xref: /PHP-5.5/Zend/zend_vm_execute.h (revision 9031a902)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1998-2015 Zend Technologies Ltd. (http://www.zend.com) |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@zend.com>                                |
16    |          Zeev Suraski <zeev@zend.com>                                |
17    |          Dmitry Stogov <dmitry@zend.com>                             |
18    +----------------------------------------------------------------------+
19 */
20 
21 #ifdef ZEND_WIN32
22 # pragma warning(once : 4101)
23 # pragma warning(once : 6235)
24 # pragma warning(once : 6237)
25 # pragma warning(once : 6239)
26 # pragma warning(once : 6240)
27 # pragma warning(once : 6285)
28 # pragma warning(once : 6286)
29 # pragma warning(once : 6326)
30 #endif
31 static user_opcode_handler_t zend_user_opcode_handlers[256] = {
32 	(user_opcode_handler_t)NULL,
33 	(user_opcode_handler_t)NULL,
34 	(user_opcode_handler_t)NULL,
35 	(user_opcode_handler_t)NULL,
36 	(user_opcode_handler_t)NULL,
37 	(user_opcode_handler_t)NULL,
38 	(user_opcode_handler_t)NULL,
39 	(user_opcode_handler_t)NULL,
40 	(user_opcode_handler_t)NULL,
41 	(user_opcode_handler_t)NULL,
42 	(user_opcode_handler_t)NULL,
43 	(user_opcode_handler_t)NULL,
44 	(user_opcode_handler_t)NULL,
45 	(user_opcode_handler_t)NULL,
46 	(user_opcode_handler_t)NULL,
47 	(user_opcode_handler_t)NULL,
48 	(user_opcode_handler_t)NULL,
49 	(user_opcode_handler_t)NULL,
50 	(user_opcode_handler_t)NULL,
51 	(user_opcode_handler_t)NULL,
52 	(user_opcode_handler_t)NULL,
53 	(user_opcode_handler_t)NULL,
54 	(user_opcode_handler_t)NULL,
55 	(user_opcode_handler_t)NULL,
56 	(user_opcode_handler_t)NULL,
57 	(user_opcode_handler_t)NULL,
58 	(user_opcode_handler_t)NULL,
59 	(user_opcode_handler_t)NULL,
60 	(user_opcode_handler_t)NULL,
61 	(user_opcode_handler_t)NULL,
62 	(user_opcode_handler_t)NULL,
63 	(user_opcode_handler_t)NULL,
64 	(user_opcode_handler_t)NULL,
65 	(user_opcode_handler_t)NULL,
66 	(user_opcode_handler_t)NULL,
67 	(user_opcode_handler_t)NULL,
68 	(user_opcode_handler_t)NULL,
69 	(user_opcode_handler_t)NULL,
70 	(user_opcode_handler_t)NULL,
71 	(user_opcode_handler_t)NULL,
72 	(user_opcode_handler_t)NULL,
73 	(user_opcode_handler_t)NULL,
74 	(user_opcode_handler_t)NULL,
75 	(user_opcode_handler_t)NULL,
76 	(user_opcode_handler_t)NULL,
77 	(user_opcode_handler_t)NULL,
78 	(user_opcode_handler_t)NULL,
79 	(user_opcode_handler_t)NULL,
80 	(user_opcode_handler_t)NULL,
81 	(user_opcode_handler_t)NULL,
82 	(user_opcode_handler_t)NULL,
83 	(user_opcode_handler_t)NULL,
84 	(user_opcode_handler_t)NULL,
85 	(user_opcode_handler_t)NULL,
86 	(user_opcode_handler_t)NULL,
87 	(user_opcode_handler_t)NULL,
88 	(user_opcode_handler_t)NULL,
89 	(user_opcode_handler_t)NULL,
90 	(user_opcode_handler_t)NULL,
91 	(user_opcode_handler_t)NULL,
92 	(user_opcode_handler_t)NULL,
93 	(user_opcode_handler_t)NULL,
94 	(user_opcode_handler_t)NULL,
95 	(user_opcode_handler_t)NULL,
96 	(user_opcode_handler_t)NULL,
97 	(user_opcode_handler_t)NULL,
98 	(user_opcode_handler_t)NULL,
99 	(user_opcode_handler_t)NULL,
100 	(user_opcode_handler_t)NULL,
101 	(user_opcode_handler_t)NULL,
102 	(user_opcode_handler_t)NULL,
103 	(user_opcode_handler_t)NULL,
104 	(user_opcode_handler_t)NULL,
105 	(user_opcode_handler_t)NULL,
106 	(user_opcode_handler_t)NULL,
107 	(user_opcode_handler_t)NULL,
108 	(user_opcode_handler_t)NULL,
109 	(user_opcode_handler_t)NULL,
110 	(user_opcode_handler_t)NULL,
111 	(user_opcode_handler_t)NULL,
112 	(user_opcode_handler_t)NULL,
113 	(user_opcode_handler_t)NULL,
114 	(user_opcode_handler_t)NULL,
115 	(user_opcode_handler_t)NULL,
116 	(user_opcode_handler_t)NULL,
117 	(user_opcode_handler_t)NULL,
118 	(user_opcode_handler_t)NULL,
119 	(user_opcode_handler_t)NULL,
120 	(user_opcode_handler_t)NULL,
121 	(user_opcode_handler_t)NULL,
122 	(user_opcode_handler_t)NULL,
123 	(user_opcode_handler_t)NULL,
124 	(user_opcode_handler_t)NULL,
125 	(user_opcode_handler_t)NULL,
126 	(user_opcode_handler_t)NULL,
127 	(user_opcode_handler_t)NULL,
128 	(user_opcode_handler_t)NULL,
129 	(user_opcode_handler_t)NULL,
130 	(user_opcode_handler_t)NULL,
131 	(user_opcode_handler_t)NULL,
132 	(user_opcode_handler_t)NULL,
133 	(user_opcode_handler_t)NULL,
134 	(user_opcode_handler_t)NULL,
135 	(user_opcode_handler_t)NULL,
136 	(user_opcode_handler_t)NULL,
137 	(user_opcode_handler_t)NULL,
138 	(user_opcode_handler_t)NULL,
139 	(user_opcode_handler_t)NULL,
140 	(user_opcode_handler_t)NULL,
141 	(user_opcode_handler_t)NULL,
142 	(user_opcode_handler_t)NULL,
143 	(user_opcode_handler_t)NULL,
144 	(user_opcode_handler_t)NULL,
145 	(user_opcode_handler_t)NULL,
146 	(user_opcode_handler_t)NULL,
147 	(user_opcode_handler_t)NULL,
148 	(user_opcode_handler_t)NULL,
149 	(user_opcode_handler_t)NULL,
150 	(user_opcode_handler_t)NULL,
151 	(user_opcode_handler_t)NULL,
152 	(user_opcode_handler_t)NULL,
153 	(user_opcode_handler_t)NULL,
154 	(user_opcode_handler_t)NULL,
155 	(user_opcode_handler_t)NULL,
156 	(user_opcode_handler_t)NULL,
157 	(user_opcode_handler_t)NULL,
158 	(user_opcode_handler_t)NULL,
159 	(user_opcode_handler_t)NULL,
160 	(user_opcode_handler_t)NULL,
161 	(user_opcode_handler_t)NULL,
162 	(user_opcode_handler_t)NULL,
163 	(user_opcode_handler_t)NULL,
164 	(user_opcode_handler_t)NULL,
165 	(user_opcode_handler_t)NULL,
166 	(user_opcode_handler_t)NULL,
167 	(user_opcode_handler_t)NULL,
168 	(user_opcode_handler_t)NULL,
169 	(user_opcode_handler_t)NULL,
170 	(user_opcode_handler_t)NULL,
171 	(user_opcode_handler_t)NULL,
172 	(user_opcode_handler_t)NULL,
173 	(user_opcode_handler_t)NULL,
174 	(user_opcode_handler_t)NULL,
175 	(user_opcode_handler_t)NULL,
176 	(user_opcode_handler_t)NULL,
177 	(user_opcode_handler_t)NULL,
178 	(user_opcode_handler_t)NULL,
179 	(user_opcode_handler_t)NULL,
180 	(user_opcode_handler_t)NULL,
181 	(user_opcode_handler_t)NULL,
182 	(user_opcode_handler_t)NULL,
183 	(user_opcode_handler_t)NULL,
184 	(user_opcode_handler_t)NULL,
185 	(user_opcode_handler_t)NULL,
186 	(user_opcode_handler_t)NULL,
187 	(user_opcode_handler_t)NULL,
188 	(user_opcode_handler_t)NULL,
189 	(user_opcode_handler_t)NULL,
190 	(user_opcode_handler_t)NULL,
191 	(user_opcode_handler_t)NULL,
192 	(user_opcode_handler_t)NULL,
193 	(user_opcode_handler_t)NULL,
194 	(user_opcode_handler_t)NULL,
195 	(user_opcode_handler_t)NULL,
196 	(user_opcode_handler_t)NULL,
197 	(user_opcode_handler_t)NULL,
198 	(user_opcode_handler_t)NULL,
199 	(user_opcode_handler_t)NULL,
200 	(user_opcode_handler_t)NULL,
201 	(user_opcode_handler_t)NULL,
202 	(user_opcode_handler_t)NULL,
203 	(user_opcode_handler_t)NULL,
204 	(user_opcode_handler_t)NULL,
205 	(user_opcode_handler_t)NULL,
206 	(user_opcode_handler_t)NULL,
207 	(user_opcode_handler_t)NULL,
208 	(user_opcode_handler_t)NULL,
209 	(user_opcode_handler_t)NULL,
210 	(user_opcode_handler_t)NULL,
211 	(user_opcode_handler_t)NULL,
212 	(user_opcode_handler_t)NULL,
213 	(user_opcode_handler_t)NULL,
214 	(user_opcode_handler_t)NULL,
215 	(user_opcode_handler_t)NULL,
216 	(user_opcode_handler_t)NULL,
217 	(user_opcode_handler_t)NULL,
218 	(user_opcode_handler_t)NULL,
219 	(user_opcode_handler_t)NULL,
220 	(user_opcode_handler_t)NULL,
221 	(user_opcode_handler_t)NULL,
222 	(user_opcode_handler_t)NULL,
223 	(user_opcode_handler_t)NULL,
224 	(user_opcode_handler_t)NULL,
225 	(user_opcode_handler_t)NULL,
226 	(user_opcode_handler_t)NULL,
227 	(user_opcode_handler_t)NULL,
228 	(user_opcode_handler_t)NULL,
229 	(user_opcode_handler_t)NULL,
230 	(user_opcode_handler_t)NULL,
231 	(user_opcode_handler_t)NULL,
232 	(user_opcode_handler_t)NULL,
233 	(user_opcode_handler_t)NULL,
234 	(user_opcode_handler_t)NULL,
235 	(user_opcode_handler_t)NULL,
236 	(user_opcode_handler_t)NULL,
237 	(user_opcode_handler_t)NULL,
238 	(user_opcode_handler_t)NULL,
239 	(user_opcode_handler_t)NULL,
240 	(user_opcode_handler_t)NULL,
241 	(user_opcode_handler_t)NULL,
242 	(user_opcode_handler_t)NULL,
243 	(user_opcode_handler_t)NULL,
244 	(user_opcode_handler_t)NULL,
245 	(user_opcode_handler_t)NULL,
246 	(user_opcode_handler_t)NULL,
247 	(user_opcode_handler_t)NULL,
248 	(user_opcode_handler_t)NULL,
249 	(user_opcode_handler_t)NULL,
250 	(user_opcode_handler_t)NULL,
251 	(user_opcode_handler_t)NULL,
252 	(user_opcode_handler_t)NULL,
253 	(user_opcode_handler_t)NULL,
254 	(user_opcode_handler_t)NULL,
255 	(user_opcode_handler_t)NULL,
256 	(user_opcode_handler_t)NULL,
257 	(user_opcode_handler_t)NULL,
258 	(user_opcode_handler_t)NULL,
259 	(user_opcode_handler_t)NULL,
260 	(user_opcode_handler_t)NULL,
261 	(user_opcode_handler_t)NULL,
262 	(user_opcode_handler_t)NULL,
263 	(user_opcode_handler_t)NULL,
264 	(user_opcode_handler_t)NULL,
265 	(user_opcode_handler_t)NULL,
266 	(user_opcode_handler_t)NULL,
267 	(user_opcode_handler_t)NULL,
268 	(user_opcode_handler_t)NULL,
269 	(user_opcode_handler_t)NULL,
270 	(user_opcode_handler_t)NULL,
271 	(user_opcode_handler_t)NULL,
272 	(user_opcode_handler_t)NULL,
273 	(user_opcode_handler_t)NULL,
274 	(user_opcode_handler_t)NULL,
275 	(user_opcode_handler_t)NULL,
276 	(user_opcode_handler_t)NULL,
277 	(user_opcode_handler_t)NULL,
278 	(user_opcode_handler_t)NULL,
279 	(user_opcode_handler_t)NULL,
280 	(user_opcode_handler_t)NULL,
281 	(user_opcode_handler_t)NULL,
282 	(user_opcode_handler_t)NULL,
283 	(user_opcode_handler_t)NULL,
284 	(user_opcode_handler_t)NULL,
285 	(user_opcode_handler_t)NULL,
286 	(user_opcode_handler_t)NULL,
287 	(user_opcode_handler_t)NULL
288 };
289 
290 static zend_uchar zend_user_opcodes[256] = {0,
291 	1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,
292 	17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,
293 	33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,
294 	49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,
295 	65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,
296 	81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,
297 	97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,
298 	113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,
299 	129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,
300 	145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,
301 	161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,
302 	177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,
303 	193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,
304 	209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,
305 	225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,
306 	241,242,243,244,245,246,247,248,249,250,251,252,253,254,255
307 };
308 
309 static opcode_handler_t zend_vm_get_opcode_handler(zend_uchar opcode, zend_op* op);
310 
311 
312 #undef OPLINE
313 #undef DCL_OPLINE
314 #undef USE_OPLINE
315 #undef LOAD_OPLINE
316 #undef SAVE_OPLINE
317 #define OPLINE EX(opline)
318 #define DCL_OPLINE
319 #define USE_OPLINE zend_op *opline = EX(opline);
320 #define LOAD_OPLINE()
321 #define SAVE_OPLINE()
322 #undef CHECK_EXCEPTION
323 #undef HANDLE_EXCEPTION
324 #undef HANDLE_EXCEPTION_LEAVE
325 #define CHECK_EXCEPTION() LOAD_OPLINE()
326 #define HANDLE_EXCEPTION() LOAD_OPLINE(); ZEND_VM_CONTINUE()
327 #define HANDLE_EXCEPTION_LEAVE() LOAD_OPLINE(); ZEND_VM_LEAVE()
328 #define LOAD_REGS()
329 #define ZEND_VM_CONTINUE()         return 0
330 #define ZEND_VM_RETURN()           return 1
331 #define ZEND_VM_ENTER()            return 2
332 #define ZEND_VM_LEAVE()            return 3
333 #define ZEND_VM_DISPATCH(opcode, opline) return zend_vm_get_opcode_handler(opcode, opline)(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
334 
335 #define ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_INTERNAL execute_data TSRMLS_CC
336 
execute_ex(zend_execute_data * execute_data TSRMLS_DC)337 ZEND_API void execute_ex(zend_execute_data *execute_data TSRMLS_DC)
338 {
339 	DCL_OPLINE
340 	zend_bool original_in_execution;
341 
342 
343 
344 	original_in_execution = EG(in_execution);
345 	EG(in_execution) = 1;
346 
347 	if (0) {
348 zend_vm_enter:
349 		execute_data = i_create_execute_data_from_op_array(EG(active_op_array), 1 TSRMLS_CC);
350 	}
351 
352 	LOAD_REGS();
353 	LOAD_OPLINE();
354 
355 	while (1) {
356     	int ret;
357 #ifdef ZEND_WIN32
358 		if (EG(timed_out)) {
359 			zend_timeout(0);
360 		}
361 #endif
362 
363 		if ((ret = OPLINE->handler(execute_data TSRMLS_CC)) > 0) {
364 			switch (ret) {
365 				case 1:
366 					EG(in_execution) = original_in_execution;
367 					return;
368 				case 2:
369 					goto zend_vm_enter;
370 					break;
371 				case 3:
372 					execute_data = EG(current_execute_data);
373 					break;
374 				default:
375 					break;
376 			}
377 		}
378 
379 	}
380 	zend_error_noreturn(E_ERROR, "Arrived at end of main loop which shouldn't happen");
381 }
382 
zend_execute(zend_op_array * op_array TSRMLS_DC)383 ZEND_API void zend_execute(zend_op_array *op_array TSRMLS_DC)
384 {
385 	if (EG(exception)) {
386 		return;
387 	}
388 	zend_execute_ex(i_create_execute_data_from_op_array(op_array, 0 TSRMLS_CC) TSRMLS_CC);
389 }
390 
zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)391 static int ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
392 {
393 	zend_bool nested = EX(nested);
394 	zend_op_array *op_array = EX(op_array);
395 
396 	EG(current_execute_data) = EX(prev_execute_data);
397 	EG(opline_ptr) = NULL;
398 	if (!EG(active_symbol_table)) {
399 		i_free_compiled_variables(execute_data);
400 	}
401 
402 	zend_vm_stack_free((char*)execute_data - (ZEND_MM_ALIGNED_SIZE(sizeof(temp_variable)) * op_array->T) TSRMLS_CC);
403 
404 	if ((op_array->fn_flags & ZEND_ACC_CLOSURE) && op_array->prototype) {
405 		zval_ptr_dtor((zval**)&op_array->prototype);
406 	}
407 
408 	if (nested) {
409 		execute_data = EG(current_execute_data);
410 	}
411 	if (nested) {
412 		USE_OPLINE
413 
414 		LOAD_REGS();
415 		LOAD_OPLINE();
416 		if (UNEXPECTED(opline->opcode == ZEND_INCLUDE_OR_EVAL)) {
417 
418 			EX(function_state).function = (zend_function *) EX(op_array);
419 			EX(function_state).arguments = NULL;
420 
421 			EG(opline_ptr) = &EX(opline);
422 			EG(active_op_array) = EX(op_array);
423 			EG(return_value_ptr_ptr) = EX(original_return_value);
424 			destroy_op_array(op_array TSRMLS_CC);
425 			efree(op_array);
426 			if (UNEXPECTED(EG(exception) != NULL)) {
427 				zend_throw_exception_internal(NULL TSRMLS_CC);
428 				HANDLE_EXCEPTION_LEAVE();
429 			}
430 
431 			ZEND_VM_INC_OPCODE();
432 			ZEND_VM_LEAVE();
433 		} else {
434 			EG(opline_ptr) = &EX(opline);
435 			EG(active_op_array) = EX(op_array);
436 			EG(return_value_ptr_ptr) = EX(original_return_value);
437 			if (EG(active_symbol_table)) {
438 				zend_clean_and_cache_symbol_table(EG(active_symbol_table) TSRMLS_CC);
439 			}
440 			EG(active_symbol_table) = EX(symbol_table);
441 
442 			EX(function_state).function = (zend_function *) EX(op_array);
443 			EX(function_state).arguments = NULL;
444 
445 			if (EG(This)) {
446 				if (UNEXPECTED(EG(exception) != NULL) && EX(call)->is_ctor_call) {
447 					if (EX(call)->is_ctor_result_used) {
448 						Z_DELREF_P(EG(This));
449 					}
450 					if (Z_REFCOUNT_P(EG(This)) == 1) {
451 						zend_object_store_ctor_failed(EG(This) TSRMLS_CC);
452 					}
453 				}
454 				zval_ptr_dtor(&EG(This));
455 			}
456 			EG(This) = EX(current_this);
457 			EG(scope) = EX(current_scope);
458 			EG(called_scope) = EX(current_called_scope);
459 
460 			EX(call)--;
461 
462 			zend_vm_stack_clear_multiple(1 TSRMLS_CC);
463 
464 			if (UNEXPECTED(EG(exception) != NULL)) {
465 				zend_throw_exception_internal(NULL TSRMLS_CC);
466 				if (RETURN_VALUE_USED(opline) && EX_T(opline->result.var).var.ptr) {
467 					zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
468 				}
469 				HANDLE_EXCEPTION_LEAVE();
470 			}
471 
472 			ZEND_VM_INC_OPCODE();
473 			ZEND_VM_LEAVE();
474 		}
475 	}
476 	ZEND_VM_RETURN();
477 }
478 
zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)479 static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
480 {
481 	USE_OPLINE
482 	zend_bool should_change_scope = 0;
483 	zend_function *fbc = EX(function_state).function;
484 
485 	SAVE_OPLINE();
486 	EX(object) = EX(call)->object;
487 	if (UNEXPECTED((fbc->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) != 0)) {
488 		if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_ABSTRACT) != 0)) {
489 			zend_error_noreturn(E_ERROR, "Cannot call abstract method %s::%s()", fbc->common.scope->name, fbc->common.function_name);
490 			CHECK_EXCEPTION();
491 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
492 		}
493 		if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_DEPRECATED) != 0)) {
494 			zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
495 				fbc->common.scope ? fbc->common.scope->name : "",
496 				fbc->common.scope ? "::" : "",
497 				fbc->common.function_name);
498 		}
499 	}
500 	if (fbc->common.scope &&
501 		!(fbc->common.fn_flags & ZEND_ACC_STATIC) &&
502 		!EX(object)) {
503 
504 		if (fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
505 			/* FIXME: output identifiers properly */
506 			zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically", fbc->common.scope->name, fbc->common.function_name);
507 		} else {
508 			/* FIXME: output identifiers properly */
509 			/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
510 			zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically", fbc->common.scope->name, fbc->common.function_name);
511 		}
512 	}
513 
514 	if (fbc->type == ZEND_USER_FUNCTION || fbc->common.scope) {
515 		should_change_scope = 1;
516 		EX(current_this) = EG(This);
517 		EX(current_scope) = EG(scope);
518 		EX(current_called_scope) = EG(called_scope);
519 		EG(This) = EX(object);
520 		EG(scope) = (fbc->type == ZEND_USER_FUNCTION || !EX(object)) ? fbc->common.scope : NULL;
521 		EG(called_scope) = EX(call)->called_scope;
522 	}
523 
524 	EX(function_state).arguments = zend_vm_stack_top(TSRMLS_C);
525 	zend_vm_stack_push((void*)(zend_uintptr_t)opline->extended_value TSRMLS_CC);
526 	LOAD_OPLINE();
527 
528 	if (fbc->type == ZEND_INTERNAL_FUNCTION) {
529 		if (fbc->common.arg_info) {
530 			zend_uint i=0;
531 			zval **p = (zval**)EX(function_state).arguments;
532 			ulong arg_count = opline->extended_value;
533 
534 			while (arg_count>0) {
535 				zend_verify_arg_type(fbc, ++i, *(p-arg_count), 0 TSRMLS_CC);
536 				arg_count--;
537 			}
538 		}
539 
540 		if (EXPECTED(EG(exception) == NULL)) {
541 			temp_variable *ret = &EX_T(opline->result.var);
542 
543 			MAKE_STD_ZVAL(ret->var.ptr);
544 			ZVAL_NULL(ret->var.ptr);
545 			ret->var.ptr_ptr = &ret->var.ptr;
546 			ret->var.fcall_returned_reference = (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
547 
548 			if (!zend_execute_internal) {
549 				/* saves one function call if zend_execute_internal is not used */
550 				fbc->internal_function.handler(opline->extended_value, ret->var.ptr, (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) ? &ret->var.ptr : NULL, EX(object), RETURN_VALUE_USED(opline) TSRMLS_CC);
551 			} else {
552 				zend_execute_internal(execute_data, NULL, RETURN_VALUE_USED(opline) TSRMLS_CC);
553 			}
554 
555 			if (!RETURN_VALUE_USED(opline)) {
556 				zval_ptr_dtor(&ret->var.ptr);
557 			}
558 		} else if (RETURN_VALUE_USED(opline)) {
559 			EX_T(opline->result.var).var.ptr = NULL;
560 		}
561 	} else if (fbc->type == ZEND_USER_FUNCTION) {
562 		temp_variable *ret = &EX_T(opline->result.var);
563 		EX(original_return_value) = EG(return_value_ptr_ptr);
564 		EG(active_symbol_table) = NULL;
565 		EG(active_op_array) = &fbc->op_array;
566 		EG(return_value_ptr_ptr) = NULL;
567 		if (RETURN_VALUE_USED(opline)) {
568 			ret->var.ptr = NULL;
569 			EG(return_value_ptr_ptr) = &ret->var.ptr;
570 			ret->var.ptr_ptr = &ret->var.ptr;
571 			ret->var.fcall_returned_reference = (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
572 		}
573 
574 		if (UNEXPECTED((EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
575 			if (RETURN_VALUE_USED(opline)) {
576 				ret->var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
577 				ret->var.fcall_returned_reference = 0;
578 			}
579 		} else if (EXPECTED(zend_execute_ex == execute_ex)) {
580 			if (EXPECTED(EG(exception) == NULL)) {
581 				ZEND_VM_ENTER();
582 			}
583 		} else {
584 			zend_execute(EG(active_op_array) TSRMLS_CC);
585 		}
586 
587 		EG(opline_ptr) = &EX(opline);
588 		EG(active_op_array) = EX(op_array);
589 		EG(return_value_ptr_ptr) = EX(original_return_value);
590 		if (EG(active_symbol_table)) {
591 			zend_clean_and_cache_symbol_table(EG(active_symbol_table) TSRMLS_CC);
592 		}
593 		EG(active_symbol_table) = EX(symbol_table);
594 	} else { /* ZEND_OVERLOADED_FUNCTION */
595 		MAKE_STD_ZVAL(EX_T(opline->result.var).var.ptr);
596 		ZVAL_NULL(EX_T(opline->result.var).var.ptr);
597 
598 		/* Not sure what should be done here if it's a static method */
599 		if (EXPECTED(EX(object) != NULL)) {
600 			Z_OBJ_HT_P(EX(object))->call_method(fbc->common.function_name, opline->extended_value, EX_T(opline->result.var).var.ptr, &EX_T(opline->result.var).var.ptr, EX(object), RETURN_VALUE_USED(opline) TSRMLS_CC);
601 		} else {
602 			zend_error_noreturn(E_ERROR, "Cannot call overloaded function for non-object");
603 		}
604 
605 		if (fbc->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) {
606 			efree((char*)fbc->common.function_name);
607 		}
608 		efree(fbc);
609 
610 		if (!RETURN_VALUE_USED(opline)) {
611 			zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
612 		} else {
613 			Z_UNSET_ISREF_P(EX_T(opline->result.var).var.ptr);
614 			Z_SET_REFCOUNT_P(EX_T(opline->result.var).var.ptr, 1);
615 			EX_T(opline->result.var).var.fcall_returned_reference = 0;
616 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
617 		}
618 	}
619 
620 	EX(function_state).function = (zend_function *) EX(op_array);
621 	EX(function_state).arguments = NULL;
622 
623 	if (should_change_scope) {
624 		if (EG(This)) {
625 			if (UNEXPECTED(EG(exception) != NULL) && EX(call)->is_ctor_call) {
626 				if (EX(call)->is_ctor_result_used) {
627 					Z_DELREF_P(EG(This));
628 				}
629 				if (Z_REFCOUNT_P(EG(This)) == 1) {
630 					zend_object_store_ctor_failed(EG(This) TSRMLS_CC);
631 				}
632 			}
633 			zval_ptr_dtor(&EG(This));
634 		}
635 		EG(This) = EX(current_this);
636 		EG(scope) = EX(current_scope);
637 		EG(called_scope) = EX(current_called_scope);
638 	}
639 
640 	EX(call)--;
641 
642 	zend_vm_stack_clear_multiple(1 TSRMLS_CC);
643 
644 	if (UNEXPECTED(EG(exception) != NULL)) {
645 		zend_throw_exception_internal(NULL TSRMLS_CC);
646 		if (RETURN_VALUE_USED(opline) && EX_T(opline->result.var).var.ptr) {
647 			zval_ptr_dtor(&EX_T(opline->result.var).var.ptr);
648 		}
649 		HANDLE_EXCEPTION();
650 	}
651 
652 	ZEND_VM_NEXT_OPCODE();
653 }
654 
ZEND_JMP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)655 static int ZEND_FASTCALL  ZEND_JMP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
656 {
657 	USE_OPLINE
658 
659 #if DEBUG_ZEND>=2
660 	printf("Jumping to %d\n", opline->op1.opline_num);
661 #endif
662 	ZEND_VM_SET_OPCODE(opline->op1.jmp_addr);
663 	ZEND_VM_CONTINUE();
664 }
665 
ZEND_INIT_STRING_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)666 static int ZEND_FASTCALL  ZEND_INIT_STRING_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
667 {
668 	USE_OPLINE
669 	zval *tmp = &EX_T(opline->result.var).tmp_var;
670 
671 	SAVE_OPLINE();
672 	tmp->value.str.val = emalloc(1);
673 	tmp->value.str.val[0] = 0;
674 	tmp->value.str.len = 0;
675 	Z_SET_REFCOUNT_P(tmp, 1);
676 	tmp->type = IS_STRING;
677 	Z_UNSET_ISREF_P(tmp);
678 	/*CHECK_EXCEPTION();*/
679 	ZEND_VM_NEXT_OPCODE();
680 }
681 
ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)682 static int ZEND_FASTCALL  ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
683 {
684 	EX(function_state).function = EX(call)->fbc;
685 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
686 }
687 
ZEND_GENERATOR_RETURN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)688 static int ZEND_FASTCALL  ZEND_GENERATOR_RETURN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
689 {
690 	/* The generator object is stored in return_value_ptr_ptr */
691 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
692 
693 	/* Close the generator to free up resources */
694 	zend_generator_close(generator, 1 TSRMLS_CC);
695 
696 	/* Pass execution back to handling code */
697 	ZEND_VM_RETURN();
698 }
699 
ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)700 static int ZEND_FASTCALL  ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
701 {
702 	USE_OPLINE
703 	zend_uint arg_num = opline->op1.num;
704 	zval **param = zend_vm_stack_get_arg(arg_num TSRMLS_CC);
705 
706 	SAVE_OPLINE();
707 	if (UNEXPECTED(param == NULL)) {
708 		if (zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, NULL, opline->extended_value TSRMLS_CC)) {
709 			const char *space;
710 			const char *class_name;
711 			zend_execute_data *ptr;
712 
713 			if (EG(active_op_array)->scope) {
714 				class_name = EG(active_op_array)->scope->name;
715 				space = "::";
716 			} else {
717 				class_name = space = "";
718 			}
719 			ptr = EX(prev_execute_data);
720 
721 			if(ptr && ptr->op_array) {
722 				zend_error(E_WARNING, "Missing argument %u for %s%s%s(), called in %s on line %d and defined", opline->op1.num, class_name, space, get_active_function_name(TSRMLS_C), ptr->op_array->filename, ptr->opline->lineno);
723 			} else {
724 				zend_error(E_WARNING, "Missing argument %u for %s%s%s()", opline->op1.num, class_name, space, get_active_function_name(TSRMLS_C));
725 			}
726 		}
727 	} else {
728 		zval **var_ptr;
729 
730 		zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, *param, opline->extended_value TSRMLS_CC);
731 		var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->result.var TSRMLS_CC);
732 		Z_DELREF_PP(var_ptr);
733 		*var_ptr = *param;
734 		Z_ADDREF_PP(var_ptr);
735 	}
736 
737 	CHECK_EXCEPTION();
738 	ZEND_VM_NEXT_OPCODE();
739 }
740 
ZEND_NEW_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)741 static int ZEND_FASTCALL  ZEND_NEW_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
742 {
743 	USE_OPLINE
744 	zval *object_zval;
745 	zend_function *constructor;
746 
747 	SAVE_OPLINE();
748 	if (UNEXPECTED((EX_T(opline->op1.var).class_entry->ce_flags & (ZEND_ACC_INTERFACE|ZEND_ACC_IMPLICIT_ABSTRACT_CLASS|ZEND_ACC_EXPLICIT_ABSTRACT_CLASS)) != 0)) {
749 		if (EX_T(opline->op1.var).class_entry->ce_flags & ZEND_ACC_INTERFACE) {
750 			zend_error_noreturn(E_ERROR, "Cannot instantiate interface %s", EX_T(opline->op1.var).class_entry->name);
751 		} else if ((EX_T(opline->op1.var).class_entry->ce_flags & ZEND_ACC_TRAIT) == ZEND_ACC_TRAIT) {
752 			zend_error_noreturn(E_ERROR, "Cannot instantiate trait %s", EX_T(opline->op1.var).class_entry->name);
753 		} else {
754 			zend_error_noreturn(E_ERROR, "Cannot instantiate abstract class %s", EX_T(opline->op1.var).class_entry->name);
755 		}
756 	}
757 	ALLOC_ZVAL(object_zval);
758 	object_init_ex(object_zval, EX_T(opline->op1.var).class_entry);
759 	INIT_PZVAL(object_zval);
760 
761 	constructor = Z_OBJ_HT_P(object_zval)->get_constructor(object_zval TSRMLS_CC);
762 
763 	if (constructor == NULL) {
764 		if (RETURN_VALUE_USED(opline)) {
765 			AI_SET_PTR(&EX_T(opline->result.var), object_zval);
766 		} else {
767 			zval_ptr_dtor(&object_zval);
768 		}
769 		ZEND_VM_JMP(EX(op_array)->opcodes + opline->op2.opline_num);
770 	} else {
771 		call_slot *call = EX(call_slots) + opline->extended_value;
772 
773 		if (RETURN_VALUE_USED(opline)) {
774 			PZVAL_LOCK(object_zval);
775 			AI_SET_PTR(&EX_T(opline->result.var), object_zval);
776 		}
777 
778 		/* We are not handling overloaded classes right now */
779 		call->fbc = constructor;
780 		call->object = object_zval;
781 		call->called_scope = EX_T(opline->op1.var).class_entry;
782 		call->is_ctor_call = 1;
783 		call->is_ctor_result_used = RETURN_VALUE_USED(opline);
784 		EX(call) = call;
785 
786 		CHECK_EXCEPTION();
787 		ZEND_VM_NEXT_OPCODE();
788 	}
789 }
790 
ZEND_BEGIN_SILENCE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)791 static int ZEND_FASTCALL  ZEND_BEGIN_SILENCE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
792 {
793 	USE_OPLINE
794 
795 	SAVE_OPLINE();
796 	Z_LVAL(EX_T(opline->result.var).tmp_var) = EG(error_reporting);
797 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_LONG;  /* shouldn't be necessary */
798 	if (EX(old_error_reporting) == NULL) {
799 		EX(old_error_reporting) = &EX_T(opline->result.var).tmp_var;
800 	}
801 
802 	if (EG(error_reporting)) {
803 		do {
804 			EG(error_reporting) = 0;
805 			if (!EG(error_reporting_ini_entry)) {
806 				if (UNEXPECTED(zend_hash_find(EG(ini_directives), "error_reporting", sizeof("error_reporting"), (void **) &EG(error_reporting_ini_entry)) == FAILURE)) {
807 					break;
808 				}
809 			}
810 			if (!EG(error_reporting_ini_entry)->modified) {
811 				if (!EG(modified_ini_directives)) {
812 					ALLOC_HASHTABLE(EG(modified_ini_directives));
813 					zend_hash_init(EG(modified_ini_directives), 8, NULL, NULL, 0);
814 				}
815 				if (EXPECTED(zend_hash_add(EG(modified_ini_directives), "error_reporting", sizeof("error_reporting"), &EG(error_reporting_ini_entry), sizeof(zend_ini_entry*), NULL) == SUCCESS)) {
816 					EG(error_reporting_ini_entry)->orig_value = EG(error_reporting_ini_entry)->value;
817 					EG(error_reporting_ini_entry)->orig_value_length = EG(error_reporting_ini_entry)->value_length;
818 					EG(error_reporting_ini_entry)->orig_modifiable = EG(error_reporting_ini_entry)->modifiable;
819 					EG(error_reporting_ini_entry)->modified = 1;
820 				}
821 			} else if (EG(error_reporting_ini_entry)->value != EG(error_reporting_ini_entry)->orig_value) {
822 				efree(EG(error_reporting_ini_entry)->value);
823 			}
824 			EG(error_reporting_ini_entry)->value = estrndup("0", sizeof("0")-1);
825 			EG(error_reporting_ini_entry)->value_length = sizeof("0")-1;
826 		} while (0);
827 	}
828 	CHECK_EXCEPTION();
829 	ZEND_VM_NEXT_OPCODE();
830 }
831 
ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)832 static int ZEND_FASTCALL  ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
833 {
834 	SAVE_OPLINE();
835 	zend_error_noreturn(E_ERROR, "Cannot call abstract method %s::%s()", EG(scope)->name, EX(op_array)->function_name);
836 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
837 }
838 
ZEND_EXT_STMT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)839 static int ZEND_FASTCALL  ZEND_EXT_STMT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
840 {
841 	SAVE_OPLINE();
842 	if (!EG(no_extensions)) {
843 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_statement_handler, EX(op_array) TSRMLS_CC);
844 	}
845 	CHECK_EXCEPTION();
846 	ZEND_VM_NEXT_OPCODE();
847 }
848 
ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)849 static int ZEND_FASTCALL  ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
850 {
851 	SAVE_OPLINE();
852 	if (!EG(no_extensions)) {
853 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_fcall_begin_handler, EX(op_array) TSRMLS_CC);
854 	}
855 	CHECK_EXCEPTION();
856 	ZEND_VM_NEXT_OPCODE();
857 }
858 
ZEND_EXT_FCALL_END_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)859 static int ZEND_FASTCALL  ZEND_EXT_FCALL_END_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
860 {
861 	SAVE_OPLINE();
862 	if (!EG(no_extensions)) {
863 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_fcall_end_handler, EX(op_array) TSRMLS_CC);
864 	}
865 	CHECK_EXCEPTION();
866 	ZEND_VM_NEXT_OPCODE();
867 }
868 
ZEND_DECLARE_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)869 static int ZEND_FASTCALL  ZEND_DECLARE_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
870 {
871 	USE_OPLINE
872 
873 	SAVE_OPLINE();
874 	EX_T(opline->result.var).class_entry = do_bind_class(EX(op_array), opline, EG(class_table), 0 TSRMLS_CC);
875 	CHECK_EXCEPTION();
876 	ZEND_VM_NEXT_OPCODE();
877 }
878 
ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)879 static int ZEND_FASTCALL  ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
880 {
881 	USE_OPLINE
882 
883 	SAVE_OPLINE();
884 	EX_T(opline->result.var).class_entry = do_bind_inherited_class(EX(op_array), opline, EG(class_table), EX_T(opline->extended_value).class_entry, 0 TSRMLS_CC);
885 	CHECK_EXCEPTION();
886 	ZEND_VM_NEXT_OPCODE();
887 }
888 
ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)889 static int ZEND_FASTCALL  ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
890 {
891 	USE_OPLINE
892 	zend_class_entry **pce, **pce_orig;
893 
894 	SAVE_OPLINE();
895 	if (zend_hash_quick_find(EG(class_table), Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void**)&pce) == FAILURE ||
896 	    (zend_hash_quick_find(EG(class_table), Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), Z_HASH_P(opline->op1.zv), (void**)&pce_orig) == SUCCESS &&
897 	     *pce != *pce_orig)) {
898 		do_bind_inherited_class(EX(op_array), opline, EG(class_table), EX_T(opline->extended_value).class_entry, 0 TSRMLS_CC);
899 	}
900 	CHECK_EXCEPTION();
901 	ZEND_VM_NEXT_OPCODE();
902 }
903 
ZEND_DECLARE_FUNCTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)904 static int ZEND_FASTCALL  ZEND_DECLARE_FUNCTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
905 {
906 	USE_OPLINE
907 
908 	SAVE_OPLINE();
909 	do_bind_function(EX(op_array), opline, EG(function_table), 0);
910 	CHECK_EXCEPTION();
911 	ZEND_VM_NEXT_OPCODE();
912 }
913 
ZEND_TICKS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)914 static int ZEND_FASTCALL  ZEND_TICKS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
915 {
916 	USE_OPLINE
917 
918 	SAVE_OPLINE();
919 	if (++EG(ticks_count)>=opline->extended_value) {
920 		EG(ticks_count)=0;
921 		if (zend_ticks_function) {
922 			zend_ticks_function(opline->extended_value);
923 		}
924 	}
925 	CHECK_EXCEPTION();
926 	ZEND_VM_NEXT_OPCODE();
927 }
928 
ZEND_EXT_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)929 static int ZEND_FASTCALL  ZEND_EXT_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
930 {
931 	ZEND_VM_NEXT_OPCODE();
932 }
933 
ZEND_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)934 static int ZEND_FASTCALL  ZEND_NOP_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
935 {
936 	ZEND_VM_NEXT_OPCODE();
937 }
938 
ZEND_ADD_TRAIT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)939 static int ZEND_FASTCALL  ZEND_ADD_TRAIT_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
940 {
941 	USE_OPLINE
942 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
943 	zend_class_entry *trait;
944 
945 	SAVE_OPLINE();
946 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
947 		trait = CACHED_PTR(opline->op2.literal->cache_slot);
948 	} else {
949 		trait = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv),
950 		                                 Z_STRLEN_P(opline->op2.zv),
951 		                                 opline->op2.literal + 1,
952 		                                 opline->extended_value TSRMLS_CC);
953 		if (UNEXPECTED(trait == NULL)) {
954 			CHECK_EXCEPTION();
955 			ZEND_VM_NEXT_OPCODE();
956 		}
957 		if (!((trait->ce_flags & ZEND_ACC_TRAIT) == ZEND_ACC_TRAIT)) {
958 			zend_error_noreturn(E_ERROR, "%s cannot use %s - it is not a trait", ce->name, trait->name);
959 		}
960 		CACHE_PTR(opline->op2.literal->cache_slot, trait);
961 	}
962 
963 	zend_do_implement_trait(ce, trait TSRMLS_CC);
964 
965  	CHECK_EXCEPTION();
966 	ZEND_VM_NEXT_OPCODE();
967 }
968 
ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)969 static int ZEND_FASTCALL  ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
970 {
971 	USE_OPLINE
972 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
973 
974 	SAVE_OPLINE();
975 	zend_do_bind_traits(ce TSRMLS_CC);
976  	CHECK_EXCEPTION();
977 	ZEND_VM_NEXT_OPCODE();
978 }
979 
ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)980 static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
981 {
982 	zend_uint op_num = EG(opline_before_exception)-EG(active_op_array)->opcodes;
983 	int i;
984 	zend_uint catch_op_num = 0, finally_op_num = 0;
985 	void **stack_frame;
986 
987 	/* Figure out where the next stack frame (which maybe contains pushed
988 	 * arguments that have to be dtor'ed) starts */
989 	stack_frame = zend_vm_stack_frame_base(execute_data);
990 
991 	/* If the exception was thrown during a function call there might be
992 	 * arguments pushed to the stack that have to be dtor'ed. */
993 	while (zend_vm_stack_top(TSRMLS_C) != stack_frame) {
994 		zval *stack_zval_p = zend_vm_stack_pop(TSRMLS_C);
995 		zval_ptr_dtor(&stack_zval_p);
996 	}
997 
998 	for (i=0; i<EG(active_op_array)->last_try_catch; i++) {
999 		if (EG(active_op_array)->try_catch_array[i].try_op > op_num) {
1000 			/* further blocks will not be relevant... */
1001 			break;
1002 		}
1003 		if (op_num < EG(active_op_array)->try_catch_array[i].catch_op) {
1004 			catch_op_num = EX(op_array)->try_catch_array[i].catch_op;
1005 		}
1006 		if (op_num < EG(active_op_array)->try_catch_array[i].finally_op) {
1007 			finally_op_num = EX(op_array)->try_catch_array[i].finally_op;
1008 		}
1009 	}
1010 
1011 	if (EX(call) >= EX(call_slots)) {
1012 		call_slot *call = EX(call);
1013 		do {
1014 			if (call->object) {
1015 				if (call->is_ctor_call) {
1016 					if (call->is_ctor_result_used) {
1017 						Z_DELREF_P(call->object);
1018 					}
1019 					if (Z_REFCOUNT_P(call->object) == 1) {
1020 						zend_object_store_ctor_failed(call->object TSRMLS_CC);
1021 					}
1022 				}
1023 				zval_ptr_dtor(&call->object);
1024 			}
1025 			if (call->fbc->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) {
1026 				efree((char *) call->fbc->common.function_name);
1027 				efree(call->fbc);
1028 			}
1029 			call--;
1030 		} while (call >= EX(call_slots));
1031 		EX(call) = NULL;
1032 	}
1033 
1034 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
1035 		if (EX(op_array)->brk_cont_array[i].start < 0) {
1036 			continue;
1037 		} else if (EX(op_array)->brk_cont_array[i].start > op_num) {
1038 			/* further blocks will not be relevant... */
1039 			break;
1040 		} else if (op_num < EX(op_array)->brk_cont_array[i].brk) {
1041 			if (!catch_op_num ||
1042 			    catch_op_num >= EX(op_array)->brk_cont_array[i].brk) {
1043 				zend_op *brk_opline = &EX(op_array)->opcodes[EX(op_array)->brk_cont_array[i].brk];
1044 
1045 				switch (brk_opline->opcode) {
1046 					case ZEND_SWITCH_FREE:
1047 						if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1048 							zval_ptr_dtor(&EX_T(brk_opline->op1.var).var.ptr);
1049 						}
1050 						break;
1051 					case ZEND_FREE:
1052 						if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1053 							zendi_zval_dtor(EX_T(brk_opline->op1.var).tmp_var);
1054 						}
1055 						break;
1056 				}
1057 			}
1058 		}
1059 	}
1060 
1061 	/* restore previous error_reporting value */
1062 	if (!EG(error_reporting) && EX(old_error_reporting) != NULL && Z_LVAL_P(EX(old_error_reporting)) != 0) {
1063 		zval restored_error_reporting;
1064 
1065 		Z_TYPE(restored_error_reporting) = IS_LONG;
1066 		Z_LVAL(restored_error_reporting) = Z_LVAL_P(EX(old_error_reporting));
1067 		convert_to_string(&restored_error_reporting);
1068 		zend_alter_ini_entry_ex("error_reporting", sizeof("error_reporting"), Z_STRVAL(restored_error_reporting), Z_STRLEN(restored_error_reporting), ZEND_INI_USER, ZEND_INI_STAGE_RUNTIME, 1 TSRMLS_CC);
1069 		zendi_zval_dtor(restored_error_reporting);
1070 	}
1071 	EX(old_error_reporting) = NULL;
1072 
1073 	if (finally_op_num && (!catch_op_num || catch_op_num >= finally_op_num)) {
1074 		zend_exception_save(TSRMLS_C);
1075 		EX(fast_ret) = NULL;
1076 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[finally_op_num]);
1077 		ZEND_VM_CONTINUE();
1078 	} else if (catch_op_num) {
1079 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[catch_op_num]);
1080 		ZEND_VM_CONTINUE();
1081 	} else {
1082 		if (UNEXPECTED((EX(op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
1083 			return ZEND_GENERATOR_RETURN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1084 		} else {
1085 			return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1086 		}
1087 	}
1088 }
1089 
ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1090 static int ZEND_FASTCALL  ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1091 {
1092 	USE_OPLINE
1093 
1094 	SAVE_OPLINE();
1095 	zend_verify_abstract_class(EX_T(opline->op1.var).class_entry TSRMLS_CC);
1096 	CHECK_EXCEPTION();
1097 	ZEND_VM_NEXT_OPCODE();
1098 }
1099 
ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1100 static int ZEND_FASTCALL  ZEND_USER_OPCODE_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1101 {
1102 	USE_OPLINE
1103 	int ret;
1104 
1105 	SAVE_OPLINE();
1106 	ret = zend_user_opcode_handlers[opline->opcode](ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_INTERNAL);
1107 	LOAD_OPLINE();
1108 
1109 	switch (ret) {
1110 		case ZEND_USER_OPCODE_CONTINUE:
1111 			ZEND_VM_CONTINUE();
1112 		case ZEND_USER_OPCODE_RETURN:
1113 			if (UNEXPECTED((EX(op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
1114 				return ZEND_GENERATOR_RETURN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1115 			} else {
1116 				return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1117 			}
1118 		case ZEND_USER_OPCODE_ENTER:
1119 			ZEND_VM_ENTER();
1120 		case ZEND_USER_OPCODE_LEAVE:
1121 			ZEND_VM_LEAVE();
1122 		case ZEND_USER_OPCODE_DISPATCH:
1123 			ZEND_VM_DISPATCH(opline->opcode, opline);
1124 		default:
1125 			ZEND_VM_DISPATCH((zend_uchar)(ret & 0xff), opline);
1126 	}
1127 }
1128 
ZEND_DISCARD_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1129 static int ZEND_FASTCALL  ZEND_DISCARD_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1130 {
1131 	if (EG(prev_exception) != NULL) {
1132 		/* discard the previously thrown exception */
1133 		zval_ptr_dtor(&EG(prev_exception));
1134 		EG(prev_exception) = NULL;
1135 	}
1136 
1137 	ZEND_VM_NEXT_OPCODE();
1138 }
1139 
ZEND_FAST_CALL_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1140 static int ZEND_FASTCALL  ZEND_FAST_CALL_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1141 {
1142 	USE_OPLINE
1143 
1144 	if ((opline->extended_value & ZEND_FAST_CALL_FROM_CATCH) &&
1145 	    UNEXPECTED(EG(prev_exception) != NULL)) {
1146 	    /* in case of unhandled exception jump to catch block instead of finally */
1147 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
1148 		ZEND_VM_CONTINUE();
1149 	}
1150 	EX(fast_ret) = opline;
1151 	ZEND_VM_SET_OPCODE(opline->op1.jmp_addr);
1152 	ZEND_VM_CONTINUE();
1153 }
1154 
ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1155 static int ZEND_FASTCALL  ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1156 {
1157 	if (EX(fast_ret)) {
1158 		ZEND_VM_SET_OPCODE(EX(fast_ret) + 1);
1159 		if ((EX(fast_ret)->extended_value & ZEND_FAST_CALL_FROM_FINALLY)) {
1160 			EX(fast_ret) = &EX(op_array)->opcodes[EX(fast_ret)->op2.opline_num];
1161 		}
1162 		ZEND_VM_CONTINUE();
1163 	} else {
1164 		/* special case for unhandled exceptions */
1165 		USE_OPLINE
1166 
1167 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
1168 			ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
1169 			ZEND_VM_CONTINUE();
1170 		} else if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
1171 			zend_exception_restore(TSRMLS_C);
1172 			ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
1173 			ZEND_VM_CONTINUE();
1174 		} else if (UNEXPECTED((EX(op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
1175 			zend_exception_restore(TSRMLS_C);
1176 			return ZEND_GENERATOR_RETURN_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1177 		} else {
1178 			zend_exception_restore(TSRMLS_C);
1179 			return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
1180 		}
1181 	}
1182 }
1183 
ZEND_FETCH_CLASS_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1184 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1185 {
1186 	USE_OPLINE
1187 
1188 	SAVE_OPLINE();
1189 	if (EG(exception)) {
1190 		zend_exception_save(TSRMLS_C);
1191 	}
1192 	if (IS_CONST == IS_UNUSED) {
1193 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1194 		CHECK_EXCEPTION();
1195 		ZEND_VM_NEXT_OPCODE();
1196 	} else {
1197 
1198 		zval *class_name = opline->op2.zv;
1199 
1200 		if (IS_CONST == IS_CONST) {
1201 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1202 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1203 			} else {
1204 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1205 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1206 			}
1207 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1208 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1209 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1210 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1211 		} else {
1212 			if (UNEXPECTED(EG(exception) != NULL)) {
1213 				HANDLE_EXCEPTION();
1214 			}
1215 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1216 		}
1217 
1218 		CHECK_EXCEPTION();
1219 		ZEND_VM_NEXT_OPCODE();
1220 	}
1221 }
1222 
ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1223 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1224 {
1225 	USE_OPLINE
1226 	zval *function_name;
1227 	call_slot *call = EX(call_slots) + opline->result.num;
1228 
1229 	if (IS_CONST == IS_CONST) {
1230 		function_name = (zval*)(opline->op2.literal+1);
1231 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1232 			call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
1233 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &call->fbc) == FAILURE)) {
1234 			SAVE_OPLINE();
1235 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1236 		} else {
1237 			CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1238 		}
1239 		call->object = NULL;
1240 		call->called_scope = NULL;
1241 		call->is_ctor_call = 0;
1242 		EX(call) = call;
1243 		/*CHECK_EXCEPTION();*/
1244 		ZEND_VM_NEXT_OPCODE();
1245 	} else {
1246 		char *function_name_strval, *lcname;
1247 		int function_name_strlen;
1248 
1249 
1250 		SAVE_OPLINE();
1251 		function_name = opline->op2.zv;
1252 
1253 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1254 			function_name_strval = Z_STRVAL_P(function_name);
1255 			function_name_strlen = Z_STRLEN_P(function_name);
1256 			if (function_name_strval[0] == '\\') {
1257 			    function_name_strlen -= 1;
1258 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1259 			} else {
1260 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1261 			}
1262 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &call->fbc) == FAILURE)) {
1263 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1264 			}
1265 			efree(lcname);
1266 
1267 			call->object = NULL;
1268 			call->called_scope = NULL;
1269 			call->is_ctor_call = 0;
1270 			EX(call) = call;
1271 			CHECK_EXCEPTION();
1272 			ZEND_VM_NEXT_OPCODE();
1273 		} else if (IS_CONST != IS_CONST && IS_CONST != IS_TMP_VAR &&
1274 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1275 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1276 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &call->called_scope, &call->fbc, &call->object TSRMLS_CC) == SUCCESS) {
1277 			if (call->object) {
1278 				Z_ADDREF_P(call->object);
1279 			}
1280 			if (IS_CONST == IS_VAR && 0 &&
1281 			    call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
1282 				/* Delay closure destruction until its invocation */
1283 				call->fbc->common.prototype = (zend_function*)function_name;
1284 			} else {
1285 
1286 			}
1287 			call->is_ctor_call = 0;
1288 			EX(call) = call;
1289 			CHECK_EXCEPTION();
1290 			ZEND_VM_NEXT_OPCODE();
1291 		} else if (IS_CONST != IS_CONST &&
1292 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1293 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1294 			zend_class_entry *ce;
1295 			zval **method = NULL;
1296 			zval **obj = NULL;
1297 
1298 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1299 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1300 
1301 			if (!obj || !method) {
1302 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1303 			}
1304 
1305 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1306 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1307 			}
1308 
1309 			if (Z_TYPE_PP(method) != IS_STRING) {
1310 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1311 			}
1312 
1313 			if (Z_TYPE_PP(obj) == IS_STRING) {
1314 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1315 				if (UNEXPECTED(ce == NULL)) {
1316 					CHECK_EXCEPTION();
1317 					ZEND_VM_NEXT_OPCODE();
1318 				}
1319 				call->called_scope = ce;
1320 				call->object = NULL;
1321 
1322 				if (ce->get_static_method) {
1323 					call->fbc = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1324 				} else {
1325 					call->fbc = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1326 				}
1327 			} else {
1328 				call->object = *obj;
1329 				ce = call->called_scope = Z_OBJCE_PP(obj);
1330 
1331 				call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1332 				if (UNEXPECTED(call->fbc == NULL)) {
1333 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), Z_STRVAL_PP(method));
1334 				}
1335 
1336 				if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1337 					call->object = NULL;
1338 				} else {
1339 					if (!PZVAL_IS_REF(call->object)) {
1340 						Z_ADDREF_P(call->object); /* For $this pointer */
1341 					} else {
1342 						zval *this_ptr;
1343 						ALLOC_ZVAL(this_ptr);
1344 						INIT_PZVAL_COPY(this_ptr, call->object);
1345 						zval_copy_ctor(this_ptr);
1346 						call->object = this_ptr;
1347 					}
1348 				}
1349 			}
1350 
1351 			if (UNEXPECTED(call->fbc == NULL)) {
1352 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1353 			}
1354 			call->is_ctor_call = 0;
1355 			EX(call) = call;
1356 
1357 			CHECK_EXCEPTION();
1358 			ZEND_VM_NEXT_OPCODE();
1359 		} else {
1360 			if (UNEXPECTED(EG(exception) != NULL)) {
1361 				HANDLE_EXCEPTION();
1362 			}
1363 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1364 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
1365 		}
1366 	}
1367 }
1368 
1369 
ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1370 static int ZEND_FASTCALL  ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1371 {
1372 	USE_OPLINE
1373 	zend_literal *func_name;
1374 	call_slot *call = EX(call_slots) + opline->result.num;
1375 
1376 	func_name = opline->op2.literal + 1;
1377 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1378 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
1379 	} else if (zend_hash_quick_find(EG(function_table), Z_STRVAL(func_name->constant), Z_STRLEN(func_name->constant)+1, func_name->hash_value, (void **) &call->fbc)==FAILURE) {
1380 		func_name++;
1381 		if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL(func_name->constant), Z_STRLEN(func_name->constant)+1, func_name->hash_value, (void **) &call->fbc)==FAILURE)) {
1382 			SAVE_OPLINE();
1383 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1384 		} else {
1385 			CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1386 		}
1387 	} else {
1388 		CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1389 	}
1390 
1391 	call->object = NULL;
1392 	call->called_scope = NULL;
1393 	call->is_ctor_call = 0;
1394 	EX(call) = call;
1395 	ZEND_VM_NEXT_OPCODE();
1396 }
1397 
ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1398 static int ZEND_FASTCALL  ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1399 {
1400 	USE_OPLINE
1401 	zval *assignment_value;
1402 	zend_uint arg_num = opline->op1.num;
1403 	zval **param = zend_vm_stack_get_arg(arg_num TSRMLS_CC);
1404 	zval **var_ptr;
1405 
1406 	SAVE_OPLINE();
1407 	if (param == NULL) {
1408 		ALLOC_ZVAL(assignment_value);
1409 		*assignment_value = *opline->op2.zv;
1410 		if ((Z_TYPE_P(assignment_value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT ||
1411 		     Z_TYPE_P(assignment_value)==IS_CONSTANT_ARRAY) {
1412 			Z_SET_REFCOUNT_P(assignment_value, 1);
1413 			zval_update_constant(&assignment_value, 0 TSRMLS_CC);
1414 		} else {
1415 			zval_copy_ctor(assignment_value);
1416 		}
1417 		INIT_PZVAL(assignment_value);
1418 	} else {
1419 		assignment_value = *param;
1420 		Z_ADDREF_P(assignment_value);
1421 	}
1422 
1423 	zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, assignment_value, opline->extended_value TSRMLS_CC);
1424 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->result.var TSRMLS_CC);
1425 	zval_ptr_dtor(var_ptr);
1426 	*var_ptr = assignment_value;
1427 
1428 	CHECK_EXCEPTION();
1429 	ZEND_VM_NEXT_OPCODE();
1430 }
1431 
ZEND_BRK_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1432 static int ZEND_FASTCALL  ZEND_BRK_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1433 {
1434 	USE_OPLINE
1435 	zend_brk_cont_element *el;
1436 
1437 	SAVE_OPLINE();
1438 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->op1.opline_num,
1439 	                   EX(op_array), execute_data TSRMLS_CC);
1440 	ZEND_VM_JMP(EX(op_array)->opcodes + el->brk);
1441 }
1442 
ZEND_CONT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1443 static int ZEND_FASTCALL  ZEND_CONT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1444 {
1445 	USE_OPLINE
1446 	zend_brk_cont_element *el;
1447 
1448 	SAVE_OPLINE();
1449 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->op1.opline_num,
1450 	                   EX(op_array), execute_data TSRMLS_CC);
1451 	ZEND_VM_JMP(EX(op_array)->opcodes + el->cont);
1452 }
1453 
ZEND_GOTO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1454 static int ZEND_FASTCALL  ZEND_GOTO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1455 {
1456 	zend_op *brk_opline;
1457 	USE_OPLINE
1458 	zend_brk_cont_element *el;
1459 
1460 	SAVE_OPLINE();
1461 	el = zend_brk_cont(Z_LVAL_P(opline->op2.zv), opline->extended_value,
1462  	                   EX(op_array), execute_data TSRMLS_CC);
1463 
1464 	brk_opline = EX(op_array)->opcodes + el->brk;
1465 
1466 	switch (brk_opline->opcode) {
1467 		case ZEND_SWITCH_FREE:
1468 			if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1469 				zval_ptr_dtor(&EX_T(brk_opline->op1.var).var.ptr);
1470 			}
1471 			break;
1472 		case ZEND_FREE:
1473 			if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1474 				zendi_zval_dtor(EX_T(brk_opline->op1.var).tmp_var);
1475 			}
1476 			break;
1477 	}
1478 	ZEND_VM_JMP(opline->op1.jmp_addr);
1479 }
1480 
ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1481 static int ZEND_FASTCALL  ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1482 {
1483 	USE_OPLINE
1484 	zend_class_entry *ce = EX_T(opline->op1.var).class_entry;
1485 	zend_class_entry *iface;
1486 
1487 	SAVE_OPLINE();
1488 	if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1489 		iface = CACHED_PTR(opline->op2.literal->cache_slot);
1490 	} else {
1491 		iface = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1492 		if (UNEXPECTED(iface == NULL)) {
1493 			CHECK_EXCEPTION();
1494 			ZEND_VM_NEXT_OPCODE();
1495 		}
1496 		CACHE_PTR(opline->op2.literal->cache_slot, iface);
1497 	}
1498 
1499 	if (UNEXPECTED((iface->ce_flags & ZEND_ACC_INTERFACE) == 0)) {
1500 		zend_error_noreturn(E_ERROR, "%s cannot implement %s - it is not an interface", ce->name, iface->name);
1501 	}
1502 	zend_do_implement_interface(ce, iface TSRMLS_CC);
1503 
1504 	CHECK_EXCEPTION();
1505 	ZEND_VM_NEXT_OPCODE();
1506 }
1507 
ZEND_FETCH_CLASS_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1508 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1509 {
1510 	USE_OPLINE
1511 
1512 	SAVE_OPLINE();
1513 	if (EG(exception)) {
1514 		zend_exception_save(TSRMLS_C);
1515 	}
1516 	if (IS_TMP_VAR == IS_UNUSED) {
1517 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1518 		CHECK_EXCEPTION();
1519 		ZEND_VM_NEXT_OPCODE();
1520 	} else {
1521 		zend_free_op free_op2;
1522 		zval *class_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
1523 
1524 		if (IS_TMP_VAR == IS_CONST) {
1525 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1526 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1527 			} else {
1528 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1529 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1530 			}
1531 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1532 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1533 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1534 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1535 		} else {
1536 			if (UNEXPECTED(EG(exception) != NULL)) {
1537 				HANDLE_EXCEPTION();
1538 			}
1539 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1540 		}
1541 
1542 		zval_dtor(free_op2.var);
1543 		CHECK_EXCEPTION();
1544 		ZEND_VM_NEXT_OPCODE();
1545 	}
1546 }
1547 
ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1548 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1549 {
1550 	USE_OPLINE
1551 	zval *function_name;
1552 	call_slot *call = EX(call_slots) + opline->result.num;
1553 
1554 	if (IS_TMP_VAR == IS_CONST) {
1555 		function_name = (zval*)(opline->op2.literal+1);
1556 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1557 			call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
1558 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &call->fbc) == FAILURE)) {
1559 			SAVE_OPLINE();
1560 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1561 		} else {
1562 			CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1563 		}
1564 		call->object = NULL;
1565 		call->called_scope = NULL;
1566 		call->is_ctor_call = 0;
1567 		EX(call) = call;
1568 		/*CHECK_EXCEPTION();*/
1569 		ZEND_VM_NEXT_OPCODE();
1570 	} else {
1571 		char *function_name_strval, *lcname;
1572 		int function_name_strlen;
1573 		zend_free_op free_op2;
1574 
1575 		SAVE_OPLINE();
1576 		function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
1577 
1578 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1579 			function_name_strval = Z_STRVAL_P(function_name);
1580 			function_name_strlen = Z_STRLEN_P(function_name);
1581 			if (function_name_strval[0] == '\\') {
1582 			    function_name_strlen -= 1;
1583 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1584 			} else {
1585 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1586 			}
1587 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &call->fbc) == FAILURE)) {
1588 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1589 			}
1590 			efree(lcname);
1591 			zval_dtor(free_op2.var);
1592 			call->object = NULL;
1593 			call->called_scope = NULL;
1594 			call->is_ctor_call = 0;
1595 			EX(call) = call;
1596 			CHECK_EXCEPTION();
1597 			ZEND_VM_NEXT_OPCODE();
1598 		} else if (IS_TMP_VAR != IS_CONST && IS_TMP_VAR != IS_TMP_VAR &&
1599 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1600 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1601 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &call->called_scope, &call->fbc, &call->object TSRMLS_CC) == SUCCESS) {
1602 			if (call->object) {
1603 				Z_ADDREF_P(call->object);
1604 			}
1605 			if (IS_TMP_VAR == IS_VAR && 1 &&
1606 			    call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
1607 				/* Delay closure destruction until its invocation */
1608 				call->fbc->common.prototype = (zend_function*)function_name;
1609 			} else {
1610 				zval_dtor(free_op2.var);
1611 			}
1612 			call->is_ctor_call = 0;
1613 			EX(call) = call;
1614 			CHECK_EXCEPTION();
1615 			ZEND_VM_NEXT_OPCODE();
1616 		} else if (IS_TMP_VAR != IS_CONST &&
1617 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1618 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1619 			zend_class_entry *ce;
1620 			zval **method = NULL;
1621 			zval **obj = NULL;
1622 
1623 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1624 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1625 
1626 			if (!obj || !method) {
1627 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1628 			}
1629 
1630 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1631 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1632 			}
1633 
1634 			if (Z_TYPE_PP(method) != IS_STRING) {
1635 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1636 			}
1637 
1638 			if (Z_TYPE_PP(obj) == IS_STRING) {
1639 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1640 				if (UNEXPECTED(ce == NULL)) {
1641 					CHECK_EXCEPTION();
1642 					ZEND_VM_NEXT_OPCODE();
1643 				}
1644 				call->called_scope = ce;
1645 				call->object = NULL;
1646 
1647 				if (ce->get_static_method) {
1648 					call->fbc = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1649 				} else {
1650 					call->fbc = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1651 				}
1652 			} else {
1653 				call->object = *obj;
1654 				ce = call->called_scope = Z_OBJCE_PP(obj);
1655 
1656 				call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1657 				if (UNEXPECTED(call->fbc == NULL)) {
1658 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), Z_STRVAL_PP(method));
1659 				}
1660 
1661 				if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1662 					call->object = NULL;
1663 				} else {
1664 					if (!PZVAL_IS_REF(call->object)) {
1665 						Z_ADDREF_P(call->object); /* For $this pointer */
1666 					} else {
1667 						zval *this_ptr;
1668 						ALLOC_ZVAL(this_ptr);
1669 						INIT_PZVAL_COPY(this_ptr, call->object);
1670 						zval_copy_ctor(this_ptr);
1671 						call->object = this_ptr;
1672 					}
1673 				}
1674 			}
1675 
1676 			if (UNEXPECTED(call->fbc == NULL)) {
1677 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1678 			}
1679 			call->is_ctor_call = 0;
1680 			EX(call) = call;
1681 			zval_dtor(free_op2.var);
1682 			CHECK_EXCEPTION();
1683 			ZEND_VM_NEXT_OPCODE();
1684 		} else {
1685 			if (UNEXPECTED(EG(exception) != NULL)) {
1686 				HANDLE_EXCEPTION();
1687 			}
1688 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1689 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
1690 		}
1691 	}
1692 }
1693 
1694 
ZEND_FETCH_CLASS_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1695 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1696 {
1697 	USE_OPLINE
1698 
1699 	SAVE_OPLINE();
1700 	if (EG(exception)) {
1701 		zend_exception_save(TSRMLS_C);
1702 	}
1703 	if (IS_VAR == IS_UNUSED) {
1704 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1705 		CHECK_EXCEPTION();
1706 		ZEND_VM_NEXT_OPCODE();
1707 	} else {
1708 		zend_free_op free_op2;
1709 		zval *class_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
1710 
1711 		if (IS_VAR == IS_CONST) {
1712 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1713 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1714 			} else {
1715 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1716 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1717 			}
1718 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1719 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1720 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1721 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1722 		} else {
1723 			if (UNEXPECTED(EG(exception) != NULL)) {
1724 				HANDLE_EXCEPTION();
1725 			}
1726 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1727 		}
1728 
1729 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1730 		CHECK_EXCEPTION();
1731 		ZEND_VM_NEXT_OPCODE();
1732 	}
1733 }
1734 
ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1735 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1736 {
1737 	USE_OPLINE
1738 	zval *function_name;
1739 	call_slot *call = EX(call_slots) + opline->result.num;
1740 
1741 	if (IS_VAR == IS_CONST) {
1742 		function_name = (zval*)(opline->op2.literal+1);
1743 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1744 			call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
1745 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &call->fbc) == FAILURE)) {
1746 			SAVE_OPLINE();
1747 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1748 		} else {
1749 			CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1750 		}
1751 		call->object = NULL;
1752 		call->called_scope = NULL;
1753 		call->is_ctor_call = 0;
1754 		EX(call) = call;
1755 		/*CHECK_EXCEPTION();*/
1756 		ZEND_VM_NEXT_OPCODE();
1757 	} else {
1758 		char *function_name_strval, *lcname;
1759 		int function_name_strlen;
1760 		zend_free_op free_op2;
1761 
1762 		SAVE_OPLINE();
1763 		function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
1764 
1765 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1766 			function_name_strval = Z_STRVAL_P(function_name);
1767 			function_name_strlen = Z_STRLEN_P(function_name);
1768 			if (function_name_strval[0] == '\\') {
1769 			    function_name_strlen -= 1;
1770 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1771 			} else {
1772 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1773 			}
1774 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &call->fbc) == FAILURE)) {
1775 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
1776 			}
1777 			efree(lcname);
1778 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1779 			call->object = NULL;
1780 			call->called_scope = NULL;
1781 			call->is_ctor_call = 0;
1782 			EX(call) = call;
1783 			CHECK_EXCEPTION();
1784 			ZEND_VM_NEXT_OPCODE();
1785 		} else if (IS_VAR != IS_CONST && IS_VAR != IS_TMP_VAR &&
1786 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
1787 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
1788 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &call->called_scope, &call->fbc, &call->object TSRMLS_CC) == SUCCESS) {
1789 			if (call->object) {
1790 				Z_ADDREF_P(call->object);
1791 			}
1792 			if (IS_VAR == IS_VAR && (free_op2.var != NULL) &&
1793 			    call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
1794 				/* Delay closure destruction until its invocation */
1795 				call->fbc->common.prototype = (zend_function*)function_name;
1796 			} else {
1797 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1798 			}
1799 			call->is_ctor_call = 0;
1800 			EX(call) = call;
1801 			CHECK_EXCEPTION();
1802 			ZEND_VM_NEXT_OPCODE();
1803 		} else if (IS_VAR != IS_CONST &&
1804 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
1805 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
1806 			zend_class_entry *ce;
1807 			zval **method = NULL;
1808 			zval **obj = NULL;
1809 
1810 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
1811 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
1812 
1813 			if (!obj || !method) {
1814 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
1815 			}
1816 
1817 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
1818 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
1819 			}
1820 
1821 			if (Z_TYPE_PP(method) != IS_STRING) {
1822 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
1823 			}
1824 
1825 			if (Z_TYPE_PP(obj) == IS_STRING) {
1826 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
1827 				if (UNEXPECTED(ce == NULL)) {
1828 					CHECK_EXCEPTION();
1829 					ZEND_VM_NEXT_OPCODE();
1830 				}
1831 				call->called_scope = ce;
1832 				call->object = NULL;
1833 
1834 				if (ce->get_static_method) {
1835 					call->fbc = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
1836 				} else {
1837 					call->fbc = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1838 				}
1839 			} else {
1840 				call->object = *obj;
1841 				ce = call->called_scope = Z_OBJCE_PP(obj);
1842 
1843 				call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
1844 				if (UNEXPECTED(call->fbc == NULL)) {
1845 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), Z_STRVAL_PP(method));
1846 				}
1847 
1848 				if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
1849 					call->object = NULL;
1850 				} else {
1851 					if (!PZVAL_IS_REF(call->object)) {
1852 						Z_ADDREF_P(call->object); /* For $this pointer */
1853 					} else {
1854 						zval *this_ptr;
1855 						ALLOC_ZVAL(this_ptr);
1856 						INIT_PZVAL_COPY(this_ptr, call->object);
1857 						zval_copy_ctor(this_ptr);
1858 						call->object = this_ptr;
1859 					}
1860 				}
1861 			}
1862 
1863 			if (UNEXPECTED(call->fbc == NULL)) {
1864 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
1865 			}
1866 			call->is_ctor_call = 0;
1867 			EX(call) = call;
1868 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
1869 			CHECK_EXCEPTION();
1870 			ZEND_VM_NEXT_OPCODE();
1871 		} else {
1872 			if (UNEXPECTED(EG(exception) != NULL)) {
1873 				HANDLE_EXCEPTION();
1874 			}
1875 			zend_error_noreturn(E_ERROR, "Function name must be a string");
1876 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
1877 		}
1878 	}
1879 }
1880 
1881 
ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1882 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1883 {
1884 	USE_OPLINE
1885 
1886 	SAVE_OPLINE();
1887 	if (EG(exception)) {
1888 		zend_exception_save(TSRMLS_C);
1889 	}
1890 	if (IS_UNUSED == IS_UNUSED) {
1891 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1892 		CHECK_EXCEPTION();
1893 		ZEND_VM_NEXT_OPCODE();
1894 	} else {
1895 
1896 		zval *class_name = NULL;
1897 
1898 		if (IS_UNUSED == IS_CONST) {
1899 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1900 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1901 			} else {
1902 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1903 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1904 			}
1905 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1906 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1907 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1908 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1909 		} else {
1910 			if (UNEXPECTED(EG(exception) != NULL)) {
1911 				HANDLE_EXCEPTION();
1912 			}
1913 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1914 		}
1915 
1916 		CHECK_EXCEPTION();
1917 		ZEND_VM_NEXT_OPCODE();
1918 	}
1919 }
1920 
ZEND_FETCH_CLASS_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1921 static int ZEND_FASTCALL  ZEND_FETCH_CLASS_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1922 {
1923 	USE_OPLINE
1924 
1925 	SAVE_OPLINE();
1926 	if (EG(exception)) {
1927 		zend_exception_save(TSRMLS_C);
1928 	}
1929 	if (IS_CV == IS_UNUSED) {
1930 		EX_T(opline->result.var).class_entry = zend_fetch_class(NULL, 0, opline->extended_value TSRMLS_CC);
1931 		CHECK_EXCEPTION();
1932 		ZEND_VM_NEXT_OPCODE();
1933 	} else {
1934 
1935 		zval *class_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
1936 
1937 		if (IS_CV == IS_CONST) {
1938 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1939 				EX_T(opline->result.var).class_entry = CACHED_PTR(opline->op2.literal->cache_slot);
1940 			} else {
1941 				EX_T(opline->result.var).class_entry = zend_fetch_class_by_name(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->op2.literal + 1, opline->extended_value TSRMLS_CC);
1942 				CACHE_PTR(opline->op2.literal->cache_slot, EX_T(opline->result.var).class_entry);
1943 			}
1944 		} else if (Z_TYPE_P(class_name) == IS_OBJECT) {
1945 			EX_T(opline->result.var).class_entry = Z_OBJCE_P(class_name);
1946 		} else if (Z_TYPE_P(class_name) == IS_STRING) {
1947 			EX_T(opline->result.var).class_entry = zend_fetch_class(Z_STRVAL_P(class_name), Z_STRLEN_P(class_name), opline->extended_value TSRMLS_CC);
1948 		} else {
1949 			if (UNEXPECTED(EG(exception) != NULL)) {
1950 				HANDLE_EXCEPTION();
1951 			}
1952 			zend_error_noreturn(E_ERROR, "Class name must be a valid object or a string");
1953 		}
1954 
1955 		CHECK_EXCEPTION();
1956 		ZEND_VM_NEXT_OPCODE();
1957 	}
1958 }
1959 
ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)1960 static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
1961 {
1962 	USE_OPLINE
1963 	zval *function_name;
1964 	call_slot *call = EX(call_slots) + opline->result.num;
1965 
1966 	if (IS_CV == IS_CONST) {
1967 		function_name = (zval*)(opline->op2.literal+1);
1968 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
1969 			call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
1970 		} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(function_name), Z_STRLEN_P(function_name)+1, Z_HASH_P(function_name), (void **) &call->fbc) == FAILURE)) {
1971 			SAVE_OPLINE();
1972 			zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(opline->op2.zv));
1973 		} else {
1974 			CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
1975 		}
1976 		call->object = NULL;
1977 		call->called_scope = NULL;
1978 		call->is_ctor_call = 0;
1979 		EX(call) = call;
1980 		/*CHECK_EXCEPTION();*/
1981 		ZEND_VM_NEXT_OPCODE();
1982 	} else {
1983 		char *function_name_strval, *lcname;
1984 		int function_name_strlen;
1985 
1986 
1987 		SAVE_OPLINE();
1988 		function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
1989 
1990 		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {
1991 			function_name_strval = Z_STRVAL_P(function_name);
1992 			function_name_strlen = Z_STRLEN_P(function_name);
1993 			if (function_name_strval[0] == '\\') {
1994 			    function_name_strlen -= 1;
1995 				lcname = zend_str_tolower_dup(function_name_strval + 1, function_name_strlen);
1996 			} else {
1997 				lcname = zend_str_tolower_dup(function_name_strval, function_name_strlen);
1998 			}
1999 			if (UNEXPECTED(zend_hash_find(EG(function_table), lcname, function_name_strlen+1, (void **) &call->fbc) == FAILURE)) {
2000 				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", function_name_strval);
2001 			}
2002 			efree(lcname);
2003 
2004 			call->object = NULL;
2005 			call->called_scope = NULL;
2006 			call->is_ctor_call = 0;
2007 			EX(call) = call;
2008 			CHECK_EXCEPTION();
2009 			ZEND_VM_NEXT_OPCODE();
2010 		} else if (IS_CV != IS_CONST && IS_CV != IS_TMP_VAR &&
2011 		    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
2012 			Z_OBJ_HANDLER_P(function_name, get_closure) &&
2013 			Z_OBJ_HANDLER_P(function_name, get_closure)(function_name, &call->called_scope, &call->fbc, &call->object TSRMLS_CC) == SUCCESS) {
2014 			if (call->object) {
2015 				Z_ADDREF_P(call->object);
2016 			}
2017 			if (IS_CV == IS_VAR && 0 &&
2018 			    call->fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
2019 				/* Delay closure destruction until its invocation */
2020 				call->fbc->common.prototype = (zend_function*)function_name;
2021 			} else {
2022 
2023 			}
2024 			call->is_ctor_call = 0;
2025 			EX(call) = call;
2026 			CHECK_EXCEPTION();
2027 			ZEND_VM_NEXT_OPCODE();
2028 		} else if (IS_CV != IS_CONST &&
2029 				EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
2030 				zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
2031 			zend_class_entry *ce;
2032 			zval **method = NULL;
2033 			zval **obj = NULL;
2034 
2035 			zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
2036 			zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
2037 
2038 			if (!obj || !method) {
2039 				zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
2040 			}
2041 
2042 			if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
2043 				zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
2044 			}
2045 
2046 			if (Z_TYPE_PP(method) != IS_STRING) {
2047 				zend_error_noreturn(E_ERROR, "Second array member is not a valid method");
2048 			}
2049 
2050 			if (Z_TYPE_PP(obj) == IS_STRING) {
2051 				ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC);
2052 				if (UNEXPECTED(ce == NULL)) {
2053 					CHECK_EXCEPTION();
2054 					ZEND_VM_NEXT_OPCODE();
2055 				}
2056 				call->called_scope = ce;
2057 				call->object = NULL;
2058 
2059 				if (ce->get_static_method) {
2060 					call->fbc = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC);
2061 				} else {
2062 					call->fbc = zend_std_get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
2063 				}
2064 			} else {
2065 				call->object = *obj;
2066 				ce = call->called_scope = Z_OBJCE_PP(obj);
2067 
2068 				call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, Z_STRVAL_PP(method), Z_STRLEN_PP(method), NULL TSRMLS_CC);
2069 				if (UNEXPECTED(call->fbc == NULL)) {
2070 					zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), Z_STRVAL_PP(method));
2071 				}
2072 
2073 				if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
2074 					call->object = NULL;
2075 				} else {
2076 					if (!PZVAL_IS_REF(call->object)) {
2077 						Z_ADDREF_P(call->object); /* For $this pointer */
2078 					} else {
2079 						zval *this_ptr;
2080 						ALLOC_ZVAL(this_ptr);
2081 						INIT_PZVAL_COPY(this_ptr, call->object);
2082 						zval_copy_ctor(this_ptr);
2083 						call->object = this_ptr;
2084 					}
2085 				}
2086 			}
2087 
2088 			if (UNEXPECTED(call->fbc == NULL)) {
2089 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, Z_STRVAL_PP(method));
2090 			}
2091 			call->is_ctor_call = 0;
2092 			EX(call) = call;
2093 
2094 			CHECK_EXCEPTION();
2095 			ZEND_VM_NEXT_OPCODE();
2096 		} else {
2097 			if (UNEXPECTED(EG(exception) != NULL)) {
2098 				HANDLE_EXCEPTION();
2099 			}
2100 			zend_error_noreturn(E_ERROR, "Function name must be a string");
2101 			ZEND_VM_NEXT_OPCODE(); /* Never reached */
2102 		}
2103 	}
2104 }
2105 
2106 
ZEND_BW_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2107 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2108 {
2109 	USE_OPLINE
2110 
2111 
2112 	SAVE_OPLINE();
2113 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
2114 		opline->op1.zv TSRMLS_CC);
2115 
2116 	CHECK_EXCEPTION();
2117 	ZEND_VM_NEXT_OPCODE();
2118 }
2119 
ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2120 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2121 {
2122 	USE_OPLINE
2123 
2124 
2125 	SAVE_OPLINE();
2126 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
2127 		opline->op1.zv TSRMLS_CC);
2128 
2129 	CHECK_EXCEPTION();
2130 	ZEND_VM_NEXT_OPCODE();
2131 }
2132 
ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2133 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2134 {
2135 	USE_OPLINE
2136 
2137 	zval *z;
2138 
2139 	SAVE_OPLINE();
2140 	z = opline->op1.zv;
2141 
2142 	if (IS_CONST == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
2143 		INIT_PZVAL(z);
2144 	}
2145 	zend_print_variable(z);
2146 
2147 	CHECK_EXCEPTION();
2148 	ZEND_VM_NEXT_OPCODE();
2149 }
2150 
ZEND_PRINT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2151 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2152 {
2153 	USE_OPLINE
2154 
2155 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
2156 	return ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2157 }
2158 
ZEND_JMPZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2159 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2160 {
2161 	USE_OPLINE
2162 
2163 	zval *val;
2164 	int ret;
2165 
2166 	SAVE_OPLINE();
2167 	val = opline->op1.zv;
2168 
2169 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2170 		ret = Z_LVAL_P(val);
2171 	} else {
2172 		ret = i_zend_is_true(val);
2173 
2174 		if (UNEXPECTED(EG(exception) != NULL)) {
2175 			HANDLE_EXCEPTION();
2176 		}
2177 	}
2178 	if (!ret) {
2179 #if DEBUG_ZEND>=2
2180 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2181 #endif
2182 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2183 		ZEND_VM_CONTINUE();
2184 	}
2185 
2186 	ZEND_VM_NEXT_OPCODE();
2187 }
2188 
ZEND_JMPNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2189 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2190 {
2191 	USE_OPLINE
2192 
2193 	zval *val;
2194 	int ret;
2195 
2196 	SAVE_OPLINE();
2197 	val = opline->op1.zv;
2198 
2199 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2200 		ret = Z_LVAL_P(val);
2201 	} else {
2202 		ret = i_zend_is_true(val);
2203 
2204 		if (UNEXPECTED(EG(exception) != NULL)) {
2205 			HANDLE_EXCEPTION();
2206 		}
2207 	}
2208 	if (ret) {
2209 #if DEBUG_ZEND>=2
2210 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2211 #endif
2212 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2213 		ZEND_VM_CONTINUE();
2214 	}
2215 
2216 	ZEND_VM_NEXT_OPCODE();
2217 }
2218 
ZEND_JMPZNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2219 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2220 {
2221 	USE_OPLINE
2222 
2223 	zval *val;
2224 	int retval;
2225 
2226 	SAVE_OPLINE();
2227 	val = opline->op1.zv;
2228 
2229 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2230 		retval = Z_LVAL_P(val);
2231 	} else {
2232 		retval = i_zend_is_true(val);
2233 
2234 		if (UNEXPECTED(EG(exception) != NULL)) {
2235 			HANDLE_EXCEPTION();
2236 		}
2237 	}
2238 	if (EXPECTED(retval != 0)) {
2239 #if DEBUG_ZEND>=2
2240 		printf("Conditional jmp on true to %d\n", opline->extended_value);
2241 #endif
2242 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
2243 		ZEND_VM_CONTINUE(); /* CHECK_ME */
2244 	} else {
2245 #if DEBUG_ZEND>=2
2246 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
2247 #endif
2248 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
2249 		ZEND_VM_CONTINUE(); /* CHECK_ME */
2250 	}
2251 }
2252 
ZEND_JMPZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2253 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2254 {
2255 	USE_OPLINE
2256 
2257 	zval *val;
2258 	int retval;
2259 
2260 	SAVE_OPLINE();
2261 	val = opline->op1.zv;
2262 
2263 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2264 		retval = Z_LVAL_P(val);
2265 	} else {
2266 		retval = i_zend_is_true(val);
2267 
2268 		if (UNEXPECTED(EG(exception) != NULL)) {
2269 			HANDLE_EXCEPTION();
2270 		}
2271 	}
2272 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
2273 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
2274 	if (!retval) {
2275 #if DEBUG_ZEND>=2
2276 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2277 #endif
2278 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2279 		ZEND_VM_CONTINUE();
2280 	}
2281 	ZEND_VM_NEXT_OPCODE();
2282 }
2283 
ZEND_JMPNZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2284 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2285 {
2286 	USE_OPLINE
2287 
2288 	zval *val;
2289 	int retval;
2290 
2291 	SAVE_OPLINE();
2292 	val = opline->op1.zv;
2293 
2294 	if (IS_CONST == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
2295 		retval = Z_LVAL_P(val);
2296 	} else {
2297 		retval = i_zend_is_true(val);
2298 
2299 		if (UNEXPECTED(EG(exception) != NULL)) {
2300 			HANDLE_EXCEPTION();
2301 		}
2302 	}
2303 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
2304 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
2305 	if (retval) {
2306 #if DEBUG_ZEND>=2
2307 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2308 #endif
2309 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
2310 		ZEND_VM_CONTINUE();
2311 	}
2312 	ZEND_VM_NEXT_OPCODE();
2313 }
2314 
ZEND_DO_FCALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2315 static int ZEND_FASTCALL  ZEND_DO_FCALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2316 {
2317 	USE_OPLINE
2318 
2319 	zval *fname = opline->op1.zv;
2320 	call_slot *call = EX(call_slots) + opline->op2.num;
2321 
2322 	if (CACHED_PTR(opline->op1.literal->cache_slot)) {
2323 		EX(function_state).function = CACHED_PTR(opline->op1.literal->cache_slot);
2324 	} else if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(fname), Z_STRLEN_P(fname)+1, Z_HASH_P(fname), (void **) &EX(function_state).function)==FAILURE)) {
2325 	    SAVE_OPLINE();
2326 		zend_error_noreturn(E_ERROR, "Call to undefined function %s()", fname->value.str.val);
2327 	} else {
2328 		CACHE_PTR(opline->op1.literal->cache_slot, EX(function_state).function);
2329 	}
2330 	call->fbc = EX(function_state).function;
2331 	call->object = NULL;
2332 	call->called_scope = NULL;
2333 	call->is_ctor_call = 0;
2334 	EX(call) = call;
2335 
2336 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2337 }
2338 
ZEND_RETURN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2339 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2340 {
2341 	USE_OPLINE
2342 	zval *retval_ptr;
2343 
2344 
2345 	SAVE_OPLINE();
2346 	retval_ptr = opline->op1.zv;
2347 
2348 	if (!EG(return_value_ptr_ptr)) {
2349 		if (IS_CONST == IS_TMP_VAR) {
2350 
2351 		}
2352 	} else {
2353 		if (IS_CONST == IS_CONST ||
2354 		    IS_CONST == IS_TMP_VAR ||
2355 		    PZVAL_IS_REF(retval_ptr)) {
2356 			zval *ret;
2357 
2358 			ALLOC_ZVAL(ret);
2359 			INIT_PZVAL_COPY(ret, retval_ptr);
2360 			if (IS_CONST != IS_TMP_VAR) {
2361 				zval_copy_ctor(ret);
2362 			}
2363 			*EG(return_value_ptr_ptr) = ret;
2364 		} else if ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2365 		           retval_ptr == &EG(uninitialized_zval)) {
2366 			zval *ret;
2367 
2368 			ALLOC_INIT_ZVAL(ret);
2369 			*EG(return_value_ptr_ptr) = ret;
2370 		} else {
2371 			*EG(return_value_ptr_ptr) = retval_ptr;
2372 			Z_ADDREF_P(retval_ptr);
2373 		}
2374 	}
2375 
2376 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2377 }
2378 
ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2379 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2380 {
2381 	USE_OPLINE
2382 	zval *retval_ptr;
2383 	zval **retval_ptr_ptr;
2384 
2385 
2386 	SAVE_OPLINE();
2387 
2388 	do {
2389 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
2390 			/* Not supposed to happen, but we'll allow it */
2391 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
2392 
2393 			retval_ptr = opline->op1.zv;
2394 			if (!EG(return_value_ptr_ptr)) {
2395 				if (IS_CONST == IS_TMP_VAR) {
2396 
2397 				}
2398 			} else if (!0) { /* Not a temp var */
2399 				zval *ret;
2400 
2401 				ALLOC_ZVAL(ret);
2402 				INIT_PZVAL_COPY(ret, retval_ptr);
2403 				zval_copy_ctor(ret);
2404 				*EG(return_value_ptr_ptr) = ret;
2405 			} else {
2406 				zval *ret;
2407 
2408 				ALLOC_ZVAL(ret);
2409 				INIT_PZVAL_COPY(ret, retval_ptr);
2410 				*EG(return_value_ptr_ptr) = ret;
2411 			}
2412 			break;
2413 		}
2414 
2415 		retval_ptr_ptr = NULL;
2416 
2417 		if (IS_CONST == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
2418 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
2419 		}
2420 
2421 		if (IS_CONST == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
2422 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
2423 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
2424 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
2425 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
2426 				if (EG(return_value_ptr_ptr)) {
2427 					zval *ret;
2428 
2429 					ALLOC_ZVAL(ret);
2430 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
2431 					zval_copy_ctor(ret);
2432 					*EG(return_value_ptr_ptr) = ret;
2433 				}
2434 				break;
2435 			}
2436 		}
2437 
2438 		if (EG(return_value_ptr_ptr)) {
2439 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
2440 			Z_ADDREF_PP(retval_ptr_ptr);
2441 
2442 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
2443 		}
2444 	} while (0);
2445 
2446 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
2447 }
2448 
ZEND_THROW_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2449 static int ZEND_FASTCALL  ZEND_THROW_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2450 {
2451 	USE_OPLINE
2452 	zval *value;
2453 	zval *exception;
2454 
2455 
2456 	SAVE_OPLINE();
2457 	value = opline->op1.zv;
2458 
2459 	if (IS_CONST == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
2460 		if (UNEXPECTED(EG(exception) != NULL)) {
2461 			HANDLE_EXCEPTION();
2462 		}
2463 		zend_error_noreturn(E_ERROR, "Can only throw objects");
2464 	}
2465 
2466 	zend_exception_save(TSRMLS_C);
2467 	/* Not sure if a complete copy is what we want here */
2468 	ALLOC_ZVAL(exception);
2469 	INIT_PZVAL_COPY(exception, value);
2470 	if (!0) {
2471 		zval_copy_ctor(exception);
2472 	}
2473 
2474 	zend_throw_exception_object(exception TSRMLS_CC);
2475 	zend_exception_restore(TSRMLS_C);
2476 
2477 	HANDLE_EXCEPTION();
2478 }
2479 
ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2480 static int ZEND_FASTCALL  ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2481 {
2482 	USE_OPLINE
2483 
2484 	SAVE_OPLINE();
2485 	if (opline->extended_value==ZEND_DO_FCALL_BY_NAME
2486 		&& ARG_MUST_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
2487 			zend_error_noreturn(E_ERROR, "Cannot pass parameter %d by reference", opline->op2.opline_num);
2488 	}
2489 	{
2490 		zval *valptr;
2491 		zval *value;
2492 
2493 
2494 		value = opline->op1.zv;
2495 
2496 		ALLOC_ZVAL(valptr);
2497 		INIT_PZVAL_COPY(valptr, value);
2498 		if (!0) {
2499 			zval_copy_ctor(valptr);
2500 		}
2501 		zend_vm_stack_push(valptr TSRMLS_CC);
2502 
2503 	}
2504 	CHECK_EXCEPTION();
2505 	ZEND_VM_NEXT_OPCODE();
2506 }
2507 
ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2508 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2509 {
2510 	USE_OPLINE
2511 
2512 	zval *retval = &EX_T(opline->result.var).tmp_var;
2513 
2514 	SAVE_OPLINE();
2515 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
2516 	ZVAL_BOOL(retval, i_zend_is_true(opline->op1.zv));
2517 
2518 	CHECK_EXCEPTION();
2519 	ZEND_VM_NEXT_OPCODE();
2520 }
2521 
ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2522 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2523 {
2524 	USE_OPLINE
2525 
2526 	zval *obj;
2527 	zend_class_entry *ce;
2528 	zend_function *clone;
2529 	zend_object_clone_obj_t clone_call;
2530 
2531 	SAVE_OPLINE();
2532 	obj = opline->op1.zv;
2533 
2534 	if (IS_CONST == IS_CONST ||
2535 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
2536 		if (UNEXPECTED(EG(exception) != NULL)) {
2537 			HANDLE_EXCEPTION();
2538 		}
2539 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
2540 	}
2541 
2542 	ce = Z_OBJCE_P(obj);
2543 	clone = ce ? ce->clone : NULL;
2544 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
2545 	if (UNEXPECTED(clone_call == NULL)) {
2546 		if (ce) {
2547 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
2548 		} else {
2549 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
2550 		}
2551 	}
2552 
2553 	if (ce && clone) {
2554 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
2555 			/* Ensure that if we're calling a private function, we're allowed to do so.
2556 			 */
2557 			if (UNEXPECTED(ce != EG(scope))) {
2558 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
2559 			}
2560 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
2561 			/* Ensure that if we're calling a protected function, we're allowed to do so.
2562 			 */
2563 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
2564 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
2565 			}
2566 		}
2567 	}
2568 
2569 	if (EXPECTED(EG(exception) == NULL)) {
2570 		zval *retval;
2571 
2572 		ALLOC_ZVAL(retval);
2573 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
2574 		Z_TYPE_P(retval) = IS_OBJECT;
2575 		Z_SET_REFCOUNT_P(retval, 1);
2576 		Z_SET_ISREF_P(retval);
2577 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
2578 			zval_ptr_dtor(&retval);
2579 		} else {
2580 			AI_SET_PTR(&EX_T(opline->result.var), retval);
2581 		}
2582 	}
2583 
2584 	CHECK_EXCEPTION();
2585 	ZEND_VM_NEXT_OPCODE();
2586 }
2587 
ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2588 static int ZEND_FASTCALL  ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2589 {
2590 	USE_OPLINE
2591 
2592 	zval *expr;
2593 	zval *result = &EX_T(opline->result.var).tmp_var;
2594 
2595 	SAVE_OPLINE();
2596 	expr = opline->op1.zv;
2597 
2598 	if (opline->extended_value != IS_STRING) {
2599 		ZVAL_COPY_VALUE(result, expr);
2600 		if (!0) {
2601 			zendi_zval_copy_ctor(*result);
2602 		}
2603 	}
2604 	switch (opline->extended_value) {
2605 		case IS_NULL:
2606 			convert_to_null(result);
2607 			break;
2608 		case IS_BOOL:
2609 			convert_to_boolean(result);
2610 			break;
2611 		case IS_LONG:
2612 			convert_to_long(result);
2613 			break;
2614 		case IS_DOUBLE:
2615 			convert_to_double(result);
2616 			break;
2617 		case IS_STRING: {
2618 			zval var_copy;
2619 			int use_copy;
2620 
2621 			zend_make_printable_zval(expr, &var_copy, &use_copy);
2622 			if (use_copy) {
2623 				ZVAL_COPY_VALUE(result, &var_copy);
2624 				if (0) {
2625 
2626 				}
2627 			} else {
2628 				ZVAL_COPY_VALUE(result, expr);
2629 				if (!0) {
2630 					zendi_zval_copy_ctor(*result);
2631 				}
2632 			}
2633 			break;
2634 		}
2635 		case IS_ARRAY:
2636 			convert_to_array(result);
2637 			break;
2638 		case IS_OBJECT:
2639 			convert_to_object(result);
2640 			break;
2641 	}
2642 
2643 	CHECK_EXCEPTION();
2644 	ZEND_VM_NEXT_OPCODE();
2645 }
2646 
ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2647 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2648 {
2649 	USE_OPLINE
2650 	zend_op_array *new_op_array=NULL;
2651 
2652 	zval *inc_filename;
2653 	zval *tmp_inc_filename = NULL;
2654 	zend_bool failure_retval=0;
2655 
2656 	SAVE_OPLINE();
2657 	inc_filename = opline->op1.zv;
2658 
2659 	if (inc_filename->type!=IS_STRING) {
2660 		MAKE_STD_ZVAL(tmp_inc_filename);
2661 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
2662 		zval_copy_ctor(tmp_inc_filename);
2663 		convert_to_string(tmp_inc_filename);
2664 		inc_filename = tmp_inc_filename;
2665 	}
2666 
2667 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
2668 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
2669 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2670 		} else {
2671 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2672 		}
2673 	} else {
2674 		switch (opline->extended_value) {
2675 			case ZEND_INCLUDE_ONCE:
2676 			case ZEND_REQUIRE_ONCE: {
2677 					zend_file_handle file_handle;
2678 					char *resolved_path;
2679 
2680 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
2681 					if (resolved_path) {
2682 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
2683 					} else {
2684 						resolved_path = Z_STRVAL_P(inc_filename);
2685 					}
2686 
2687 					if (failure_retval) {
2688 						/* do nothing, file already included */
2689 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
2690 
2691 						if (!file_handle.opened_path) {
2692 							file_handle.opened_path = estrdup(resolved_path);
2693 						}
2694 
2695 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
2696 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
2697 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
2698 						} else {
2699 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
2700 							failure_retval=1;
2701 						}
2702 					} else {
2703 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
2704 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2705 						} else {
2706 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
2707 						}
2708 					}
2709 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
2710 						efree(resolved_path);
2711 					}
2712 				}
2713 				break;
2714 			case ZEND_INCLUDE:
2715 			case ZEND_REQUIRE:
2716 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
2717 				break;
2718 			case ZEND_EVAL: {
2719 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
2720 
2721 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
2722 					efree(eval_desc);
2723 				}
2724 				break;
2725 			EMPTY_SWITCH_DEFAULT_CASE()
2726 		}
2727 	}
2728 	if (tmp_inc_filename) {
2729 		zval_ptr_dtor(&tmp_inc_filename);
2730 	}
2731 
2732 	if (UNEXPECTED(EG(exception) != NULL)) {
2733 		HANDLE_EXCEPTION();
2734 	} else if (EXPECTED(new_op_array != NULL)) {
2735 		EX(original_return_value) = EG(return_value_ptr_ptr);
2736 		EG(active_op_array) = new_op_array;
2737 		if (RETURN_VALUE_USED(opline)) {
2738 			EX_T(opline->result.var).var.ptr = NULL;
2739 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2740 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
2741 		} else {
2742 			EG(return_value_ptr_ptr) = NULL;
2743 		}
2744 
2745 		EX(function_state).function = (zend_function *) new_op_array;
2746 		EX(object) = NULL;
2747 
2748 		if (!EG(active_symbol_table)) {
2749 			zend_rebuild_symbol_table(TSRMLS_C);
2750 		}
2751 
2752 		if (EXPECTED(zend_execute_ex == execute_ex)) {
2753 			ZEND_VM_ENTER();
2754 		} else {
2755 			zend_execute(new_op_array TSRMLS_CC);
2756 		}
2757 
2758 		EX(function_state).function = (zend_function *) EX(op_array);
2759 
2760 		EG(opline_ptr) = &EX(opline);
2761 		EG(active_op_array) = EX(op_array);
2762 		EG(return_value_ptr_ptr) = EX(original_return_value);
2763 		destroy_op_array(new_op_array TSRMLS_CC);
2764 		efree(new_op_array);
2765 		if (UNEXPECTED(EG(exception) != NULL)) {
2766 			zend_throw_exception_internal(NULL TSRMLS_CC);
2767 			HANDLE_EXCEPTION();
2768 		}
2769 
2770 	} else if (RETURN_VALUE_USED(opline)) {
2771 		zval *retval;
2772 
2773 		ALLOC_ZVAL(retval);
2774 		ZVAL_BOOL(retval, failure_retval);
2775 		INIT_PZVAL(retval);
2776 		AI_SET_PTR(&EX_T(opline->result.var), retval);
2777 	}
2778 	ZEND_VM_NEXT_OPCODE();
2779 }
2780 
ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2781 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2782 {
2783 	USE_OPLINE
2784 
2785 	zval *array_ptr, **array_ptr_ptr;
2786 	HashTable *fe_ht;
2787 	zend_object_iterator *iter = NULL;
2788 	zend_class_entry *ce = NULL;
2789 	zend_bool is_empty = 0;
2790 
2791 	SAVE_OPLINE();
2792 
2793 	if ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2794 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
2795 		array_ptr_ptr = NULL;
2796 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
2797 			MAKE_STD_ZVAL(array_ptr);
2798 			ZVAL_NULL(array_ptr);
2799 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
2800 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
2801 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
2802 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
2803 			}
2804 
2805 			ce = Z_OBJCE_PP(array_ptr_ptr);
2806 			if (!ce || ce->get_iterator == NULL) {
2807 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
2808 				Z_ADDREF_PP(array_ptr_ptr);
2809 			}
2810 			array_ptr = *array_ptr_ptr;
2811 		} else {
2812 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
2813 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
2814 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
2815 					Z_SET_ISREF_PP(array_ptr_ptr);
2816 				}
2817 			}
2818 			array_ptr = *array_ptr_ptr;
2819 			Z_ADDREF_P(array_ptr);
2820 		}
2821 	} else {
2822 		array_ptr = opline->op1.zv;
2823 		if (0) { /* IS_TMP_VAR */
2824 			zval *tmp;
2825 
2826 			ALLOC_ZVAL(tmp);
2827 			INIT_PZVAL_COPY(tmp, array_ptr);
2828 			array_ptr = tmp;
2829 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
2830 				ce = Z_OBJCE_P(array_ptr);
2831 				if (ce && ce->get_iterator) {
2832 					Z_DELREF_P(array_ptr);
2833 				}
2834 			}
2835 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
2836 			ce = Z_OBJCE_P(array_ptr);
2837 			if (!ce || !ce->get_iterator) {
2838 				Z_ADDREF_P(array_ptr);
2839 			}
2840 		} else if (IS_CONST == IS_CONST ||
2841 		           ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
2842 		            !Z_ISREF_P(array_ptr) &&
2843 		            Z_REFCOUNT_P(array_ptr) > 1)) {
2844 			zval *tmp;
2845 
2846 			ALLOC_ZVAL(tmp);
2847 			INIT_PZVAL_COPY(tmp, array_ptr);
2848 			zval_copy_ctor(tmp);
2849 			array_ptr = tmp;
2850 		} else {
2851 			Z_ADDREF_P(array_ptr);
2852 		}
2853 	}
2854 
2855 	if (ce && ce->get_iterator) {
2856 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
2857 
2858 		if (iter && EXPECTED(EG(exception) == NULL)) {
2859 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
2860 		} else {
2861 
2862 			if (!EG(exception)) {
2863 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
2864 			}
2865 			zend_throw_exception_internal(NULL TSRMLS_CC);
2866 			HANDLE_EXCEPTION();
2867 		}
2868 	}
2869 
2870 	EX_T(opline->result.var).fe.ptr = array_ptr;
2871 
2872 	if (iter) {
2873 		iter->index = 0;
2874 		if (iter->funcs->rewind) {
2875 			iter->funcs->rewind(iter TSRMLS_CC);
2876 			if (UNEXPECTED(EG(exception) != NULL)) {
2877 				zval_ptr_dtor(&array_ptr);
2878 
2879 				HANDLE_EXCEPTION();
2880 			}
2881 		}
2882 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
2883 		if (UNEXPECTED(EG(exception) != NULL)) {
2884 			zval_ptr_dtor(&array_ptr);
2885 
2886 			HANDLE_EXCEPTION();
2887 		}
2888 		iter->index = -1; /* will be set to 0 before using next handler */
2889 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
2890 		zend_hash_internal_pointer_reset(fe_ht);
2891 		if (ce) {
2892 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
2893 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
2894 				char *str_key;
2895 				uint str_key_len;
2896 				ulong int_key;
2897 				zend_uchar key_type;
2898 
2899 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
2900 				if (key_type != HASH_KEY_NON_EXISTENT &&
2901 					(key_type == HASH_KEY_IS_LONG ||
2902 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
2903 					break;
2904 				}
2905 				zend_hash_move_forward(fe_ht);
2906 			}
2907 		}
2908 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
2909 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
2910 	} else {
2911 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
2912 		is_empty = 1;
2913 	}
2914 
2915 	if (is_empty) {
2916 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
2917 	} else {
2918 		CHECK_EXCEPTION();
2919 		ZEND_VM_NEXT_OPCODE();
2920 	}
2921 }
2922 
ZEND_EXIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2923 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2924 {
2925 #if 0 || (IS_CONST != IS_UNUSED)
2926 	USE_OPLINE
2927 
2928 	SAVE_OPLINE();
2929 	if (IS_CONST != IS_UNUSED) {
2930 
2931 		zval *ptr = opline->op1.zv;
2932 
2933 		if (Z_TYPE_P(ptr) == IS_LONG) {
2934 			EG(exit_status) = Z_LVAL_P(ptr);
2935 		} else {
2936 			zend_print_variable(ptr);
2937 		}
2938 
2939 	}
2940 #endif
2941 	zend_bailout();
2942 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
2943 }
2944 
ZEND_JMP_SET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2945 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2946 {
2947 	USE_OPLINE
2948 
2949 	zval *value;
2950 
2951 	SAVE_OPLINE();
2952 	value = opline->op1.zv;
2953 
2954 	if (i_zend_is_true(value)) {
2955 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
2956 		if (!0) {
2957 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
2958 		}
2959 
2960 #if DEBUG_ZEND>=2
2961 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2962 #endif
2963 		ZEND_VM_JMP(opline->op2.jmp_addr);
2964 	}
2965 
2966 	CHECK_EXCEPTION();
2967 	ZEND_VM_NEXT_OPCODE();
2968 }
2969 
ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)2970 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
2971 {
2972 	USE_OPLINE
2973 
2974 	zval *value, *ret;
2975 
2976 	SAVE_OPLINE();
2977 	value = opline->op1.zv;
2978 
2979 	if (i_zend_is_true(value)) {
2980 		if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
2981 			Z_ADDREF_P(value);
2982 			EX_T(opline->result.var).var.ptr = value;
2983 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2984 		} else {
2985 			ALLOC_ZVAL(ret);
2986 			INIT_PZVAL_COPY(ret, value);
2987 			EX_T(opline->result.var).var.ptr = ret;
2988 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
2989 			if (!0) {
2990 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
2991 			}
2992 		}
2993 
2994 #if DEBUG_ZEND>=2
2995 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
2996 #endif
2997 		ZEND_VM_JMP(opline->op2.jmp_addr);
2998 	}
2999 
3000 	CHECK_EXCEPTION();
3001 	ZEND_VM_NEXT_OPCODE();
3002 }
3003 
ZEND_QM_ASSIGN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3004 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3005 {
3006 	USE_OPLINE
3007 
3008 	zval *value;
3009 
3010 	SAVE_OPLINE();
3011 	value = opline->op1.zv;
3012 
3013 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
3014 	if (!0) {
3015 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3016 	}
3017 
3018 	CHECK_EXCEPTION();
3019 	ZEND_VM_NEXT_OPCODE();
3020 }
3021 
ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3022 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3023 {
3024 	USE_OPLINE
3025 
3026 	zval *value, *ret;
3027 
3028 	SAVE_OPLINE();
3029 	value = opline->op1.zv;
3030 
3031 	if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3032 		Z_ADDREF_P(value);
3033 		EX_T(opline->result.var).var.ptr = value;
3034 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
3035 	} else {
3036 		ALLOC_ZVAL(ret);
3037 		INIT_PZVAL_COPY(ret, value);
3038 		EX_T(opline->result.var).var.ptr = ret;
3039 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
3040 		if (!0) {
3041 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
3042 		}
3043 	}
3044 
3045 	CHECK_EXCEPTION();
3046 	ZEND_VM_NEXT_OPCODE();
3047 }
3048 
ZEND_ADD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3049 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3050 {
3051 	USE_OPLINE
3052 
3053 
3054 	SAVE_OPLINE();
3055 	fast_add_function(&EX_T(opline->result.var).tmp_var,
3056 		opline->op1.zv,
3057 		opline->op2.zv TSRMLS_CC);
3058 
3059 
3060 	CHECK_EXCEPTION();
3061 	ZEND_VM_NEXT_OPCODE();
3062 }
3063 
ZEND_SUB_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3064 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3065 {
3066 	USE_OPLINE
3067 
3068 
3069 	SAVE_OPLINE();
3070 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
3071 		opline->op1.zv,
3072 		opline->op2.zv TSRMLS_CC);
3073 
3074 
3075 	CHECK_EXCEPTION();
3076 	ZEND_VM_NEXT_OPCODE();
3077 }
3078 
ZEND_MUL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3079 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3080 {
3081 	USE_OPLINE
3082 
3083 
3084 	SAVE_OPLINE();
3085 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
3086 		opline->op1.zv,
3087 		opline->op2.zv TSRMLS_CC);
3088 
3089 
3090 	CHECK_EXCEPTION();
3091 	ZEND_VM_NEXT_OPCODE();
3092 }
3093 
ZEND_DIV_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3094 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3095 {
3096 	USE_OPLINE
3097 
3098 
3099 	SAVE_OPLINE();
3100 	fast_div_function(&EX_T(opline->result.var).tmp_var,
3101 		opline->op1.zv,
3102 		opline->op2.zv TSRMLS_CC);
3103 
3104 
3105 	CHECK_EXCEPTION();
3106 	ZEND_VM_NEXT_OPCODE();
3107 }
3108 
ZEND_MOD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3109 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3110 {
3111 	USE_OPLINE
3112 
3113 
3114 	SAVE_OPLINE();
3115 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
3116 		opline->op1.zv,
3117 		opline->op2.zv TSRMLS_CC);
3118 
3119 
3120 	CHECK_EXCEPTION();
3121 	ZEND_VM_NEXT_OPCODE();
3122 }
3123 
ZEND_SL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3124 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3125 {
3126 	USE_OPLINE
3127 
3128 
3129 	SAVE_OPLINE();
3130 	shift_left_function(&EX_T(opline->result.var).tmp_var,
3131 		opline->op1.zv,
3132 		opline->op2.zv TSRMLS_CC);
3133 
3134 
3135 	CHECK_EXCEPTION();
3136 	ZEND_VM_NEXT_OPCODE();
3137 }
3138 
ZEND_SR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3139 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3140 {
3141 	USE_OPLINE
3142 
3143 
3144 	SAVE_OPLINE();
3145 	shift_right_function(&EX_T(opline->result.var).tmp_var,
3146 		opline->op1.zv,
3147 		opline->op2.zv TSRMLS_CC);
3148 
3149 
3150 	CHECK_EXCEPTION();
3151 	ZEND_VM_NEXT_OPCODE();
3152 }
3153 
ZEND_CONCAT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3154 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3155 {
3156 	USE_OPLINE
3157 
3158 
3159 	SAVE_OPLINE();
3160 	concat_function(&EX_T(opline->result.var).tmp_var,
3161 		opline->op1.zv,
3162 		opline->op2.zv TSRMLS_CC);
3163 
3164 
3165 	CHECK_EXCEPTION();
3166 	ZEND_VM_NEXT_OPCODE();
3167 }
3168 
ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3169 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3170 {
3171 	USE_OPLINE
3172 
3173 
3174 	SAVE_OPLINE();
3175 	is_identical_function(&EX_T(opline->result.var).tmp_var,
3176 		opline->op1.zv,
3177 		opline->op2.zv TSRMLS_CC);
3178 
3179 
3180 	CHECK_EXCEPTION();
3181 	ZEND_VM_NEXT_OPCODE();
3182 }
3183 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3184 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3185 {
3186 	USE_OPLINE
3187 
3188 	zval *result = &EX_T(opline->result.var).tmp_var;
3189 
3190 	SAVE_OPLINE();
3191 	is_identical_function(result,
3192 		opline->op1.zv,
3193 		opline->op2.zv TSRMLS_CC);
3194 	Z_LVAL_P(result) = !Z_LVAL_P(result);
3195 
3196 
3197 	CHECK_EXCEPTION();
3198 	ZEND_VM_NEXT_OPCODE();
3199 }
3200 
ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3201 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3202 {
3203 	USE_OPLINE
3204 
3205 	zval *result = &EX_T(opline->result.var).tmp_var;
3206 
3207 	SAVE_OPLINE();
3208 	ZVAL_BOOL(result, fast_equal_function(result,
3209 		opline->op1.zv,
3210 		opline->op2.zv TSRMLS_CC));
3211 
3212 
3213 	CHECK_EXCEPTION();
3214 	ZEND_VM_NEXT_OPCODE();
3215 }
3216 
ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3217 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3218 {
3219 	USE_OPLINE
3220 
3221 	zval *result = &EX_T(opline->result.var).tmp_var;
3222 
3223 	SAVE_OPLINE();
3224 	ZVAL_BOOL(result, fast_not_equal_function(result,
3225 		opline->op1.zv,
3226 		opline->op2.zv TSRMLS_CC));
3227 
3228 
3229 	CHECK_EXCEPTION();
3230 	ZEND_VM_NEXT_OPCODE();
3231 }
3232 
ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3233 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3234 {
3235 	USE_OPLINE
3236 
3237 	zval *result = &EX_T(opline->result.var).tmp_var;
3238 
3239 	SAVE_OPLINE();
3240 	ZVAL_BOOL(result, fast_is_smaller_function(result,
3241 		opline->op1.zv,
3242 		opline->op2.zv TSRMLS_CC));
3243 
3244 
3245 	CHECK_EXCEPTION();
3246 	ZEND_VM_NEXT_OPCODE();
3247 }
3248 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3249 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3250 {
3251 	USE_OPLINE
3252 
3253 	zval *result = &EX_T(opline->result.var).tmp_var;
3254 
3255 	SAVE_OPLINE();
3256 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
3257 		opline->op1.zv,
3258 		opline->op2.zv TSRMLS_CC));
3259 
3260 
3261 	CHECK_EXCEPTION();
3262 	ZEND_VM_NEXT_OPCODE();
3263 }
3264 
ZEND_BW_OR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3265 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3266 {
3267 	USE_OPLINE
3268 
3269 
3270 	SAVE_OPLINE();
3271 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
3272 		opline->op1.zv,
3273 		opline->op2.zv TSRMLS_CC);
3274 
3275 
3276 	CHECK_EXCEPTION();
3277 	ZEND_VM_NEXT_OPCODE();
3278 }
3279 
ZEND_BW_AND_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3280 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3281 {
3282 	USE_OPLINE
3283 
3284 
3285 	SAVE_OPLINE();
3286 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
3287 		opline->op1.zv,
3288 		opline->op2.zv TSRMLS_CC);
3289 
3290 
3291 	CHECK_EXCEPTION();
3292 	ZEND_VM_NEXT_OPCODE();
3293 }
3294 
ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3295 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3296 {
3297 	USE_OPLINE
3298 
3299 
3300 	SAVE_OPLINE();
3301 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
3302 		opline->op1.zv,
3303 		opline->op2.zv TSRMLS_CC);
3304 
3305 
3306 	CHECK_EXCEPTION();
3307 	ZEND_VM_NEXT_OPCODE();
3308 }
3309 
ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3310 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3311 {
3312 	USE_OPLINE
3313 
3314 
3315 	SAVE_OPLINE();
3316 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
3317 		opline->op1.zv,
3318 		opline->op2.zv TSRMLS_CC);
3319 
3320 
3321 	CHECK_EXCEPTION();
3322 	ZEND_VM_NEXT_OPCODE();
3323 }
3324 
zend_fetch_var_address_helper_SPEC_CONST_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)3325 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
3326 {
3327 	USE_OPLINE
3328 	zend_free_op free_op1;
3329 	zval *varname;
3330 	zval **retval;
3331 	zval tmp_varname;
3332 	HashTable *target_symbol_table;
3333 	ulong hash_value;
3334 
3335 	SAVE_OPLINE();
3336 	varname = opline->op1.zv;
3337 
3338  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
3339 		ZVAL_COPY_VALUE(&tmp_varname, varname);
3340 		zval_copy_ctor(&tmp_varname);
3341 		Z_SET_REFCOUNT(tmp_varname, 1);
3342 		Z_UNSET_ISREF(tmp_varname);
3343 		convert_to_string(&tmp_varname);
3344 		varname = &tmp_varname;
3345 	}
3346 
3347 	if (IS_CONST != IS_UNUSED) {
3348 		zend_class_entry *ce;
3349 
3350 		if (IS_CONST == IS_CONST) {
3351 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3352 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
3353 			} else {
3354 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3355 				if (UNEXPECTED(ce == NULL)) {
3356 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
3357 						zval_dtor(&tmp_varname);
3358 					}
3359 
3360 					CHECK_EXCEPTION();
3361 					ZEND_VM_NEXT_OPCODE();
3362 				}
3363 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
3364 			}
3365 		} else {
3366 			ce = EX_T(opline->op2.var).class_entry;
3367 		}
3368 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3369 
3370 	} else {
3371 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
3372 /*
3373 		if (!target_symbol_table) {
3374 			CHECK_EXCEPTION();
3375 			ZEND_VM_NEXT_OPCODE();
3376 		}
3377 */
3378 		if (IS_CONST == IS_CONST) {
3379 			hash_value = Z_HASH_P(varname);
3380 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
3381 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
3382 		} else {
3383 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
3384 		}
3385 
3386 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
3387 			switch (type) {
3388 				case BP_VAR_R:
3389 				case BP_VAR_UNSET:
3390 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
3391 					/* break missing intentionally */
3392 				case BP_VAR_IS:
3393 					retval = &EG(uninitialized_zval_ptr);
3394 					break;
3395 				case BP_VAR_RW:
3396 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
3397 					/* break missing intentionally */
3398 				case BP_VAR_W:
3399 					Z_ADDREF_P(&EG(uninitialized_zval));
3400 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
3401 					break;
3402 				EMPTY_SWITCH_DEFAULT_CASE()
3403 			}
3404 		}
3405 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
3406 			case ZEND_FETCH_GLOBAL:
3407 				if (IS_CONST != IS_TMP_VAR) {
3408 
3409 				}
3410 				break;
3411 			case ZEND_FETCH_LOCAL:
3412 
3413 				break;
3414 			case ZEND_FETCH_STATIC:
3415 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
3416 				break;
3417 			case ZEND_FETCH_GLOBAL_LOCK:
3418 				if (IS_CONST == IS_VAR && !free_op1.var) {
3419 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
3420 				}
3421 				break;
3422 		}
3423 	}
3424 
3425 
3426 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
3427 		zval_dtor(&tmp_varname);
3428 	}
3429 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
3430 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
3431 	}
3432 	PZVAL_LOCK(*retval);
3433 	switch (type) {
3434 		case BP_VAR_R:
3435 		case BP_VAR_IS:
3436 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
3437 			break;
3438 		case BP_VAR_UNSET: {
3439 			zend_free_op free_res;
3440 
3441 			PZVAL_UNLOCK(*retval, &free_res);
3442 			if (retval != &EG(uninitialized_zval_ptr)) {
3443 				SEPARATE_ZVAL_IF_NOT_REF(retval);
3444 			}
3445 			PZVAL_LOCK(*retval);
3446 			FREE_OP_VAR_PTR(free_res);
3447 		}
3448 		/* break missing intentionally */
3449 		default:
3450 			EX_T(opline->result.var).var.ptr_ptr = retval;
3451 			break;
3452 	}
3453 	CHECK_EXCEPTION();
3454 	ZEND_VM_NEXT_OPCODE();
3455 }
3456 
ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3457 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3458 {
3459 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3460 }
3461 
ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3462 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3463 {
3464 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3465 }
3466 
ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3467 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3468 {
3469 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3470 }
3471 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3472 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3473 {
3474 	USE_OPLINE
3475 
3476 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3477 }
3478 
ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3479 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3480 {
3481 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3482 }
3483 
ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3484 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3485 {
3486 	return zend_fetch_var_address_helper_SPEC_CONST_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3487 }
3488 
ZEND_FETCH_DIM_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3489 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3490 {
3491 	USE_OPLINE
3492 
3493 	zval *container;
3494 
3495 	SAVE_OPLINE();
3496 
3497 	if (IS_CONST == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
3498 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
3499 	}
3500 	container = opline->op1.zv;
3501 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
3502 
3503 
3504 	CHECK_EXCEPTION();
3505 	ZEND_VM_NEXT_OPCODE();
3506 }
3507 
ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3508 static int ZEND_FASTCALL  ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3509 {
3510 	USE_OPLINE
3511 
3512 	zval *container;
3513 
3514 	SAVE_OPLINE();
3515 	container = opline->op1.zv;
3516 
3517 	if (UNEXPECTED(Z_TYPE_P(container) != IS_ARRAY)) {
3518 		PZVAL_LOCK(&EG(uninitialized_zval));
3519 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
3520 	} else {
3521 
3522 		zval *value = *zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
3523 
3524 		PZVAL_LOCK(value);
3525 		AI_SET_PTR(&EX_T(opline->result.var), value);
3526 
3527 	}
3528 	CHECK_EXCEPTION();
3529 	ZEND_VM_NEXT_OPCODE();
3530 }
3531 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3532 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3533 {
3534 	USE_OPLINE
3535 	zval *function_name;
3536 	zend_class_entry *ce;
3537 	call_slot *call = EX(call_slots) + opline->result.num;
3538 
3539 	SAVE_OPLINE();
3540 
3541 	if (IS_CONST == IS_CONST) {
3542 		/* no function found. try a static method in class */
3543 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
3544 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
3545 		} else {
3546 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
3547 			if (UNEXPECTED(EG(exception) != NULL)) {
3548 				HANDLE_EXCEPTION();
3549 			}
3550 			if (UNEXPECTED(ce == NULL)) {
3551 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
3552 			}
3553 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
3554 		}
3555 		call->called_scope = ce;
3556 	} else {
3557 		ce = EX_T(opline->op1.var).class_entry;
3558 
3559 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
3560 			call->called_scope = EG(called_scope);
3561 		} else {
3562 			call->called_scope = ce;
3563 		}
3564 	}
3565 
3566 	if (IS_CONST == IS_CONST &&
3567 	    IS_CONST == IS_CONST &&
3568 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
3569 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
3570 	} else if (IS_CONST != IS_CONST &&
3571 	           IS_CONST == IS_CONST &&
3572 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
3573 		/* do nothing */
3574 	} else if (IS_CONST != IS_UNUSED) {
3575 		char *function_name_strval = NULL;
3576 		int function_name_strlen = 0;
3577 
3578 
3579 		if (IS_CONST == IS_CONST) {
3580 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
3581 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
3582 		} else {
3583 			function_name = opline->op2.zv;
3584 
3585 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
3586 				if (UNEXPECTED(EG(exception) != NULL)) {
3587 					HANDLE_EXCEPTION();
3588 				}
3589 				zend_error_noreturn(E_ERROR, "Function name must be a string");
3590 			} else {
3591 				function_name_strval = Z_STRVAL_P(function_name);
3592 				function_name_strlen = Z_STRLEN_P(function_name);
3593  			}
3594 		}
3595 
3596 		if (function_name_strval) {
3597 			if (ce->get_static_method) {
3598 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
3599 			} else {
3600 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
3601 			}
3602 			if (UNEXPECTED(call->fbc == NULL)) {
3603 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
3604 			}
3605 			if (IS_CONST == IS_CONST &&
3606 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
3607 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
3608 				if (IS_CONST == IS_CONST) {
3609 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
3610 				} else {
3611 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
3612 				}
3613 			}
3614 		}
3615 		if (IS_CONST != IS_CONST) {
3616 
3617 		}
3618 	} else {
3619 		if (UNEXPECTED(ce->constructor == NULL)) {
3620 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
3621 		}
3622 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
3623 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
3624 		}
3625 		call->fbc = ce->constructor;
3626 	}
3627 
3628 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
3629 		call->object = NULL;
3630 	} else {
3631 		if (EG(This) &&
3632 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
3633 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
3634 		    /* We are calling method of the other (incompatible) class,
3635 		       but passing $this. This is done for compatibility with php-4. */
3636 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
3637 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
3638 			} else {
3639 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
3640 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
3641 			}
3642 		}
3643 		if ((call->object = EG(This))) {
3644 			Z_ADDREF_P(call->object);
3645 			call->called_scope = Z_OBJCE_P(call->object);
3646 		}
3647 	}
3648 	call->is_ctor_call = 0;
3649 	EX(call) = call;
3650 
3651 	CHECK_EXCEPTION();
3652 	ZEND_VM_NEXT_OPCODE();
3653 }
3654 
ZEND_CASE_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3655 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3656 {
3657 	USE_OPLINE
3658 
3659 
3660 	SAVE_OPLINE();
3661 	if (IS_CONST==IS_VAR) {
3662 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
3663 	}
3664 	is_equal_function(&EX_T(opline->result.var).tmp_var,
3665 				 opline->op1.zv,
3666 				 opline->op2.zv TSRMLS_CC);
3667 
3668 	CHECK_EXCEPTION();
3669 	ZEND_VM_NEXT_OPCODE();
3670 }
3671 
ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3672 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3673 {
3674 	USE_OPLINE
3675 
3676 	SAVE_OPLINE();
3677 	if (IS_CONST == IS_UNUSED) {
3678 		zend_constant *c;
3679 		zval *retval;
3680 
3681 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3682 			c = CACHED_PTR(opline->op2.literal->cache_slot);
3683 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
3684 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
3685 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
3686 				if(!actual) {
3687 					actual = Z_STRVAL_P(opline->op2.zv);
3688 				} else {
3689 					actual++;
3690 				}
3691 				/* non-qualified constant - allow text substitution */
3692 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
3693 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
3694 				CHECK_EXCEPTION();
3695 				ZEND_VM_NEXT_OPCODE();
3696 			} else {
3697 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
3698 			}
3699 		} else {
3700 			CACHE_PTR(opline->op2.literal->cache_slot, c);
3701 		}
3702 		retval = &EX_T(opline->result.var).tmp_var;
3703 		ZVAL_COPY_VALUE(retval, &c->value);
3704 		zval_copy_ctor(retval);
3705 		CHECK_EXCEPTION();
3706 		ZEND_VM_NEXT_OPCODE();
3707 	} else {
3708 		/* class constant */
3709 		zend_class_entry *ce;
3710 		zval **value;
3711 
3712 		if (IS_CONST == IS_CONST) {
3713 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3714 				value = CACHED_PTR(opline->op2.literal->cache_slot);
3715 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3716 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3717 				CHECK_EXCEPTION();
3718 				ZEND_VM_NEXT_OPCODE();
3719 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
3720 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
3721 			} else {
3722 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
3723 				if (UNEXPECTED(EG(exception) != NULL)) {
3724 					HANDLE_EXCEPTION();
3725 				}
3726 				if (UNEXPECTED(ce == NULL)) {
3727 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
3728 				}
3729 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
3730 			}
3731 		} else {
3732 			ce = EX_T(opline->op1.var).class_entry;
3733 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
3734 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3735 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3736 				CHECK_EXCEPTION();
3737 				ZEND_VM_NEXT_OPCODE();
3738 			}
3739 		}
3740 
3741 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
3742 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
3743 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
3744 				zend_class_entry *old_scope = EG(scope);
3745 
3746 				EG(scope) = ce;
3747 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
3748 				EG(scope) = old_scope;
3749 			}
3750 			if (IS_CONST == IS_CONST) {
3751 				CACHE_PTR(opline->op2.literal->cache_slot, value);
3752 			} else {
3753 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
3754 			}
3755 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
3756 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
3757 		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && strcmp(Z_STRVAL_P(opline->op2.zv), "class") == 0) {
3758 			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */
3759 			ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, ce->name, ce->name_length, 1);
3760 		} else {
3761 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
3762 		}
3763 
3764 		CHECK_EXCEPTION();
3765 		ZEND_VM_NEXT_OPCODE();
3766 	}
3767 }
3768 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3769 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3770 {
3771 	USE_OPLINE
3772 
3773 	zval *expr_ptr;
3774 
3775 	SAVE_OPLINE();
3776 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
3777 		zval **expr_ptr_ptr = NULL;
3778 
3779 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
3780 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
3781 		}
3782 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
3783 		expr_ptr = *expr_ptr_ptr;
3784 		Z_ADDREF_P(expr_ptr);
3785 	} else {
3786 		expr_ptr=opline->op1.zv;
3787 		if (0) { /* temporary variable */
3788 			zval *new_expr;
3789 
3790 			ALLOC_ZVAL(new_expr);
3791 			INIT_PZVAL_COPY(new_expr, expr_ptr);
3792 			expr_ptr = new_expr;
3793 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
3794 			zval *new_expr;
3795 
3796 			ALLOC_ZVAL(new_expr);
3797 			INIT_PZVAL_COPY(new_expr, expr_ptr);
3798 			expr_ptr = new_expr;
3799 			zendi_zval_copy_ctor(*expr_ptr);
3800 		} else {
3801 			Z_ADDREF_P(expr_ptr);
3802 		}
3803 	}
3804 
3805 	if (IS_CONST != IS_UNUSED) {
3806 
3807 		zval *offset = opline->op2.zv;
3808 		ulong hval;
3809 
3810 		switch (Z_TYPE_P(offset)) {
3811 			case IS_DOUBLE:
3812 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
3813 				goto num_index;
3814 			case IS_LONG:
3815 			case IS_BOOL:
3816 				hval = Z_LVAL_P(offset);
3817 num_index:
3818 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
3819 				break;
3820 			case IS_STRING:
3821 				if (IS_CONST == IS_CONST) {
3822 					hval = Z_HASH_P(offset);
3823 				} else {
3824 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
3825 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
3826 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
3827 					} else {
3828 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
3829 					}
3830 				}
3831 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
3832 				break;
3833 			case IS_NULL:
3834 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
3835 				break;
3836 			default:
3837 				zend_error(E_WARNING, "Illegal offset type");
3838 				zval_ptr_dtor(&expr_ptr);
3839 				/* do nothing */
3840 				break;
3841 		}
3842 
3843 	} else {
3844 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
3845 	}
3846 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
3847 
3848 	} else {
3849 
3850 	}
3851 	CHECK_EXCEPTION();
3852 	ZEND_VM_NEXT_OPCODE();
3853 }
3854 
ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3855 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3856 {
3857 	USE_OPLINE
3858 
3859 	array_init(&EX_T(opline->result.var).tmp_var);
3860 	if (IS_CONST == IS_UNUSED) {
3861 		ZEND_VM_NEXT_OPCODE();
3862 #if 0 || IS_CONST != IS_UNUSED
3863 	} else {
3864 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
3865 #endif
3866 	}
3867 }
3868 
ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3869 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3870 {
3871 	USE_OPLINE
3872 	zval tmp, *varname;
3873 	HashTable *target_symbol_table;
3874 
3875 
3876 	SAVE_OPLINE();
3877 	if (IS_CONST == IS_CV &&
3878 	    IS_CONST == IS_UNUSED &&
3879 	    (opline->extended_value & ZEND_QUICK_SET)) {
3880 		if (EG(active_symbol_table)) {
3881 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
3882 
3883 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
3884 			EX_CV(opline->op1.var) = NULL;
3885 		} else if (EX_CV(opline->op1.var)) {
3886 			zval_ptr_dtor(EX_CV(opline->op1.var));
3887 			EX_CV(opline->op1.var) = NULL;
3888 		}
3889 		CHECK_EXCEPTION();
3890 		ZEND_VM_NEXT_OPCODE();
3891 	}
3892 
3893 	varname = opline->op1.zv;
3894 
3895 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
3896 		ZVAL_COPY_VALUE(&tmp, varname);
3897 		zval_copy_ctor(&tmp);
3898 		convert_to_string(&tmp);
3899 		varname = &tmp;
3900 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3901 		Z_ADDREF_P(varname);
3902 	}
3903 
3904 	if (IS_CONST != IS_UNUSED) {
3905 		zend_class_entry *ce;
3906 
3907 		if (IS_CONST == IS_CONST) {
3908 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3909 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
3910 			} else {
3911 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3912 				if (UNEXPECTED(EG(exception) != NULL)) {
3913 					if (IS_CONST != IS_CONST && varname == &tmp) {
3914 						zval_dtor(&tmp);
3915 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3916 						zval_ptr_dtor(&varname);
3917 					}
3918 
3919 					HANDLE_EXCEPTION();
3920 				}
3921 				if (UNEXPECTED(ce == NULL)) {
3922 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
3923 				}
3924 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
3925 			}
3926 		} else {
3927 			ce = EX_T(opline->op2.var).class_entry;
3928 		}
3929 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3930 	} else {
3931 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
3932 
3933 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
3934 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
3935 	}
3936 
3937 	if (IS_CONST != IS_CONST && varname == &tmp) {
3938 		zval_dtor(&tmp);
3939 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
3940 		zval_ptr_dtor(&varname);
3941 	}
3942 
3943 	CHECK_EXCEPTION();
3944 	ZEND_VM_NEXT_OPCODE();
3945 }
3946 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)3947 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
3948 {
3949 	USE_OPLINE
3950 	zval **value;
3951 	zend_bool isset = 1;
3952 
3953 	SAVE_OPLINE();
3954 	if (IS_CONST == IS_CV &&
3955 	    IS_CONST == IS_UNUSED &&
3956 	    (opline->extended_value & ZEND_QUICK_SET)) {
3957 		if (EX_CV(opline->op1.var)) {
3958 			value = EX_CV(opline->op1.var);
3959 		} else if (EG(active_symbol_table)) {
3960 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
3961 
3962 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
3963 				isset = 0;
3964 			}
3965 		} else {
3966 			isset = 0;
3967 		}
3968 	} else {
3969 		HashTable *target_symbol_table;
3970 
3971 		zval tmp, *varname = opline->op1.zv;
3972 
3973 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
3974 			ZVAL_COPY_VALUE(&tmp, varname);
3975 			zval_copy_ctor(&tmp);
3976 			convert_to_string(&tmp);
3977 			varname = &tmp;
3978 		}
3979 
3980 		if (IS_CONST != IS_UNUSED) {
3981 			zend_class_entry *ce;
3982 
3983 			if (IS_CONST == IS_CONST) {
3984 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
3985 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
3986 				} else {
3987 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
3988 					if (UNEXPECTED(ce == NULL)) {
3989 						CHECK_EXCEPTION();
3990 						ZEND_VM_NEXT_OPCODE();
3991 					}
3992 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
3993 				}
3994 			} else {
3995 				ce = EX_T(opline->op2.var).class_entry;
3996 			}
3997 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
3998 			if (!value) {
3999 				isset = 0;
4000 			}
4001 		} else {
4002 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
4003 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
4004 				isset = 0;
4005 			}
4006 		}
4007 
4008 		if (IS_CONST != IS_CONST && varname == &tmp) {
4009 			zval_dtor(&tmp);
4010 		}
4011 
4012 	}
4013 
4014 	if (opline->extended_value & ZEND_ISSET) {
4015 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
4016 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
4017 		} else {
4018 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
4019 		}
4020 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
4021 		if (!isset || !i_zend_is_true(*value)) {
4022 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
4023 		} else {
4024 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
4025 		}
4026 	}
4027 
4028 	CHECK_EXCEPTION();
4029 	ZEND_VM_NEXT_OPCODE();
4030 }
4031 
ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4032 static int ZEND_FASTCALL  ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4033 {
4034 	USE_OPLINE
4035 
4036 	zval *name;
4037 	zval *val;
4038 	zend_constant c;
4039 
4040 	SAVE_OPLINE();
4041 	name  = opline->op1.zv;
4042 	val   = opline->op2.zv;
4043 
4044 	if ((Z_TYPE_P(val) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT || Z_TYPE_P(val) == IS_CONSTANT_ARRAY) {
4045 		zval tmp;
4046 		zval *tmp_ptr = &tmp;
4047 
4048 		ZVAL_COPY_VALUE(&tmp, val);
4049 		if (Z_TYPE_P(val) == IS_CONSTANT_ARRAY) {
4050 			zval_copy_ctor(&tmp);
4051 		}
4052 		INIT_PZVAL(&tmp);
4053 		zval_update_constant(&tmp_ptr, NULL TSRMLS_CC);
4054 		c.value = *tmp_ptr;
4055 	} else {
4056 		INIT_PZVAL_COPY(&c.value, val);
4057 		zval_copy_ctor(&c.value);
4058 	}
4059 	c.flags = CONST_CS; /* non persistent, case sensetive */
4060 	c.name = IS_INTERNED(Z_STRVAL_P(name)) ? Z_STRVAL_P(name) : zend_strndup(Z_STRVAL_P(name), Z_STRLEN_P(name));
4061 	c.name_len = Z_STRLEN_P(name)+1;
4062 	c.module_number = PHP_USER_CONSTANT;
4063 
4064 	if (zend_register_constant(&c TSRMLS_CC) == FAILURE) {
4065 	}
4066 
4067 
4068 	CHECK_EXCEPTION();
4069 	ZEND_VM_NEXT_OPCODE();
4070 }
4071 
ZEND_YIELD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4072 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4073 {
4074 	USE_OPLINE
4075 
4076 	/* The generator object is stored in return_value_ptr_ptr */
4077 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
4078 
4079 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
4080 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
4081 	}
4082 
4083 	/* Destroy the previously yielded value */
4084 	if (generator->value) {
4085 		zval_ptr_dtor(&generator->value);
4086 	}
4087 
4088 	/* Destroy the previously yielded key */
4089 	if (generator->key) {
4090 		zval_ptr_dtor(&generator->key);
4091 	}
4092 
4093 	/* Set the new yielded value */
4094 	if (IS_CONST != IS_UNUSED) {
4095 
4096 
4097 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
4098 			/* Constants and temporary variables aren't yieldable by reference,
4099 			 * but we still allow them with a notice. */
4100 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
4101 				zval *value, *copy;
4102 
4103 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
4104 
4105 				value = opline->op1.zv;
4106 				ALLOC_ZVAL(copy);
4107 				INIT_PZVAL_COPY(copy, value);
4108 
4109 				/* Temporary variables don't need ctor copying */
4110 				if (!0) {
4111 					zval_copy_ctor(copy);
4112 				}
4113 
4114 				generator->value = copy;
4115 			} else {
4116 				zval **value_ptr = NULL;
4117 
4118 				if (IS_CONST == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
4119 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
4120 				}
4121 
4122 				/* If a function call result is yielded and the function did
4123 				 * not return by reference we throw a notice. */
4124 				if (IS_CONST == IS_VAR && !Z_ISREF_PP(value_ptr)
4125 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
4126 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
4127 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
4128 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
4129 
4130 					Z_ADDREF_PP(value_ptr);
4131 					generator->value = *value_ptr;
4132 				} else {
4133 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
4134 					Z_ADDREF_PP(value_ptr);
4135 					generator->value = *value_ptr;
4136 				}
4137 
4138 			}
4139 		} else {
4140 			zval *value = opline->op1.zv;
4141 
4142 			/* Consts, temporary variables and references need copying */
4143 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
4144 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
4145 			) {
4146 				zval *copy;
4147 
4148 				ALLOC_ZVAL(copy);
4149 				INIT_PZVAL_COPY(copy, value);
4150 
4151 				/* Temporary variables don't need ctor copying */
4152 				if (!0) {
4153 					zval_copy_ctor(copy);
4154 				}
4155 
4156 				generator->value = copy;
4157 			} else {
4158 				Z_ADDREF_P(value);
4159 				generator->value = value;
4160 			}
4161 
4162 		}
4163 	} else {
4164 		/* If no value was specified yield null */
4165 		Z_ADDREF(EG(uninitialized_zval));
4166 		generator->value = &EG(uninitialized_zval);
4167 	}
4168 
4169 	/* Set the new yielded key */
4170 	if (IS_CONST != IS_UNUSED) {
4171 
4172 		zval *key = opline->op2.zv;
4173 
4174 		/* Consts, temporary variables and references need copying */
4175 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
4176 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
4177 		) {
4178 			zval *copy;
4179 
4180 			ALLOC_ZVAL(copy);
4181 			INIT_PZVAL_COPY(copy, key);
4182 
4183 			/* Temporary variables don't need ctor copying */
4184 			if (!0) {
4185 				zval_copy_ctor(copy);
4186 			}
4187 
4188 			generator->key = copy;
4189 		} else {
4190 			Z_ADDREF_P(key);
4191 			generator->key = key;
4192 		}
4193 
4194 		if (Z_TYPE_P(generator->key) == IS_LONG
4195 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
4196 		) {
4197 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
4198 		}
4199 
4200 	} else {
4201 		/* If no key was specified we use auto-increment keys */
4202 		generator->largest_used_integer_key++;
4203 
4204 		ALLOC_INIT_ZVAL(generator->key);
4205 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
4206 	}
4207 
4208 	if (RETURN_VALUE_USED(opline)) {
4209 		/* If the return value of yield is used set the send
4210 		 * target and initialize it to NULL */
4211 		generator->send_target = &EX_T(opline->result.var).var.ptr;
4212 		Z_ADDREF(EG(uninitialized_zval));
4213 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
4214 	} else {
4215 		generator->send_target = NULL;
4216 	}
4217 
4218 	/* We increment to the next op, so we are at the correct position when the
4219 	 * generator is resumed. */
4220 	ZEND_VM_INC_OPCODE();
4221 
4222 	/* The GOTO VM uses a local opline variable. We need to set the opline
4223 	 * variable in execute_data so we don't resume at an old position. */
4224 	SAVE_OPLINE();
4225 
4226 	ZEND_VM_RETURN();
4227 }
4228 
ZEND_ADD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4229 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4230 {
4231 	USE_OPLINE
4232 	zend_free_op free_op2;
4233 
4234 	SAVE_OPLINE();
4235 	fast_add_function(&EX_T(opline->result.var).tmp_var,
4236 		opline->op1.zv,
4237 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4238 
4239 	zval_dtor(free_op2.var);
4240 	CHECK_EXCEPTION();
4241 	ZEND_VM_NEXT_OPCODE();
4242 }
4243 
ZEND_SUB_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4244 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4245 {
4246 	USE_OPLINE
4247 	zend_free_op free_op2;
4248 
4249 	SAVE_OPLINE();
4250 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
4251 		opline->op1.zv,
4252 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4253 
4254 	zval_dtor(free_op2.var);
4255 	CHECK_EXCEPTION();
4256 	ZEND_VM_NEXT_OPCODE();
4257 }
4258 
ZEND_MUL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4259 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4260 {
4261 	USE_OPLINE
4262 	zend_free_op free_op2;
4263 
4264 	SAVE_OPLINE();
4265 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
4266 		opline->op1.zv,
4267 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4268 
4269 	zval_dtor(free_op2.var);
4270 	CHECK_EXCEPTION();
4271 	ZEND_VM_NEXT_OPCODE();
4272 }
4273 
ZEND_DIV_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4274 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4275 {
4276 	USE_OPLINE
4277 	zend_free_op free_op2;
4278 
4279 	SAVE_OPLINE();
4280 	fast_div_function(&EX_T(opline->result.var).tmp_var,
4281 		opline->op1.zv,
4282 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4283 
4284 	zval_dtor(free_op2.var);
4285 	CHECK_EXCEPTION();
4286 	ZEND_VM_NEXT_OPCODE();
4287 }
4288 
ZEND_MOD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4289 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4290 {
4291 	USE_OPLINE
4292 	zend_free_op free_op2;
4293 
4294 	SAVE_OPLINE();
4295 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
4296 		opline->op1.zv,
4297 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4298 
4299 	zval_dtor(free_op2.var);
4300 	CHECK_EXCEPTION();
4301 	ZEND_VM_NEXT_OPCODE();
4302 }
4303 
ZEND_SL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4304 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4305 {
4306 	USE_OPLINE
4307 	zend_free_op free_op2;
4308 
4309 	SAVE_OPLINE();
4310 	shift_left_function(&EX_T(opline->result.var).tmp_var,
4311 		opline->op1.zv,
4312 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4313 
4314 	zval_dtor(free_op2.var);
4315 	CHECK_EXCEPTION();
4316 	ZEND_VM_NEXT_OPCODE();
4317 }
4318 
ZEND_SR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4319 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4320 {
4321 	USE_OPLINE
4322 	zend_free_op free_op2;
4323 
4324 	SAVE_OPLINE();
4325 	shift_right_function(&EX_T(opline->result.var).tmp_var,
4326 		opline->op1.zv,
4327 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4328 
4329 	zval_dtor(free_op2.var);
4330 	CHECK_EXCEPTION();
4331 	ZEND_VM_NEXT_OPCODE();
4332 }
4333 
ZEND_CONCAT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4334 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4335 {
4336 	USE_OPLINE
4337 	zend_free_op free_op2;
4338 
4339 	SAVE_OPLINE();
4340 	concat_function(&EX_T(opline->result.var).tmp_var,
4341 		opline->op1.zv,
4342 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4343 
4344 	zval_dtor(free_op2.var);
4345 	CHECK_EXCEPTION();
4346 	ZEND_VM_NEXT_OPCODE();
4347 }
4348 
ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4349 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4350 {
4351 	USE_OPLINE
4352 	zend_free_op free_op2;
4353 
4354 	SAVE_OPLINE();
4355 	is_identical_function(&EX_T(opline->result.var).tmp_var,
4356 		opline->op1.zv,
4357 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4358 
4359 	zval_dtor(free_op2.var);
4360 	CHECK_EXCEPTION();
4361 	ZEND_VM_NEXT_OPCODE();
4362 }
4363 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4364 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4365 {
4366 	USE_OPLINE
4367 	zend_free_op free_op2;
4368 	zval *result = &EX_T(opline->result.var).tmp_var;
4369 
4370 	SAVE_OPLINE();
4371 	is_identical_function(result,
4372 		opline->op1.zv,
4373 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4374 	Z_LVAL_P(result) = !Z_LVAL_P(result);
4375 
4376 	zval_dtor(free_op2.var);
4377 	CHECK_EXCEPTION();
4378 	ZEND_VM_NEXT_OPCODE();
4379 }
4380 
ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4381 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4382 {
4383 	USE_OPLINE
4384 	zend_free_op free_op2;
4385 	zval *result = &EX_T(opline->result.var).tmp_var;
4386 
4387 	SAVE_OPLINE();
4388 	ZVAL_BOOL(result, fast_equal_function(result,
4389 		opline->op1.zv,
4390 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
4391 
4392 	zval_dtor(free_op2.var);
4393 	CHECK_EXCEPTION();
4394 	ZEND_VM_NEXT_OPCODE();
4395 }
4396 
ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4397 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4398 {
4399 	USE_OPLINE
4400 	zend_free_op free_op2;
4401 	zval *result = &EX_T(opline->result.var).tmp_var;
4402 
4403 	SAVE_OPLINE();
4404 	ZVAL_BOOL(result, fast_not_equal_function(result,
4405 		opline->op1.zv,
4406 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
4407 
4408 	zval_dtor(free_op2.var);
4409 	CHECK_EXCEPTION();
4410 	ZEND_VM_NEXT_OPCODE();
4411 }
4412 
ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4413 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4414 {
4415 	USE_OPLINE
4416 	zend_free_op free_op2;
4417 	zval *result = &EX_T(opline->result.var).tmp_var;
4418 
4419 	SAVE_OPLINE();
4420 	ZVAL_BOOL(result, fast_is_smaller_function(result,
4421 		opline->op1.zv,
4422 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
4423 
4424 	zval_dtor(free_op2.var);
4425 	CHECK_EXCEPTION();
4426 	ZEND_VM_NEXT_OPCODE();
4427 }
4428 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4429 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4430 {
4431 	USE_OPLINE
4432 	zend_free_op free_op2;
4433 	zval *result = &EX_T(opline->result.var).tmp_var;
4434 
4435 	SAVE_OPLINE();
4436 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
4437 		opline->op1.zv,
4438 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
4439 
4440 	zval_dtor(free_op2.var);
4441 	CHECK_EXCEPTION();
4442 	ZEND_VM_NEXT_OPCODE();
4443 }
4444 
ZEND_BW_OR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4445 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4446 {
4447 	USE_OPLINE
4448 	zend_free_op free_op2;
4449 
4450 	SAVE_OPLINE();
4451 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
4452 		opline->op1.zv,
4453 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4454 
4455 	zval_dtor(free_op2.var);
4456 	CHECK_EXCEPTION();
4457 	ZEND_VM_NEXT_OPCODE();
4458 }
4459 
ZEND_BW_AND_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4460 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4461 {
4462 	USE_OPLINE
4463 	zend_free_op free_op2;
4464 
4465 	SAVE_OPLINE();
4466 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
4467 		opline->op1.zv,
4468 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4469 
4470 	zval_dtor(free_op2.var);
4471 	CHECK_EXCEPTION();
4472 	ZEND_VM_NEXT_OPCODE();
4473 }
4474 
ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4475 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4476 {
4477 	USE_OPLINE
4478 	zend_free_op free_op2;
4479 
4480 	SAVE_OPLINE();
4481 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
4482 		opline->op1.zv,
4483 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4484 
4485 	zval_dtor(free_op2.var);
4486 	CHECK_EXCEPTION();
4487 	ZEND_VM_NEXT_OPCODE();
4488 }
4489 
ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4490 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4491 {
4492 	USE_OPLINE
4493 	zend_free_op free_op2;
4494 
4495 	SAVE_OPLINE();
4496 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
4497 		opline->op1.zv,
4498 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4499 
4500 	zval_dtor(free_op2.var);
4501 	CHECK_EXCEPTION();
4502 	ZEND_VM_NEXT_OPCODE();
4503 }
4504 
ZEND_FETCH_DIM_R_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4505 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4506 {
4507 	USE_OPLINE
4508 	zend_free_op free_op2;
4509 	zval *container;
4510 
4511 	SAVE_OPLINE();
4512 
4513 	if (IS_CONST == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
4514 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
4515 	}
4516 	container = opline->op1.zv;
4517 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
4518 	zval_dtor(free_op2.var);
4519 
4520 	CHECK_EXCEPTION();
4521 	ZEND_VM_NEXT_OPCODE();
4522 }
4523 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4524 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4525 {
4526 	USE_OPLINE
4527 	zval *function_name;
4528 	zend_class_entry *ce;
4529 	call_slot *call = EX(call_slots) + opline->result.num;
4530 
4531 	SAVE_OPLINE();
4532 
4533 	if (IS_CONST == IS_CONST) {
4534 		/* no function found. try a static method in class */
4535 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
4536 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
4537 		} else {
4538 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
4539 			if (UNEXPECTED(EG(exception) != NULL)) {
4540 				HANDLE_EXCEPTION();
4541 			}
4542 			if (UNEXPECTED(ce == NULL)) {
4543 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
4544 			}
4545 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
4546 		}
4547 		call->called_scope = ce;
4548 	} else {
4549 		ce = EX_T(opline->op1.var).class_entry;
4550 
4551 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
4552 			call->called_scope = EG(called_scope);
4553 		} else {
4554 			call->called_scope = ce;
4555 		}
4556 	}
4557 
4558 	if (IS_CONST == IS_CONST &&
4559 	    IS_TMP_VAR == IS_CONST &&
4560 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
4561 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
4562 	} else if (IS_CONST != IS_CONST &&
4563 	           IS_TMP_VAR == IS_CONST &&
4564 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
4565 		/* do nothing */
4566 	} else if (IS_TMP_VAR != IS_UNUSED) {
4567 		char *function_name_strval = NULL;
4568 		int function_name_strlen = 0;
4569 		zend_free_op free_op2;
4570 
4571 		if (IS_TMP_VAR == IS_CONST) {
4572 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
4573 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
4574 		} else {
4575 			function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
4576 
4577 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
4578 				if (UNEXPECTED(EG(exception) != NULL)) {
4579 					HANDLE_EXCEPTION();
4580 				}
4581 				zend_error_noreturn(E_ERROR, "Function name must be a string");
4582 			} else {
4583 				function_name_strval = Z_STRVAL_P(function_name);
4584 				function_name_strlen = Z_STRLEN_P(function_name);
4585  			}
4586 		}
4587 
4588 		if (function_name_strval) {
4589 			if (ce->get_static_method) {
4590 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
4591 			} else {
4592 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
4593 			}
4594 			if (UNEXPECTED(call->fbc == NULL)) {
4595 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
4596 			}
4597 			if (IS_TMP_VAR == IS_CONST &&
4598 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
4599 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
4600 				if (IS_CONST == IS_CONST) {
4601 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
4602 				} else {
4603 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
4604 				}
4605 			}
4606 		}
4607 		if (IS_TMP_VAR != IS_CONST) {
4608 			zval_dtor(free_op2.var);
4609 		}
4610 	} else {
4611 		if (UNEXPECTED(ce->constructor == NULL)) {
4612 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
4613 		}
4614 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
4615 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
4616 		}
4617 		call->fbc = ce->constructor;
4618 	}
4619 
4620 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
4621 		call->object = NULL;
4622 	} else {
4623 		if (EG(This) &&
4624 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
4625 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
4626 		    /* We are calling method of the other (incompatible) class,
4627 		       but passing $this. This is done for compatibility with php-4. */
4628 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
4629 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
4630 			} else {
4631 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
4632 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
4633 			}
4634 		}
4635 		if ((call->object = EG(This))) {
4636 			Z_ADDREF_P(call->object);
4637 			call->called_scope = Z_OBJCE_P(call->object);
4638 		}
4639 	}
4640 	call->is_ctor_call = 0;
4641 	EX(call) = call;
4642 
4643 	CHECK_EXCEPTION();
4644 	ZEND_VM_NEXT_OPCODE();
4645 }
4646 
ZEND_CASE_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4647 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4648 {
4649 	USE_OPLINE
4650 	zend_free_op free_op2;
4651 
4652 	SAVE_OPLINE();
4653 	if (IS_CONST==IS_VAR) {
4654 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
4655 	}
4656 	is_equal_function(&EX_T(opline->result.var).tmp_var,
4657 				 opline->op1.zv,
4658 				 _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4659 
4660 	zval_dtor(free_op2.var);
4661 	CHECK_EXCEPTION();
4662 	ZEND_VM_NEXT_OPCODE();
4663 }
4664 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4665 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4666 {
4667 	USE_OPLINE
4668 
4669 	zval *expr_ptr;
4670 
4671 	SAVE_OPLINE();
4672 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
4673 		zval **expr_ptr_ptr = NULL;
4674 
4675 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
4676 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
4677 		}
4678 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
4679 		expr_ptr = *expr_ptr_ptr;
4680 		Z_ADDREF_P(expr_ptr);
4681 	} else {
4682 		expr_ptr=opline->op1.zv;
4683 		if (0) { /* temporary variable */
4684 			zval *new_expr;
4685 
4686 			ALLOC_ZVAL(new_expr);
4687 			INIT_PZVAL_COPY(new_expr, expr_ptr);
4688 			expr_ptr = new_expr;
4689 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
4690 			zval *new_expr;
4691 
4692 			ALLOC_ZVAL(new_expr);
4693 			INIT_PZVAL_COPY(new_expr, expr_ptr);
4694 			expr_ptr = new_expr;
4695 			zendi_zval_copy_ctor(*expr_ptr);
4696 		} else {
4697 			Z_ADDREF_P(expr_ptr);
4698 		}
4699 	}
4700 
4701 	if (IS_TMP_VAR != IS_UNUSED) {
4702 		zend_free_op free_op2;
4703 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
4704 		ulong hval;
4705 
4706 		switch (Z_TYPE_P(offset)) {
4707 			case IS_DOUBLE:
4708 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
4709 				goto num_index;
4710 			case IS_LONG:
4711 			case IS_BOOL:
4712 				hval = Z_LVAL_P(offset);
4713 num_index:
4714 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
4715 				break;
4716 			case IS_STRING:
4717 				if (IS_TMP_VAR == IS_CONST) {
4718 					hval = Z_HASH_P(offset);
4719 				} else {
4720 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
4721 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
4722 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
4723 					} else {
4724 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
4725 					}
4726 				}
4727 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
4728 				break;
4729 			case IS_NULL:
4730 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
4731 				break;
4732 			default:
4733 				zend_error(E_WARNING, "Illegal offset type");
4734 				zval_ptr_dtor(&expr_ptr);
4735 				/* do nothing */
4736 				break;
4737 		}
4738 		zval_dtor(free_op2.var);
4739 	} else {
4740 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
4741 	}
4742 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
4743 
4744 	} else {
4745 
4746 	}
4747 	CHECK_EXCEPTION();
4748 	ZEND_VM_NEXT_OPCODE();
4749 }
4750 
ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4751 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4752 {
4753 	USE_OPLINE
4754 
4755 	array_init(&EX_T(opline->result.var).tmp_var);
4756 	if (IS_CONST == IS_UNUSED) {
4757 		ZEND_VM_NEXT_OPCODE();
4758 #if 0 || IS_CONST != IS_UNUSED
4759 	} else {
4760 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
4761 #endif
4762 	}
4763 }
4764 
ZEND_YIELD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4765 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4766 {
4767 	USE_OPLINE
4768 
4769 	/* The generator object is stored in return_value_ptr_ptr */
4770 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
4771 
4772 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
4773 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
4774 	}
4775 
4776 	/* Destroy the previously yielded value */
4777 	if (generator->value) {
4778 		zval_ptr_dtor(&generator->value);
4779 	}
4780 
4781 	/* Destroy the previously yielded key */
4782 	if (generator->key) {
4783 		zval_ptr_dtor(&generator->key);
4784 	}
4785 
4786 	/* Set the new yielded value */
4787 	if (IS_CONST != IS_UNUSED) {
4788 
4789 
4790 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
4791 			/* Constants and temporary variables aren't yieldable by reference,
4792 			 * but we still allow them with a notice. */
4793 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
4794 				zval *value, *copy;
4795 
4796 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
4797 
4798 				value = opline->op1.zv;
4799 				ALLOC_ZVAL(copy);
4800 				INIT_PZVAL_COPY(copy, value);
4801 
4802 				/* Temporary variables don't need ctor copying */
4803 				if (!0) {
4804 					zval_copy_ctor(copy);
4805 				}
4806 
4807 				generator->value = copy;
4808 			} else {
4809 				zval **value_ptr = NULL;
4810 
4811 				if (IS_CONST == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
4812 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
4813 				}
4814 
4815 				/* If a function call result is yielded and the function did
4816 				 * not return by reference we throw a notice. */
4817 				if (IS_CONST == IS_VAR && !Z_ISREF_PP(value_ptr)
4818 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
4819 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
4820 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
4821 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
4822 
4823 					Z_ADDREF_PP(value_ptr);
4824 					generator->value = *value_ptr;
4825 				} else {
4826 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
4827 					Z_ADDREF_PP(value_ptr);
4828 					generator->value = *value_ptr;
4829 				}
4830 
4831 			}
4832 		} else {
4833 			zval *value = opline->op1.zv;
4834 
4835 			/* Consts, temporary variables and references need copying */
4836 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
4837 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
4838 			) {
4839 				zval *copy;
4840 
4841 				ALLOC_ZVAL(copy);
4842 				INIT_PZVAL_COPY(copy, value);
4843 
4844 				/* Temporary variables don't need ctor copying */
4845 				if (!0) {
4846 					zval_copy_ctor(copy);
4847 				}
4848 
4849 				generator->value = copy;
4850 			} else {
4851 				Z_ADDREF_P(value);
4852 				generator->value = value;
4853 			}
4854 
4855 		}
4856 	} else {
4857 		/* If no value was specified yield null */
4858 		Z_ADDREF(EG(uninitialized_zval));
4859 		generator->value = &EG(uninitialized_zval);
4860 	}
4861 
4862 	/* Set the new yielded key */
4863 	if (IS_TMP_VAR != IS_UNUSED) {
4864 		zend_free_op free_op2;
4865 		zval *key = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
4866 
4867 		/* Consts, temporary variables and references need copying */
4868 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
4869 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
4870 		) {
4871 			zval *copy;
4872 
4873 			ALLOC_ZVAL(copy);
4874 			INIT_PZVAL_COPY(copy, key);
4875 
4876 			/* Temporary variables don't need ctor copying */
4877 			if (!1) {
4878 				zval_copy_ctor(copy);
4879 			}
4880 
4881 			generator->key = copy;
4882 		} else {
4883 			Z_ADDREF_P(key);
4884 			generator->key = key;
4885 		}
4886 
4887 		if (Z_TYPE_P(generator->key) == IS_LONG
4888 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
4889 		) {
4890 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
4891 		}
4892 
4893 	} else {
4894 		/* If no key was specified we use auto-increment keys */
4895 		generator->largest_used_integer_key++;
4896 
4897 		ALLOC_INIT_ZVAL(generator->key);
4898 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
4899 	}
4900 
4901 	if (RETURN_VALUE_USED(opline)) {
4902 		/* If the return value of yield is used set the send
4903 		 * target and initialize it to NULL */
4904 		generator->send_target = &EX_T(opline->result.var).var.ptr;
4905 		Z_ADDREF(EG(uninitialized_zval));
4906 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
4907 	} else {
4908 		generator->send_target = NULL;
4909 	}
4910 
4911 	/* We increment to the next op, so we are at the correct position when the
4912 	 * generator is resumed. */
4913 	ZEND_VM_INC_OPCODE();
4914 
4915 	/* The GOTO VM uses a local opline variable. We need to set the opline
4916 	 * variable in execute_data so we don't resume at an old position. */
4917 	SAVE_OPLINE();
4918 
4919 	ZEND_VM_RETURN();
4920 }
4921 
ZEND_ADD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4922 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4923 {
4924 	USE_OPLINE
4925 	zend_free_op free_op2;
4926 
4927 	SAVE_OPLINE();
4928 	fast_add_function(&EX_T(opline->result.var).tmp_var,
4929 		opline->op1.zv,
4930 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4931 
4932 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4933 	CHECK_EXCEPTION();
4934 	ZEND_VM_NEXT_OPCODE();
4935 }
4936 
ZEND_SUB_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4937 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4938 {
4939 	USE_OPLINE
4940 	zend_free_op free_op2;
4941 
4942 	SAVE_OPLINE();
4943 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
4944 		opline->op1.zv,
4945 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4946 
4947 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4948 	CHECK_EXCEPTION();
4949 	ZEND_VM_NEXT_OPCODE();
4950 }
4951 
ZEND_MUL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4952 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4953 {
4954 	USE_OPLINE
4955 	zend_free_op free_op2;
4956 
4957 	SAVE_OPLINE();
4958 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
4959 		opline->op1.zv,
4960 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4961 
4962 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4963 	CHECK_EXCEPTION();
4964 	ZEND_VM_NEXT_OPCODE();
4965 }
4966 
ZEND_DIV_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4967 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4968 {
4969 	USE_OPLINE
4970 	zend_free_op free_op2;
4971 
4972 	SAVE_OPLINE();
4973 	fast_div_function(&EX_T(opline->result.var).tmp_var,
4974 		opline->op1.zv,
4975 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4976 
4977 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4978 	CHECK_EXCEPTION();
4979 	ZEND_VM_NEXT_OPCODE();
4980 }
4981 
ZEND_MOD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4982 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4983 {
4984 	USE_OPLINE
4985 	zend_free_op free_op2;
4986 
4987 	SAVE_OPLINE();
4988 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
4989 		opline->op1.zv,
4990 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
4991 
4992 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
4993 	CHECK_EXCEPTION();
4994 	ZEND_VM_NEXT_OPCODE();
4995 }
4996 
ZEND_SL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)4997 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
4998 {
4999 	USE_OPLINE
5000 	zend_free_op free_op2;
5001 
5002 	SAVE_OPLINE();
5003 	shift_left_function(&EX_T(opline->result.var).tmp_var,
5004 		opline->op1.zv,
5005 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5006 
5007 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5008 	CHECK_EXCEPTION();
5009 	ZEND_VM_NEXT_OPCODE();
5010 }
5011 
ZEND_SR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5012 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5013 {
5014 	USE_OPLINE
5015 	zend_free_op free_op2;
5016 
5017 	SAVE_OPLINE();
5018 	shift_right_function(&EX_T(opline->result.var).tmp_var,
5019 		opline->op1.zv,
5020 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5021 
5022 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5023 	CHECK_EXCEPTION();
5024 	ZEND_VM_NEXT_OPCODE();
5025 }
5026 
ZEND_CONCAT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5027 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5028 {
5029 	USE_OPLINE
5030 	zend_free_op free_op2;
5031 
5032 	SAVE_OPLINE();
5033 	concat_function(&EX_T(opline->result.var).tmp_var,
5034 		opline->op1.zv,
5035 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5036 
5037 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5038 	CHECK_EXCEPTION();
5039 	ZEND_VM_NEXT_OPCODE();
5040 }
5041 
ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5042 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5043 {
5044 	USE_OPLINE
5045 	zend_free_op free_op2;
5046 
5047 	SAVE_OPLINE();
5048 	is_identical_function(&EX_T(opline->result.var).tmp_var,
5049 		opline->op1.zv,
5050 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5051 
5052 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5053 	CHECK_EXCEPTION();
5054 	ZEND_VM_NEXT_OPCODE();
5055 }
5056 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5057 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5058 {
5059 	USE_OPLINE
5060 	zend_free_op free_op2;
5061 	zval *result = &EX_T(opline->result.var).tmp_var;
5062 
5063 	SAVE_OPLINE();
5064 	is_identical_function(result,
5065 		opline->op1.zv,
5066 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5067 	Z_LVAL_P(result) = !Z_LVAL_P(result);
5068 
5069 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5070 	CHECK_EXCEPTION();
5071 	ZEND_VM_NEXT_OPCODE();
5072 }
5073 
ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5074 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5075 {
5076 	USE_OPLINE
5077 	zend_free_op free_op2;
5078 	zval *result = &EX_T(opline->result.var).tmp_var;
5079 
5080 	SAVE_OPLINE();
5081 	ZVAL_BOOL(result, fast_equal_function(result,
5082 		opline->op1.zv,
5083 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
5084 
5085 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5086 	CHECK_EXCEPTION();
5087 	ZEND_VM_NEXT_OPCODE();
5088 }
5089 
ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5090 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5091 {
5092 	USE_OPLINE
5093 	zend_free_op free_op2;
5094 	zval *result = &EX_T(opline->result.var).tmp_var;
5095 
5096 	SAVE_OPLINE();
5097 	ZVAL_BOOL(result, fast_not_equal_function(result,
5098 		opline->op1.zv,
5099 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
5100 
5101 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5102 	CHECK_EXCEPTION();
5103 	ZEND_VM_NEXT_OPCODE();
5104 }
5105 
ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5106 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5107 {
5108 	USE_OPLINE
5109 	zend_free_op free_op2;
5110 	zval *result = &EX_T(opline->result.var).tmp_var;
5111 
5112 	SAVE_OPLINE();
5113 	ZVAL_BOOL(result, fast_is_smaller_function(result,
5114 		opline->op1.zv,
5115 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
5116 
5117 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5118 	CHECK_EXCEPTION();
5119 	ZEND_VM_NEXT_OPCODE();
5120 }
5121 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5122 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5123 {
5124 	USE_OPLINE
5125 	zend_free_op free_op2;
5126 	zval *result = &EX_T(opline->result.var).tmp_var;
5127 
5128 	SAVE_OPLINE();
5129 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
5130 		opline->op1.zv,
5131 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
5132 
5133 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5134 	CHECK_EXCEPTION();
5135 	ZEND_VM_NEXT_OPCODE();
5136 }
5137 
ZEND_BW_OR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5138 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5139 {
5140 	USE_OPLINE
5141 	zend_free_op free_op2;
5142 
5143 	SAVE_OPLINE();
5144 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
5145 		opline->op1.zv,
5146 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5147 
5148 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5149 	CHECK_EXCEPTION();
5150 	ZEND_VM_NEXT_OPCODE();
5151 }
5152 
ZEND_BW_AND_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5153 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5154 {
5155 	USE_OPLINE
5156 	zend_free_op free_op2;
5157 
5158 	SAVE_OPLINE();
5159 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
5160 		opline->op1.zv,
5161 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5162 
5163 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5164 	CHECK_EXCEPTION();
5165 	ZEND_VM_NEXT_OPCODE();
5166 }
5167 
ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5168 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5169 {
5170 	USE_OPLINE
5171 	zend_free_op free_op2;
5172 
5173 	SAVE_OPLINE();
5174 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
5175 		opline->op1.zv,
5176 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5177 
5178 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5179 	CHECK_EXCEPTION();
5180 	ZEND_VM_NEXT_OPCODE();
5181 }
5182 
ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5183 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5184 {
5185 	USE_OPLINE
5186 	zend_free_op free_op2;
5187 
5188 	SAVE_OPLINE();
5189 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
5190 		opline->op1.zv,
5191 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5192 
5193 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5194 	CHECK_EXCEPTION();
5195 	ZEND_VM_NEXT_OPCODE();
5196 }
5197 
zend_fetch_var_address_helper_SPEC_CONST_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)5198 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
5199 {
5200 	USE_OPLINE
5201 	zend_free_op free_op1;
5202 	zval *varname;
5203 	zval **retval;
5204 	zval tmp_varname;
5205 	HashTable *target_symbol_table;
5206 	ulong hash_value;
5207 
5208 	SAVE_OPLINE();
5209 	varname = opline->op1.zv;
5210 
5211  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
5212 		ZVAL_COPY_VALUE(&tmp_varname, varname);
5213 		zval_copy_ctor(&tmp_varname);
5214 		Z_SET_REFCOUNT(tmp_varname, 1);
5215 		Z_UNSET_ISREF(tmp_varname);
5216 		convert_to_string(&tmp_varname);
5217 		varname = &tmp_varname;
5218 	}
5219 
5220 	if (IS_VAR != IS_UNUSED) {
5221 		zend_class_entry *ce;
5222 
5223 		if (IS_VAR == IS_CONST) {
5224 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5225 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5226 			} else {
5227 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5228 				if (UNEXPECTED(ce == NULL)) {
5229 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
5230 						zval_dtor(&tmp_varname);
5231 					}
5232 
5233 					CHECK_EXCEPTION();
5234 					ZEND_VM_NEXT_OPCODE();
5235 				}
5236 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5237 			}
5238 		} else {
5239 			ce = EX_T(opline->op2.var).class_entry;
5240 		}
5241 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5242 
5243 	} else {
5244 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5245 /*
5246 		if (!target_symbol_table) {
5247 			CHECK_EXCEPTION();
5248 			ZEND_VM_NEXT_OPCODE();
5249 		}
5250 */
5251 		if (IS_CONST == IS_CONST) {
5252 			hash_value = Z_HASH_P(varname);
5253 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
5254 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
5255 		} else {
5256 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
5257 		}
5258 
5259 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
5260 			switch (type) {
5261 				case BP_VAR_R:
5262 				case BP_VAR_UNSET:
5263 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
5264 					/* break missing intentionally */
5265 				case BP_VAR_IS:
5266 					retval = &EG(uninitialized_zval_ptr);
5267 					break;
5268 				case BP_VAR_RW:
5269 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
5270 					/* break missing intentionally */
5271 				case BP_VAR_W:
5272 					Z_ADDREF_P(&EG(uninitialized_zval));
5273 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
5274 					break;
5275 				EMPTY_SWITCH_DEFAULT_CASE()
5276 			}
5277 		}
5278 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
5279 			case ZEND_FETCH_GLOBAL:
5280 				if (IS_CONST != IS_TMP_VAR) {
5281 
5282 				}
5283 				break;
5284 			case ZEND_FETCH_LOCAL:
5285 
5286 				break;
5287 			case ZEND_FETCH_STATIC:
5288 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
5289 				break;
5290 			case ZEND_FETCH_GLOBAL_LOCK:
5291 				if (IS_CONST == IS_VAR && !free_op1.var) {
5292 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
5293 				}
5294 				break;
5295 		}
5296 	}
5297 
5298 
5299 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
5300 		zval_dtor(&tmp_varname);
5301 	}
5302 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
5303 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
5304 	}
5305 	PZVAL_LOCK(*retval);
5306 	switch (type) {
5307 		case BP_VAR_R:
5308 		case BP_VAR_IS:
5309 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
5310 			break;
5311 		case BP_VAR_UNSET: {
5312 			zend_free_op free_res;
5313 
5314 			PZVAL_UNLOCK(*retval, &free_res);
5315 			if (retval != &EG(uninitialized_zval_ptr)) {
5316 				SEPARATE_ZVAL_IF_NOT_REF(retval);
5317 			}
5318 			PZVAL_LOCK(*retval);
5319 			FREE_OP_VAR_PTR(free_res);
5320 		}
5321 		/* break missing intentionally */
5322 		default:
5323 			EX_T(opline->result.var).var.ptr_ptr = retval;
5324 			break;
5325 	}
5326 	CHECK_EXCEPTION();
5327 	ZEND_VM_NEXT_OPCODE();
5328 }
5329 
ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5330 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5331 {
5332 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5333 }
5334 
ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5335 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5336 {
5337 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5338 }
5339 
ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5340 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5341 {
5342 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5343 }
5344 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5345 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5346 {
5347 	USE_OPLINE
5348 
5349 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5350 }
5351 
ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5352 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5353 {
5354 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5355 }
5356 
ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5357 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5358 {
5359 	return zend_fetch_var_address_helper_SPEC_CONST_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5360 }
5361 
ZEND_FETCH_DIM_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5362 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5363 {
5364 	USE_OPLINE
5365 	zend_free_op free_op2;
5366 	zval *container;
5367 
5368 	SAVE_OPLINE();
5369 
5370 	if (IS_CONST == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
5371 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
5372 	}
5373 	container = opline->op1.zv;
5374 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
5375 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5376 
5377 	CHECK_EXCEPTION();
5378 	ZEND_VM_NEXT_OPCODE();
5379 }
5380 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5381 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5382 {
5383 	USE_OPLINE
5384 	zval *function_name;
5385 	zend_class_entry *ce;
5386 	call_slot *call = EX(call_slots) + opline->result.num;
5387 
5388 	SAVE_OPLINE();
5389 
5390 	if (IS_CONST == IS_CONST) {
5391 		/* no function found. try a static method in class */
5392 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
5393 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
5394 		} else {
5395 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
5396 			if (UNEXPECTED(EG(exception) != NULL)) {
5397 				HANDLE_EXCEPTION();
5398 			}
5399 			if (UNEXPECTED(ce == NULL)) {
5400 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
5401 			}
5402 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
5403 		}
5404 		call->called_scope = ce;
5405 	} else {
5406 		ce = EX_T(opline->op1.var).class_entry;
5407 
5408 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
5409 			call->called_scope = EG(called_scope);
5410 		} else {
5411 			call->called_scope = ce;
5412 		}
5413 	}
5414 
5415 	if (IS_CONST == IS_CONST &&
5416 	    IS_VAR == IS_CONST &&
5417 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
5418 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
5419 	} else if (IS_CONST != IS_CONST &&
5420 	           IS_VAR == IS_CONST &&
5421 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
5422 		/* do nothing */
5423 	} else if (IS_VAR != IS_UNUSED) {
5424 		char *function_name_strval = NULL;
5425 		int function_name_strlen = 0;
5426 		zend_free_op free_op2;
5427 
5428 		if (IS_VAR == IS_CONST) {
5429 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
5430 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
5431 		} else {
5432 			function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
5433 
5434 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
5435 				if (UNEXPECTED(EG(exception) != NULL)) {
5436 					HANDLE_EXCEPTION();
5437 				}
5438 				zend_error_noreturn(E_ERROR, "Function name must be a string");
5439 			} else {
5440 				function_name_strval = Z_STRVAL_P(function_name);
5441 				function_name_strlen = Z_STRLEN_P(function_name);
5442  			}
5443 		}
5444 
5445 		if (function_name_strval) {
5446 			if (ce->get_static_method) {
5447 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
5448 			} else {
5449 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
5450 			}
5451 			if (UNEXPECTED(call->fbc == NULL)) {
5452 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
5453 			}
5454 			if (IS_VAR == IS_CONST &&
5455 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
5456 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
5457 				if (IS_CONST == IS_CONST) {
5458 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
5459 				} else {
5460 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
5461 				}
5462 			}
5463 		}
5464 		if (IS_VAR != IS_CONST) {
5465 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5466 		}
5467 	} else {
5468 		if (UNEXPECTED(ce->constructor == NULL)) {
5469 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
5470 		}
5471 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
5472 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
5473 		}
5474 		call->fbc = ce->constructor;
5475 	}
5476 
5477 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
5478 		call->object = NULL;
5479 	} else {
5480 		if (EG(This) &&
5481 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
5482 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
5483 		    /* We are calling method of the other (incompatible) class,
5484 		       but passing $this. This is done for compatibility with php-4. */
5485 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
5486 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
5487 			} else {
5488 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
5489 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
5490 			}
5491 		}
5492 		if ((call->object = EG(This))) {
5493 			Z_ADDREF_P(call->object);
5494 			call->called_scope = Z_OBJCE_P(call->object);
5495 		}
5496 	}
5497 	call->is_ctor_call = 0;
5498 	EX(call) = call;
5499 
5500 	CHECK_EXCEPTION();
5501 	ZEND_VM_NEXT_OPCODE();
5502 }
5503 
ZEND_CASE_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5504 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5505 {
5506 	USE_OPLINE
5507 	zend_free_op free_op2;
5508 
5509 	SAVE_OPLINE();
5510 	if (IS_CONST==IS_VAR) {
5511 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
5512 	}
5513 	is_equal_function(&EX_T(opline->result.var).tmp_var,
5514 				 opline->op1.zv,
5515 				 _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
5516 
5517 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5518 	CHECK_EXCEPTION();
5519 	ZEND_VM_NEXT_OPCODE();
5520 }
5521 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5522 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5523 {
5524 	USE_OPLINE
5525 
5526 	zval *expr_ptr;
5527 
5528 	SAVE_OPLINE();
5529 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5530 		zval **expr_ptr_ptr = NULL;
5531 
5532 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
5533 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
5534 		}
5535 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
5536 		expr_ptr = *expr_ptr_ptr;
5537 		Z_ADDREF_P(expr_ptr);
5538 	} else {
5539 		expr_ptr=opline->op1.zv;
5540 		if (0) { /* temporary variable */
5541 			zval *new_expr;
5542 
5543 			ALLOC_ZVAL(new_expr);
5544 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5545 			expr_ptr = new_expr;
5546 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
5547 			zval *new_expr;
5548 
5549 			ALLOC_ZVAL(new_expr);
5550 			INIT_PZVAL_COPY(new_expr, expr_ptr);
5551 			expr_ptr = new_expr;
5552 			zendi_zval_copy_ctor(*expr_ptr);
5553 		} else {
5554 			Z_ADDREF_P(expr_ptr);
5555 		}
5556 	}
5557 
5558 	if (IS_VAR != IS_UNUSED) {
5559 		zend_free_op free_op2;
5560 		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
5561 		ulong hval;
5562 
5563 		switch (Z_TYPE_P(offset)) {
5564 			case IS_DOUBLE:
5565 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
5566 				goto num_index;
5567 			case IS_LONG:
5568 			case IS_BOOL:
5569 				hval = Z_LVAL_P(offset);
5570 num_index:
5571 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
5572 				break;
5573 			case IS_STRING:
5574 				if (IS_VAR == IS_CONST) {
5575 					hval = Z_HASH_P(offset);
5576 				} else {
5577 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
5578 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
5579 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
5580 					} else {
5581 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
5582 					}
5583 				}
5584 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
5585 				break;
5586 			case IS_NULL:
5587 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
5588 				break;
5589 			default:
5590 				zend_error(E_WARNING, "Illegal offset type");
5591 				zval_ptr_dtor(&expr_ptr);
5592 				/* do nothing */
5593 				break;
5594 		}
5595 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5596 	} else {
5597 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
5598 	}
5599 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
5600 
5601 	} else {
5602 
5603 	}
5604 	CHECK_EXCEPTION();
5605 	ZEND_VM_NEXT_OPCODE();
5606 }
5607 
ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5608 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5609 {
5610 	USE_OPLINE
5611 
5612 	array_init(&EX_T(opline->result.var).tmp_var);
5613 	if (IS_CONST == IS_UNUSED) {
5614 		ZEND_VM_NEXT_OPCODE();
5615 #if 0 || IS_CONST != IS_UNUSED
5616 	} else {
5617 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
5618 #endif
5619 	}
5620 }
5621 
ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5622 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5623 {
5624 	USE_OPLINE
5625 	zval tmp, *varname;
5626 	HashTable *target_symbol_table;
5627 
5628 
5629 	SAVE_OPLINE();
5630 	if (IS_CONST == IS_CV &&
5631 	    IS_VAR == IS_UNUSED &&
5632 	    (opline->extended_value & ZEND_QUICK_SET)) {
5633 		if (EG(active_symbol_table)) {
5634 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5635 
5636 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
5637 			EX_CV(opline->op1.var) = NULL;
5638 		} else if (EX_CV(opline->op1.var)) {
5639 			zval_ptr_dtor(EX_CV(opline->op1.var));
5640 			EX_CV(opline->op1.var) = NULL;
5641 		}
5642 		CHECK_EXCEPTION();
5643 		ZEND_VM_NEXT_OPCODE();
5644 	}
5645 
5646 	varname = opline->op1.zv;
5647 
5648 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5649 		ZVAL_COPY_VALUE(&tmp, varname);
5650 		zval_copy_ctor(&tmp);
5651 		convert_to_string(&tmp);
5652 		varname = &tmp;
5653 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5654 		Z_ADDREF_P(varname);
5655 	}
5656 
5657 	if (IS_VAR != IS_UNUSED) {
5658 		zend_class_entry *ce;
5659 
5660 		if (IS_VAR == IS_CONST) {
5661 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5662 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5663 			} else {
5664 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5665 				if (UNEXPECTED(EG(exception) != NULL)) {
5666 					if (IS_CONST != IS_CONST && varname == &tmp) {
5667 						zval_dtor(&tmp);
5668 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5669 						zval_ptr_dtor(&varname);
5670 					}
5671 
5672 					HANDLE_EXCEPTION();
5673 				}
5674 				if (UNEXPECTED(ce == NULL)) {
5675 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
5676 				}
5677 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5678 			}
5679 		} else {
5680 			ce = EX_T(opline->op2.var).class_entry;
5681 		}
5682 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5683 	} else {
5684 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
5685 
5686 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5687 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
5688 	}
5689 
5690 	if (IS_CONST != IS_CONST && varname == &tmp) {
5691 		zval_dtor(&tmp);
5692 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
5693 		zval_ptr_dtor(&varname);
5694 	}
5695 
5696 	CHECK_EXCEPTION();
5697 	ZEND_VM_NEXT_OPCODE();
5698 }
5699 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5700 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5701 {
5702 	USE_OPLINE
5703 	zval **value;
5704 	zend_bool isset = 1;
5705 
5706 	SAVE_OPLINE();
5707 	if (IS_CONST == IS_CV &&
5708 	    IS_VAR == IS_UNUSED &&
5709 	    (opline->extended_value & ZEND_QUICK_SET)) {
5710 		if (EX_CV(opline->op1.var)) {
5711 			value = EX_CV(opline->op1.var);
5712 		} else if (EG(active_symbol_table)) {
5713 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
5714 
5715 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
5716 				isset = 0;
5717 			}
5718 		} else {
5719 			isset = 0;
5720 		}
5721 	} else {
5722 		HashTable *target_symbol_table;
5723 
5724 		zval tmp, *varname = opline->op1.zv;
5725 
5726 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
5727 			ZVAL_COPY_VALUE(&tmp, varname);
5728 			zval_copy_ctor(&tmp);
5729 			convert_to_string(&tmp);
5730 			varname = &tmp;
5731 		}
5732 
5733 		if (IS_VAR != IS_UNUSED) {
5734 			zend_class_entry *ce;
5735 
5736 			if (IS_VAR == IS_CONST) {
5737 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5738 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
5739 				} else {
5740 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5741 					if (UNEXPECTED(ce == NULL)) {
5742 						CHECK_EXCEPTION();
5743 						ZEND_VM_NEXT_OPCODE();
5744 					}
5745 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
5746 				}
5747 			} else {
5748 				ce = EX_T(opline->op2.var).class_entry;
5749 			}
5750 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5751 			if (!value) {
5752 				isset = 0;
5753 			}
5754 		} else {
5755 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5756 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
5757 				isset = 0;
5758 			}
5759 		}
5760 
5761 		if (IS_CONST != IS_CONST && varname == &tmp) {
5762 			zval_dtor(&tmp);
5763 		}
5764 
5765 	}
5766 
5767 	if (opline->extended_value & ZEND_ISSET) {
5768 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
5769 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5770 		} else {
5771 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5772 		}
5773 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
5774 		if (!isset || !i_zend_is_true(*value)) {
5775 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
5776 		} else {
5777 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
5778 		}
5779 	}
5780 
5781 	CHECK_EXCEPTION();
5782 	ZEND_VM_NEXT_OPCODE();
5783 }
5784 
ZEND_YIELD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)5785 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
5786 {
5787 	USE_OPLINE
5788 
5789 	/* The generator object is stored in return_value_ptr_ptr */
5790 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
5791 
5792 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
5793 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
5794 	}
5795 
5796 	/* Destroy the previously yielded value */
5797 	if (generator->value) {
5798 		zval_ptr_dtor(&generator->value);
5799 	}
5800 
5801 	/* Destroy the previously yielded key */
5802 	if (generator->key) {
5803 		zval_ptr_dtor(&generator->key);
5804 	}
5805 
5806 	/* Set the new yielded value */
5807 	if (IS_CONST != IS_UNUSED) {
5808 
5809 
5810 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
5811 			/* Constants and temporary variables aren't yieldable by reference,
5812 			 * but we still allow them with a notice. */
5813 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
5814 				zval *value, *copy;
5815 
5816 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
5817 
5818 				value = opline->op1.zv;
5819 				ALLOC_ZVAL(copy);
5820 				INIT_PZVAL_COPY(copy, value);
5821 
5822 				/* Temporary variables don't need ctor copying */
5823 				if (!0) {
5824 					zval_copy_ctor(copy);
5825 				}
5826 
5827 				generator->value = copy;
5828 			} else {
5829 				zval **value_ptr = NULL;
5830 
5831 				if (IS_CONST == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
5832 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
5833 				}
5834 
5835 				/* If a function call result is yielded and the function did
5836 				 * not return by reference we throw a notice. */
5837 				if (IS_CONST == IS_VAR && !Z_ISREF_PP(value_ptr)
5838 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
5839 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
5840 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
5841 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
5842 
5843 					Z_ADDREF_PP(value_ptr);
5844 					generator->value = *value_ptr;
5845 				} else {
5846 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
5847 					Z_ADDREF_PP(value_ptr);
5848 					generator->value = *value_ptr;
5849 				}
5850 
5851 			}
5852 		} else {
5853 			zval *value = opline->op1.zv;
5854 
5855 			/* Consts, temporary variables and references need copying */
5856 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
5857 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
5858 			) {
5859 				zval *copy;
5860 
5861 				ALLOC_ZVAL(copy);
5862 				INIT_PZVAL_COPY(copy, value);
5863 
5864 				/* Temporary variables don't need ctor copying */
5865 				if (!0) {
5866 					zval_copy_ctor(copy);
5867 				}
5868 
5869 				generator->value = copy;
5870 			} else {
5871 				Z_ADDREF_P(value);
5872 				generator->value = value;
5873 			}
5874 
5875 		}
5876 	} else {
5877 		/* If no value was specified yield null */
5878 		Z_ADDREF(EG(uninitialized_zval));
5879 		generator->value = &EG(uninitialized_zval);
5880 	}
5881 
5882 	/* Set the new yielded key */
5883 	if (IS_VAR != IS_UNUSED) {
5884 		zend_free_op free_op2;
5885 		zval *key = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
5886 
5887 		/* Consts, temporary variables and references need copying */
5888 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
5889 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
5890 		) {
5891 			zval *copy;
5892 
5893 			ALLOC_ZVAL(copy);
5894 			INIT_PZVAL_COPY(copy, key);
5895 
5896 			/* Temporary variables don't need ctor copying */
5897 			if (!0) {
5898 				zval_copy_ctor(copy);
5899 			}
5900 
5901 			generator->key = copy;
5902 		} else {
5903 			Z_ADDREF_P(key);
5904 			generator->key = key;
5905 		}
5906 
5907 		if (Z_TYPE_P(generator->key) == IS_LONG
5908 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
5909 		) {
5910 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
5911 		}
5912 
5913 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
5914 	} else {
5915 		/* If no key was specified we use auto-increment keys */
5916 		generator->largest_used_integer_key++;
5917 
5918 		ALLOC_INIT_ZVAL(generator->key);
5919 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
5920 	}
5921 
5922 	if (RETURN_VALUE_USED(opline)) {
5923 		/* If the return value of yield is used set the send
5924 		 * target and initialize it to NULL */
5925 		generator->send_target = &EX_T(opline->result.var).var.ptr;
5926 		Z_ADDREF(EG(uninitialized_zval));
5927 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
5928 	} else {
5929 		generator->send_target = NULL;
5930 	}
5931 
5932 	/* We increment to the next op, so we are at the correct position when the
5933 	 * generator is resumed. */
5934 	ZEND_VM_INC_OPCODE();
5935 
5936 	/* The GOTO VM uses a local opline variable. We need to set the opline
5937 	 * variable in execute_data so we don't resume at an old position. */
5938 	SAVE_OPLINE();
5939 
5940 	ZEND_VM_RETURN();
5941 }
5942 
zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)5943 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
5944 {
5945 	USE_OPLINE
5946 	zend_free_op free_op1;
5947 	zval *varname;
5948 	zval **retval;
5949 	zval tmp_varname;
5950 	HashTable *target_symbol_table;
5951 	ulong hash_value;
5952 
5953 	SAVE_OPLINE();
5954 	varname = opline->op1.zv;
5955 
5956  	if (IS_CONST != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
5957 		ZVAL_COPY_VALUE(&tmp_varname, varname);
5958 		zval_copy_ctor(&tmp_varname);
5959 		Z_SET_REFCOUNT(tmp_varname, 1);
5960 		Z_UNSET_ISREF(tmp_varname);
5961 		convert_to_string(&tmp_varname);
5962 		varname = &tmp_varname;
5963 	}
5964 
5965 	if (IS_UNUSED != IS_UNUSED) {
5966 		zend_class_entry *ce;
5967 
5968 		if (IS_UNUSED == IS_CONST) {
5969 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
5970 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
5971 			} else {
5972 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
5973 				if (UNEXPECTED(ce == NULL)) {
5974 					if (IS_CONST != IS_CONST && varname == &tmp_varname) {
5975 						zval_dtor(&tmp_varname);
5976 					}
5977 
5978 					CHECK_EXCEPTION();
5979 					ZEND_VM_NEXT_OPCODE();
5980 				}
5981 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
5982 			}
5983 		} else {
5984 			ce = EX_T(opline->op2.var).class_entry;
5985 		}
5986 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
5987 
5988 	} else {
5989 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
5990 /*
5991 		if (!target_symbol_table) {
5992 			CHECK_EXCEPTION();
5993 			ZEND_VM_NEXT_OPCODE();
5994 		}
5995 */
5996 		if (IS_CONST == IS_CONST) {
5997 			hash_value = Z_HASH_P(varname);
5998 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
5999 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
6000 		} else {
6001 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
6002 		}
6003 
6004 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
6005 			switch (type) {
6006 				case BP_VAR_R:
6007 				case BP_VAR_UNSET:
6008 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
6009 					/* break missing intentionally */
6010 				case BP_VAR_IS:
6011 					retval = &EG(uninitialized_zval_ptr);
6012 					break;
6013 				case BP_VAR_RW:
6014 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
6015 					/* break missing intentionally */
6016 				case BP_VAR_W:
6017 					Z_ADDREF_P(&EG(uninitialized_zval));
6018 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
6019 					break;
6020 				EMPTY_SWITCH_DEFAULT_CASE()
6021 			}
6022 		}
6023 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
6024 			case ZEND_FETCH_GLOBAL:
6025 				if (IS_CONST != IS_TMP_VAR) {
6026 
6027 				}
6028 				break;
6029 			case ZEND_FETCH_LOCAL:
6030 
6031 				break;
6032 			case ZEND_FETCH_STATIC:
6033 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
6034 				break;
6035 			case ZEND_FETCH_GLOBAL_LOCK:
6036 				if (IS_CONST == IS_VAR && !free_op1.var) {
6037 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
6038 				}
6039 				break;
6040 		}
6041 	}
6042 
6043 
6044 	if (IS_CONST != IS_CONST && varname == &tmp_varname) {
6045 		zval_dtor(&tmp_varname);
6046 	}
6047 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
6048 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
6049 	}
6050 	PZVAL_LOCK(*retval);
6051 	switch (type) {
6052 		case BP_VAR_R:
6053 		case BP_VAR_IS:
6054 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
6055 			break;
6056 		case BP_VAR_UNSET: {
6057 			zend_free_op free_res;
6058 
6059 			PZVAL_UNLOCK(*retval, &free_res);
6060 			if (retval != &EG(uninitialized_zval_ptr)) {
6061 				SEPARATE_ZVAL_IF_NOT_REF(retval);
6062 			}
6063 			PZVAL_LOCK(*retval);
6064 			FREE_OP_VAR_PTR(free_res);
6065 		}
6066 		/* break missing intentionally */
6067 		default:
6068 			EX_T(opline->result.var).var.ptr_ptr = retval;
6069 			break;
6070 	}
6071 	CHECK_EXCEPTION();
6072 	ZEND_VM_NEXT_OPCODE();
6073 }
6074 
ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6075 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6076 {
6077 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6078 }
6079 
ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6080 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6081 {
6082 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6083 }
6084 
ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6085 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6086 {
6087 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6088 }
6089 
ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6090 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6091 {
6092 	USE_OPLINE
6093 
6094 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6095 }
6096 
ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6097 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6098 {
6099 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6100 }
6101 
ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6102 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6103 {
6104 	return zend_fetch_var_address_helper_SPEC_CONST_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6105 }
6106 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6107 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6108 {
6109 	USE_OPLINE
6110 	zval *function_name;
6111 	zend_class_entry *ce;
6112 	call_slot *call = EX(call_slots) + opline->result.num;
6113 
6114 	SAVE_OPLINE();
6115 
6116 	if (IS_CONST == IS_CONST) {
6117 		/* no function found. try a static method in class */
6118 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
6119 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
6120 		} else {
6121 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
6122 			if (UNEXPECTED(EG(exception) != NULL)) {
6123 				HANDLE_EXCEPTION();
6124 			}
6125 			if (UNEXPECTED(ce == NULL)) {
6126 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
6127 			}
6128 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
6129 		}
6130 		call->called_scope = ce;
6131 	} else {
6132 		ce = EX_T(opline->op1.var).class_entry;
6133 
6134 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
6135 			call->called_scope = EG(called_scope);
6136 		} else {
6137 			call->called_scope = ce;
6138 		}
6139 	}
6140 
6141 	if (IS_CONST == IS_CONST &&
6142 	    IS_UNUSED == IS_CONST &&
6143 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
6144 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
6145 	} else if (IS_CONST != IS_CONST &&
6146 	           IS_UNUSED == IS_CONST &&
6147 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
6148 		/* do nothing */
6149 	} else if (IS_UNUSED != IS_UNUSED) {
6150 		char *function_name_strval = NULL;
6151 		int function_name_strlen = 0;
6152 
6153 
6154 		if (IS_UNUSED == IS_CONST) {
6155 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
6156 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
6157 		} else {
6158 			function_name = NULL;
6159 
6160 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
6161 				if (UNEXPECTED(EG(exception) != NULL)) {
6162 					HANDLE_EXCEPTION();
6163 				}
6164 				zend_error_noreturn(E_ERROR, "Function name must be a string");
6165 			} else {
6166 				function_name_strval = Z_STRVAL_P(function_name);
6167 				function_name_strlen = Z_STRLEN_P(function_name);
6168  			}
6169 		}
6170 
6171 		if (function_name_strval) {
6172 			if (ce->get_static_method) {
6173 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
6174 			} else {
6175 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_UNUSED == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
6176 			}
6177 			if (UNEXPECTED(call->fbc == NULL)) {
6178 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
6179 			}
6180 			if (IS_UNUSED == IS_CONST &&
6181 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
6182 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
6183 				if (IS_CONST == IS_CONST) {
6184 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
6185 				} else {
6186 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
6187 				}
6188 			}
6189 		}
6190 		if (IS_UNUSED != IS_CONST) {
6191 
6192 		}
6193 	} else {
6194 		if (UNEXPECTED(ce->constructor == NULL)) {
6195 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
6196 		}
6197 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
6198 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
6199 		}
6200 		call->fbc = ce->constructor;
6201 	}
6202 
6203 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
6204 		call->object = NULL;
6205 	} else {
6206 		if (EG(This) &&
6207 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
6208 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
6209 		    /* We are calling method of the other (incompatible) class,
6210 		       but passing $this. This is done for compatibility with php-4. */
6211 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
6212 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
6213 			} else {
6214 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
6215 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
6216 			}
6217 		}
6218 		if ((call->object = EG(This))) {
6219 			Z_ADDREF_P(call->object);
6220 			call->called_scope = Z_OBJCE_P(call->object);
6221 		}
6222 	}
6223 	call->is_ctor_call = 0;
6224 	EX(call) = call;
6225 
6226 	CHECK_EXCEPTION();
6227 	ZEND_VM_NEXT_OPCODE();
6228 }
6229 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6230 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6231 {
6232 	USE_OPLINE
6233 
6234 	zval *expr_ptr;
6235 
6236 	SAVE_OPLINE();
6237 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
6238 		zval **expr_ptr_ptr = NULL;
6239 
6240 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
6241 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
6242 		}
6243 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
6244 		expr_ptr = *expr_ptr_ptr;
6245 		Z_ADDREF_P(expr_ptr);
6246 	} else {
6247 		expr_ptr=opline->op1.zv;
6248 		if (0) { /* temporary variable */
6249 			zval *new_expr;
6250 
6251 			ALLOC_ZVAL(new_expr);
6252 			INIT_PZVAL_COPY(new_expr, expr_ptr);
6253 			expr_ptr = new_expr;
6254 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
6255 			zval *new_expr;
6256 
6257 			ALLOC_ZVAL(new_expr);
6258 			INIT_PZVAL_COPY(new_expr, expr_ptr);
6259 			expr_ptr = new_expr;
6260 			zendi_zval_copy_ctor(*expr_ptr);
6261 		} else {
6262 			Z_ADDREF_P(expr_ptr);
6263 		}
6264 	}
6265 
6266 	if (IS_UNUSED != IS_UNUSED) {
6267 
6268 		zval *offset = NULL;
6269 		ulong hval;
6270 
6271 		switch (Z_TYPE_P(offset)) {
6272 			case IS_DOUBLE:
6273 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
6274 				goto num_index;
6275 			case IS_LONG:
6276 			case IS_BOOL:
6277 				hval = Z_LVAL_P(offset);
6278 num_index:
6279 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
6280 				break;
6281 			case IS_STRING:
6282 				if (IS_UNUSED == IS_CONST) {
6283 					hval = Z_HASH_P(offset);
6284 				} else {
6285 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
6286 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
6287 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
6288 					} else {
6289 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
6290 					}
6291 				}
6292 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
6293 				break;
6294 			case IS_NULL:
6295 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
6296 				break;
6297 			default:
6298 				zend_error(E_WARNING, "Illegal offset type");
6299 				zval_ptr_dtor(&expr_ptr);
6300 				/* do nothing */
6301 				break;
6302 		}
6303 
6304 	} else {
6305 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
6306 	}
6307 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
6308 
6309 	} else {
6310 
6311 	}
6312 	CHECK_EXCEPTION();
6313 	ZEND_VM_NEXT_OPCODE();
6314 }
6315 
ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6316 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6317 {
6318 	USE_OPLINE
6319 
6320 	array_init(&EX_T(opline->result.var).tmp_var);
6321 	if (IS_CONST == IS_UNUSED) {
6322 		ZEND_VM_NEXT_OPCODE();
6323 #if 0 || IS_CONST != IS_UNUSED
6324 	} else {
6325 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
6326 #endif
6327 	}
6328 }
6329 
ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6330 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6331 {
6332 	USE_OPLINE
6333 	zval tmp, *varname;
6334 	HashTable *target_symbol_table;
6335 
6336 
6337 	SAVE_OPLINE();
6338 	if (IS_CONST == IS_CV &&
6339 	    IS_UNUSED == IS_UNUSED &&
6340 	    (opline->extended_value & ZEND_QUICK_SET)) {
6341 		if (EG(active_symbol_table)) {
6342 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
6343 
6344 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
6345 			EX_CV(opline->op1.var) = NULL;
6346 		} else if (EX_CV(opline->op1.var)) {
6347 			zval_ptr_dtor(EX_CV(opline->op1.var));
6348 			EX_CV(opline->op1.var) = NULL;
6349 		}
6350 		CHECK_EXCEPTION();
6351 		ZEND_VM_NEXT_OPCODE();
6352 	}
6353 
6354 	varname = opline->op1.zv;
6355 
6356 	if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
6357 		ZVAL_COPY_VALUE(&tmp, varname);
6358 		zval_copy_ctor(&tmp);
6359 		convert_to_string(&tmp);
6360 		varname = &tmp;
6361 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
6362 		Z_ADDREF_P(varname);
6363 	}
6364 
6365 	if (IS_UNUSED != IS_UNUSED) {
6366 		zend_class_entry *ce;
6367 
6368 		if (IS_UNUSED == IS_CONST) {
6369 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
6370 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
6371 			} else {
6372 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
6373 				if (UNEXPECTED(EG(exception) != NULL)) {
6374 					if (IS_CONST != IS_CONST && varname == &tmp) {
6375 						zval_dtor(&tmp);
6376 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
6377 						zval_ptr_dtor(&varname);
6378 					}
6379 
6380 					HANDLE_EXCEPTION();
6381 				}
6382 				if (UNEXPECTED(ce == NULL)) {
6383 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
6384 				}
6385 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
6386 			}
6387 		} else {
6388 			ce = EX_T(opline->op2.var).class_entry;
6389 		}
6390 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
6391 	} else {
6392 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
6393 
6394 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
6395 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
6396 	}
6397 
6398 	if (IS_CONST != IS_CONST && varname == &tmp) {
6399 		zval_dtor(&tmp);
6400 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
6401 		zval_ptr_dtor(&varname);
6402 	}
6403 
6404 	CHECK_EXCEPTION();
6405 	ZEND_VM_NEXT_OPCODE();
6406 }
6407 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6408 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6409 {
6410 	USE_OPLINE
6411 	zval **value;
6412 	zend_bool isset = 1;
6413 
6414 	SAVE_OPLINE();
6415 	if (IS_CONST == IS_CV &&
6416 	    IS_UNUSED == IS_UNUSED &&
6417 	    (opline->extended_value & ZEND_QUICK_SET)) {
6418 		if (EX_CV(opline->op1.var)) {
6419 			value = EX_CV(opline->op1.var);
6420 		} else if (EG(active_symbol_table)) {
6421 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
6422 
6423 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
6424 				isset = 0;
6425 			}
6426 		} else {
6427 			isset = 0;
6428 		}
6429 	} else {
6430 		HashTable *target_symbol_table;
6431 
6432 		zval tmp, *varname = opline->op1.zv;
6433 
6434 		if (IS_CONST != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
6435 			ZVAL_COPY_VALUE(&tmp, varname);
6436 			zval_copy_ctor(&tmp);
6437 			convert_to_string(&tmp);
6438 			varname = &tmp;
6439 		}
6440 
6441 		if (IS_UNUSED != IS_UNUSED) {
6442 			zend_class_entry *ce;
6443 
6444 			if (IS_UNUSED == IS_CONST) {
6445 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
6446 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
6447 				} else {
6448 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
6449 					if (UNEXPECTED(ce == NULL)) {
6450 						CHECK_EXCEPTION();
6451 						ZEND_VM_NEXT_OPCODE();
6452 					}
6453 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
6454 				}
6455 			} else {
6456 				ce = EX_T(opline->op2.var).class_entry;
6457 			}
6458 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CONST == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
6459 			if (!value) {
6460 				isset = 0;
6461 			}
6462 		} else {
6463 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
6464 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
6465 				isset = 0;
6466 			}
6467 		}
6468 
6469 		if (IS_CONST != IS_CONST && varname == &tmp) {
6470 			zval_dtor(&tmp);
6471 		}
6472 
6473 	}
6474 
6475 	if (opline->extended_value & ZEND_ISSET) {
6476 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
6477 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
6478 		} else {
6479 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
6480 		}
6481 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
6482 		if (!isset || !i_zend_is_true(*value)) {
6483 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
6484 		} else {
6485 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
6486 		}
6487 	}
6488 
6489 	CHECK_EXCEPTION();
6490 	ZEND_VM_NEXT_OPCODE();
6491 }
6492 
ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6493 static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6494 {
6495 	USE_OPLINE
6496 	zend_function *op_array;
6497 
6498 	SAVE_OPLINE();
6499 
6500 	if (UNEXPECTED(zend_hash_quick_find(EG(function_table), Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), Z_HASH_P(opline->op1.zv), (void *) &op_array) == FAILURE) ||
6501 	    UNEXPECTED(op_array->type != ZEND_USER_FUNCTION)) {
6502 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
6503 	}
6504 
6505 	if (UNEXPECTED((op_array->common.fn_flags & ZEND_ACC_STATIC) ||
6506 			(EX(prev_execute_data) &&
6507 			 EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC))) {
6508 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
6509 	} else {
6510 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
6511 	}
6512 
6513 	CHECK_EXCEPTION();
6514 	ZEND_VM_NEXT_OPCODE();
6515 }
6516 
ZEND_YIELD_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6517 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6518 {
6519 	USE_OPLINE
6520 
6521 	/* The generator object is stored in return_value_ptr_ptr */
6522 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
6523 
6524 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
6525 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
6526 	}
6527 
6528 	/* Destroy the previously yielded value */
6529 	if (generator->value) {
6530 		zval_ptr_dtor(&generator->value);
6531 	}
6532 
6533 	/* Destroy the previously yielded key */
6534 	if (generator->key) {
6535 		zval_ptr_dtor(&generator->key);
6536 	}
6537 
6538 	/* Set the new yielded value */
6539 	if (IS_CONST != IS_UNUSED) {
6540 
6541 
6542 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
6543 			/* Constants and temporary variables aren't yieldable by reference,
6544 			 * but we still allow them with a notice. */
6545 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
6546 				zval *value, *copy;
6547 
6548 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
6549 
6550 				value = opline->op1.zv;
6551 				ALLOC_ZVAL(copy);
6552 				INIT_PZVAL_COPY(copy, value);
6553 
6554 				/* Temporary variables don't need ctor copying */
6555 				if (!0) {
6556 					zval_copy_ctor(copy);
6557 				}
6558 
6559 				generator->value = copy;
6560 			} else {
6561 				zval **value_ptr = NULL;
6562 
6563 				if (IS_CONST == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
6564 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
6565 				}
6566 
6567 				/* If a function call result is yielded and the function did
6568 				 * not return by reference we throw a notice. */
6569 				if (IS_CONST == IS_VAR && !Z_ISREF_PP(value_ptr)
6570 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
6571 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
6572 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
6573 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
6574 
6575 					Z_ADDREF_PP(value_ptr);
6576 					generator->value = *value_ptr;
6577 				} else {
6578 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
6579 					Z_ADDREF_PP(value_ptr);
6580 					generator->value = *value_ptr;
6581 				}
6582 
6583 			}
6584 		} else {
6585 			zval *value = opline->op1.zv;
6586 
6587 			/* Consts, temporary variables and references need copying */
6588 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
6589 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
6590 			) {
6591 				zval *copy;
6592 
6593 				ALLOC_ZVAL(copy);
6594 				INIT_PZVAL_COPY(copy, value);
6595 
6596 				/* Temporary variables don't need ctor copying */
6597 				if (!0) {
6598 					zval_copy_ctor(copy);
6599 				}
6600 
6601 				generator->value = copy;
6602 			} else {
6603 				Z_ADDREF_P(value);
6604 				generator->value = value;
6605 			}
6606 
6607 		}
6608 	} else {
6609 		/* If no value was specified yield null */
6610 		Z_ADDREF(EG(uninitialized_zval));
6611 		generator->value = &EG(uninitialized_zval);
6612 	}
6613 
6614 	/* Set the new yielded key */
6615 	if (IS_UNUSED != IS_UNUSED) {
6616 
6617 		zval *key = NULL;
6618 
6619 		/* Consts, temporary variables and references need copying */
6620 		if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
6621 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
6622 		) {
6623 			zval *copy;
6624 
6625 			ALLOC_ZVAL(copy);
6626 			INIT_PZVAL_COPY(copy, key);
6627 
6628 			/* Temporary variables don't need ctor copying */
6629 			if (!0) {
6630 				zval_copy_ctor(copy);
6631 			}
6632 
6633 			generator->key = copy;
6634 		} else {
6635 			Z_ADDREF_P(key);
6636 			generator->key = key;
6637 		}
6638 
6639 		if (Z_TYPE_P(generator->key) == IS_LONG
6640 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
6641 		) {
6642 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
6643 		}
6644 
6645 	} else {
6646 		/* If no key was specified we use auto-increment keys */
6647 		generator->largest_used_integer_key++;
6648 
6649 		ALLOC_INIT_ZVAL(generator->key);
6650 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
6651 	}
6652 
6653 	if (RETURN_VALUE_USED(opline)) {
6654 		/* If the return value of yield is used set the send
6655 		 * target and initialize it to NULL */
6656 		generator->send_target = &EX_T(opline->result.var).var.ptr;
6657 		Z_ADDREF(EG(uninitialized_zval));
6658 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
6659 	} else {
6660 		generator->send_target = NULL;
6661 	}
6662 
6663 	/* We increment to the next op, so we are at the correct position when the
6664 	 * generator is resumed. */
6665 	ZEND_VM_INC_OPCODE();
6666 
6667 	/* The GOTO VM uses a local opline variable. We need to set the opline
6668 	 * variable in execute_data so we don't resume at an old position. */
6669 	SAVE_OPLINE();
6670 
6671 	ZEND_VM_RETURN();
6672 }
6673 
ZEND_ADD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6674 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6675 {
6676 	USE_OPLINE
6677 
6678 
6679 	SAVE_OPLINE();
6680 	fast_add_function(&EX_T(opline->result.var).tmp_var,
6681 		opline->op1.zv,
6682 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6683 
6684 
6685 	CHECK_EXCEPTION();
6686 	ZEND_VM_NEXT_OPCODE();
6687 }
6688 
ZEND_SUB_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6689 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6690 {
6691 	USE_OPLINE
6692 
6693 
6694 	SAVE_OPLINE();
6695 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
6696 		opline->op1.zv,
6697 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6698 
6699 
6700 	CHECK_EXCEPTION();
6701 	ZEND_VM_NEXT_OPCODE();
6702 }
6703 
ZEND_MUL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6704 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6705 {
6706 	USE_OPLINE
6707 
6708 
6709 	SAVE_OPLINE();
6710 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
6711 		opline->op1.zv,
6712 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6713 
6714 
6715 	CHECK_EXCEPTION();
6716 	ZEND_VM_NEXT_OPCODE();
6717 }
6718 
ZEND_DIV_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6719 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6720 {
6721 	USE_OPLINE
6722 
6723 
6724 	SAVE_OPLINE();
6725 	fast_div_function(&EX_T(opline->result.var).tmp_var,
6726 		opline->op1.zv,
6727 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6728 
6729 
6730 	CHECK_EXCEPTION();
6731 	ZEND_VM_NEXT_OPCODE();
6732 }
6733 
ZEND_MOD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6734 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6735 {
6736 	USE_OPLINE
6737 
6738 
6739 	SAVE_OPLINE();
6740 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
6741 		opline->op1.zv,
6742 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6743 
6744 
6745 	CHECK_EXCEPTION();
6746 	ZEND_VM_NEXT_OPCODE();
6747 }
6748 
ZEND_SL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6749 static int ZEND_FASTCALL  ZEND_SL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6750 {
6751 	USE_OPLINE
6752 
6753 
6754 	SAVE_OPLINE();
6755 	shift_left_function(&EX_T(opline->result.var).tmp_var,
6756 		opline->op1.zv,
6757 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6758 
6759 
6760 	CHECK_EXCEPTION();
6761 	ZEND_VM_NEXT_OPCODE();
6762 }
6763 
ZEND_SR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6764 static int ZEND_FASTCALL  ZEND_SR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6765 {
6766 	USE_OPLINE
6767 
6768 
6769 	SAVE_OPLINE();
6770 	shift_right_function(&EX_T(opline->result.var).tmp_var,
6771 		opline->op1.zv,
6772 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6773 
6774 
6775 	CHECK_EXCEPTION();
6776 	ZEND_VM_NEXT_OPCODE();
6777 }
6778 
ZEND_CONCAT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6779 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6780 {
6781 	USE_OPLINE
6782 
6783 
6784 	SAVE_OPLINE();
6785 	concat_function(&EX_T(opline->result.var).tmp_var,
6786 		opline->op1.zv,
6787 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6788 
6789 
6790 	CHECK_EXCEPTION();
6791 	ZEND_VM_NEXT_OPCODE();
6792 }
6793 
ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6794 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6795 {
6796 	USE_OPLINE
6797 
6798 
6799 	SAVE_OPLINE();
6800 	is_identical_function(&EX_T(opline->result.var).tmp_var,
6801 		opline->op1.zv,
6802 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6803 
6804 
6805 	CHECK_EXCEPTION();
6806 	ZEND_VM_NEXT_OPCODE();
6807 }
6808 
ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6809 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6810 {
6811 	USE_OPLINE
6812 
6813 	zval *result = &EX_T(opline->result.var).tmp_var;
6814 
6815 	SAVE_OPLINE();
6816 	is_identical_function(result,
6817 		opline->op1.zv,
6818 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6819 	Z_LVAL_P(result) = !Z_LVAL_P(result);
6820 
6821 
6822 	CHECK_EXCEPTION();
6823 	ZEND_VM_NEXT_OPCODE();
6824 }
6825 
ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6826 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6827 {
6828 	USE_OPLINE
6829 
6830 	zval *result = &EX_T(opline->result.var).tmp_var;
6831 
6832 	SAVE_OPLINE();
6833 	ZVAL_BOOL(result, fast_equal_function(result,
6834 		opline->op1.zv,
6835 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
6836 
6837 
6838 	CHECK_EXCEPTION();
6839 	ZEND_VM_NEXT_OPCODE();
6840 }
6841 
ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6842 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6843 {
6844 	USE_OPLINE
6845 
6846 	zval *result = &EX_T(opline->result.var).tmp_var;
6847 
6848 	SAVE_OPLINE();
6849 	ZVAL_BOOL(result, fast_not_equal_function(result,
6850 		opline->op1.zv,
6851 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
6852 
6853 
6854 	CHECK_EXCEPTION();
6855 	ZEND_VM_NEXT_OPCODE();
6856 }
6857 
ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6858 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6859 {
6860 	USE_OPLINE
6861 
6862 	zval *result = &EX_T(opline->result.var).tmp_var;
6863 
6864 	SAVE_OPLINE();
6865 	ZVAL_BOOL(result, fast_is_smaller_function(result,
6866 		opline->op1.zv,
6867 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
6868 
6869 
6870 	CHECK_EXCEPTION();
6871 	ZEND_VM_NEXT_OPCODE();
6872 }
6873 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6874 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6875 {
6876 	USE_OPLINE
6877 
6878 	zval *result = &EX_T(opline->result.var).tmp_var;
6879 
6880 	SAVE_OPLINE();
6881 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
6882 		opline->op1.zv,
6883 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
6884 
6885 
6886 	CHECK_EXCEPTION();
6887 	ZEND_VM_NEXT_OPCODE();
6888 }
6889 
ZEND_BW_OR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6890 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6891 {
6892 	USE_OPLINE
6893 
6894 
6895 	SAVE_OPLINE();
6896 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
6897 		opline->op1.zv,
6898 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6899 
6900 
6901 	CHECK_EXCEPTION();
6902 	ZEND_VM_NEXT_OPCODE();
6903 }
6904 
ZEND_BW_AND_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6905 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6906 {
6907 	USE_OPLINE
6908 
6909 
6910 	SAVE_OPLINE();
6911 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
6912 		opline->op1.zv,
6913 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6914 
6915 
6916 	CHECK_EXCEPTION();
6917 	ZEND_VM_NEXT_OPCODE();
6918 }
6919 
ZEND_BW_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6920 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6921 {
6922 	USE_OPLINE
6923 
6924 
6925 	SAVE_OPLINE();
6926 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
6927 		opline->op1.zv,
6928 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6929 
6930 
6931 	CHECK_EXCEPTION();
6932 	ZEND_VM_NEXT_OPCODE();
6933 }
6934 
ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6935 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6936 {
6937 	USE_OPLINE
6938 
6939 
6940 	SAVE_OPLINE();
6941 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
6942 		opline->op1.zv,
6943 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
6944 
6945 
6946 	CHECK_EXCEPTION();
6947 	ZEND_VM_NEXT_OPCODE();
6948 }
6949 
ZEND_FETCH_DIM_R_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6950 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6951 {
6952 	USE_OPLINE
6953 
6954 	zval *container;
6955 
6956 	SAVE_OPLINE();
6957 
6958 	if (IS_CONST == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
6959 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
6960 	}
6961 	container = opline->op1.zv;
6962 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
6963 
6964 
6965 	CHECK_EXCEPTION();
6966 	ZEND_VM_NEXT_OPCODE();
6967 }
6968 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)6969 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
6970 {
6971 	USE_OPLINE
6972 	zval *function_name;
6973 	zend_class_entry *ce;
6974 	call_slot *call = EX(call_slots) + opline->result.num;
6975 
6976 	SAVE_OPLINE();
6977 
6978 	if (IS_CONST == IS_CONST) {
6979 		/* no function found. try a static method in class */
6980 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
6981 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
6982 		} else {
6983 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
6984 			if (UNEXPECTED(EG(exception) != NULL)) {
6985 				HANDLE_EXCEPTION();
6986 			}
6987 			if (UNEXPECTED(ce == NULL)) {
6988 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
6989 			}
6990 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
6991 		}
6992 		call->called_scope = ce;
6993 	} else {
6994 		ce = EX_T(opline->op1.var).class_entry;
6995 
6996 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
6997 			call->called_scope = EG(called_scope);
6998 		} else {
6999 			call->called_scope = ce;
7000 		}
7001 	}
7002 
7003 	if (IS_CONST == IS_CONST &&
7004 	    IS_CV == IS_CONST &&
7005 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
7006 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
7007 	} else if (IS_CONST != IS_CONST &&
7008 	           IS_CV == IS_CONST &&
7009 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
7010 		/* do nothing */
7011 	} else if (IS_CV != IS_UNUSED) {
7012 		char *function_name_strval = NULL;
7013 		int function_name_strlen = 0;
7014 
7015 
7016 		if (IS_CV == IS_CONST) {
7017 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
7018 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
7019 		} else {
7020 			function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
7021 
7022 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
7023 				if (UNEXPECTED(EG(exception) != NULL)) {
7024 					HANDLE_EXCEPTION();
7025 				}
7026 				zend_error_noreturn(E_ERROR, "Function name must be a string");
7027 			} else {
7028 				function_name_strval = Z_STRVAL_P(function_name);
7029 				function_name_strlen = Z_STRLEN_P(function_name);
7030  			}
7031 		}
7032 
7033 		if (function_name_strval) {
7034 			if (ce->get_static_method) {
7035 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
7036 			} else {
7037 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
7038 			}
7039 			if (UNEXPECTED(call->fbc == NULL)) {
7040 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
7041 			}
7042 			if (IS_CV == IS_CONST &&
7043 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
7044 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
7045 				if (IS_CONST == IS_CONST) {
7046 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
7047 				} else {
7048 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
7049 				}
7050 			}
7051 		}
7052 		if (IS_CV != IS_CONST) {
7053 
7054 		}
7055 	} else {
7056 		if (UNEXPECTED(ce->constructor == NULL)) {
7057 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
7058 		}
7059 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
7060 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
7061 		}
7062 		call->fbc = ce->constructor;
7063 	}
7064 
7065 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
7066 		call->object = NULL;
7067 	} else {
7068 		if (EG(This) &&
7069 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
7070 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
7071 		    /* We are calling method of the other (incompatible) class,
7072 		       but passing $this. This is done for compatibility with php-4. */
7073 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
7074 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
7075 			} else {
7076 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
7077 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
7078 			}
7079 		}
7080 		if ((call->object = EG(This))) {
7081 			Z_ADDREF_P(call->object);
7082 			call->called_scope = Z_OBJCE_P(call->object);
7083 		}
7084 	}
7085 	call->is_ctor_call = 0;
7086 	EX(call) = call;
7087 
7088 	CHECK_EXCEPTION();
7089 	ZEND_VM_NEXT_OPCODE();
7090 }
7091 
ZEND_CATCH_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7092 static int ZEND_FASTCALL  ZEND_CATCH_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7093 {
7094 	USE_OPLINE
7095 	zend_class_entry *ce, *catch_ce;
7096 	zval *exception;
7097 
7098 	SAVE_OPLINE();
7099 	/* Check whether an exception has been thrown, if not, jump over code */
7100 	zend_exception_restore(TSRMLS_C);
7101 	if (EG(exception) == NULL) {
7102 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
7103 		ZEND_VM_CONTINUE(); /* CHECK_ME */
7104 	}
7105 	if (CACHED_PTR(opline->op1.literal->cache_slot)) {
7106 		catch_ce = CACHED_PTR(opline->op1.literal->cache_slot);
7107 	} else {
7108 		catch_ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, ZEND_FETCH_CLASS_NO_AUTOLOAD TSRMLS_CC);
7109 
7110 		CACHE_PTR(opline->op1.literal->cache_slot, catch_ce);
7111 	}
7112 	ce = Z_OBJCE_P(EG(exception));
7113 
7114 #ifdef HAVE_DTRACE
7115 	if (DTRACE_EXCEPTION_CAUGHT_ENABLED()) {
7116 		DTRACE_EXCEPTION_CAUGHT((char *)ce->name);
7117 	}
7118 #endif /* HAVE_DTRACE */
7119 
7120 	if (ce != catch_ce) {
7121 		if (!instanceof_function(ce, catch_ce TSRMLS_CC)) {
7122 			if (opline->result.num) {
7123 				zend_throw_exception_internal(NULL TSRMLS_CC);
7124 				HANDLE_EXCEPTION();
7125 			}
7126 			ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
7127 			ZEND_VM_CONTINUE(); /* CHECK_ME */
7128 		}
7129 	}
7130 
7131 	exception = EG(exception);
7132 	if (!EG(active_symbol_table)) {
7133 		if (EX_CV(opline->op2.var)) {
7134 			zval_ptr_dtor(EX_CV(opline->op2.var));
7135 		}
7136 		EX_CV(opline->op2.var) = (zval**)EX_CV_NUM(execute_data, EX(op_array)->last_var + opline->op2.var);
7137 		*EX_CV(opline->op2.var) = EG(exception);
7138 	} else {
7139 		zend_compiled_variable *cv = &CV_DEF_OF(opline->op2.var);
7140 		zend_hash_quick_update(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value,
7141 		    &EG(exception), sizeof(zval *), (void**)&EX_CV(opline->op2.var));
7142 	}
7143 	if (UNEXPECTED(EG(exception) != exception)) {
7144 		Z_ADDREF_P(EG(exception));
7145 		HANDLE_EXCEPTION();
7146 	} else {
7147 		EG(exception) = NULL;
7148 		ZEND_VM_NEXT_OPCODE();
7149 	}
7150 }
7151 
ZEND_CASE_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7152 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7153 {
7154 	USE_OPLINE
7155 
7156 
7157 	SAVE_OPLINE();
7158 	if (IS_CONST==IS_VAR) {
7159 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
7160 	}
7161 	is_equal_function(&EX_T(opline->result.var).tmp_var,
7162 				 opline->op1.zv,
7163 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
7164 
7165 	CHECK_EXCEPTION();
7166 	ZEND_VM_NEXT_OPCODE();
7167 }
7168 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7169 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7170 {
7171 	USE_OPLINE
7172 
7173 	zval *expr_ptr;
7174 
7175 	SAVE_OPLINE();
7176 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
7177 		zval **expr_ptr_ptr = NULL;
7178 
7179 		if (IS_CONST == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
7180 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
7181 		}
7182 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
7183 		expr_ptr = *expr_ptr_ptr;
7184 		Z_ADDREF_P(expr_ptr);
7185 	} else {
7186 		expr_ptr=opline->op1.zv;
7187 		if (0) { /* temporary variable */
7188 			zval *new_expr;
7189 
7190 			ALLOC_ZVAL(new_expr);
7191 			INIT_PZVAL_COPY(new_expr, expr_ptr);
7192 			expr_ptr = new_expr;
7193 		} else if (IS_CONST == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
7194 			zval *new_expr;
7195 
7196 			ALLOC_ZVAL(new_expr);
7197 			INIT_PZVAL_COPY(new_expr, expr_ptr);
7198 			expr_ptr = new_expr;
7199 			zendi_zval_copy_ctor(*expr_ptr);
7200 		} else {
7201 			Z_ADDREF_P(expr_ptr);
7202 		}
7203 	}
7204 
7205 	if (IS_CV != IS_UNUSED) {
7206 
7207 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
7208 		ulong hval;
7209 
7210 		switch (Z_TYPE_P(offset)) {
7211 			case IS_DOUBLE:
7212 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
7213 				goto num_index;
7214 			case IS_LONG:
7215 			case IS_BOOL:
7216 				hval = Z_LVAL_P(offset);
7217 num_index:
7218 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
7219 				break;
7220 			case IS_STRING:
7221 				if (IS_CV == IS_CONST) {
7222 					hval = Z_HASH_P(offset);
7223 				} else {
7224 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
7225 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
7226 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
7227 					} else {
7228 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
7229 					}
7230 				}
7231 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
7232 				break;
7233 			case IS_NULL:
7234 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
7235 				break;
7236 			default:
7237 				zend_error(E_WARNING, "Illegal offset type");
7238 				zval_ptr_dtor(&expr_ptr);
7239 				/* do nothing */
7240 				break;
7241 		}
7242 
7243 	} else {
7244 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
7245 	}
7246 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
7247 
7248 	} else {
7249 
7250 	}
7251 	CHECK_EXCEPTION();
7252 	ZEND_VM_NEXT_OPCODE();
7253 }
7254 
ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7255 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7256 {
7257 	USE_OPLINE
7258 
7259 	array_init(&EX_T(opline->result.var).tmp_var);
7260 	if (IS_CONST == IS_UNUSED) {
7261 		ZEND_VM_NEXT_OPCODE();
7262 #if 0 || IS_CONST != IS_UNUSED
7263 	} else {
7264 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7265 #endif
7266 	}
7267 }
7268 
ZEND_YIELD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7269 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7270 {
7271 	USE_OPLINE
7272 
7273 	/* The generator object is stored in return_value_ptr_ptr */
7274 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
7275 
7276 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
7277 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
7278 	}
7279 
7280 	/* Destroy the previously yielded value */
7281 	if (generator->value) {
7282 		zval_ptr_dtor(&generator->value);
7283 	}
7284 
7285 	/* Destroy the previously yielded key */
7286 	if (generator->key) {
7287 		zval_ptr_dtor(&generator->key);
7288 	}
7289 
7290 	/* Set the new yielded value */
7291 	if (IS_CONST != IS_UNUSED) {
7292 
7293 
7294 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
7295 			/* Constants and temporary variables aren't yieldable by reference,
7296 			 * but we still allow them with a notice. */
7297 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR) {
7298 				zval *value, *copy;
7299 
7300 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
7301 
7302 				value = opline->op1.zv;
7303 				ALLOC_ZVAL(copy);
7304 				INIT_PZVAL_COPY(copy, value);
7305 
7306 				/* Temporary variables don't need ctor copying */
7307 				if (!0) {
7308 					zval_copy_ctor(copy);
7309 				}
7310 
7311 				generator->value = copy;
7312 			} else {
7313 				zval **value_ptr = NULL;
7314 
7315 				if (IS_CONST == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
7316 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
7317 				}
7318 
7319 				/* If a function call result is yielded and the function did
7320 				 * not return by reference we throw a notice. */
7321 				if (IS_CONST == IS_VAR && !Z_ISREF_PP(value_ptr)
7322 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
7323 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
7324 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
7325 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
7326 
7327 					Z_ADDREF_PP(value_ptr);
7328 					generator->value = *value_ptr;
7329 				} else {
7330 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
7331 					Z_ADDREF_PP(value_ptr);
7332 					generator->value = *value_ptr;
7333 				}
7334 
7335 			}
7336 		} else {
7337 			zval *value = opline->op1.zv;
7338 
7339 			/* Consts, temporary variables and references need copying */
7340 			if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
7341 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
7342 			) {
7343 				zval *copy;
7344 
7345 				ALLOC_ZVAL(copy);
7346 				INIT_PZVAL_COPY(copy, value);
7347 
7348 				/* Temporary variables don't need ctor copying */
7349 				if (!0) {
7350 					zval_copy_ctor(copy);
7351 				}
7352 
7353 				generator->value = copy;
7354 			} else {
7355 				Z_ADDREF_P(value);
7356 				generator->value = value;
7357 			}
7358 
7359 		}
7360 	} else {
7361 		/* If no value was specified yield null */
7362 		Z_ADDREF(EG(uninitialized_zval));
7363 		generator->value = &EG(uninitialized_zval);
7364 	}
7365 
7366 	/* Set the new yielded key */
7367 	if (IS_CV != IS_UNUSED) {
7368 
7369 		zval *key = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
7370 
7371 		/* Consts, temporary variables and references need copying */
7372 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
7373 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
7374 		) {
7375 			zval *copy;
7376 
7377 			ALLOC_ZVAL(copy);
7378 			INIT_PZVAL_COPY(copy, key);
7379 
7380 			/* Temporary variables don't need ctor copying */
7381 			if (!0) {
7382 				zval_copy_ctor(copy);
7383 			}
7384 
7385 			generator->key = copy;
7386 		} else {
7387 			Z_ADDREF_P(key);
7388 			generator->key = key;
7389 		}
7390 
7391 		if (Z_TYPE_P(generator->key) == IS_LONG
7392 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
7393 		) {
7394 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
7395 		}
7396 
7397 	} else {
7398 		/* If no key was specified we use auto-increment keys */
7399 		generator->largest_used_integer_key++;
7400 
7401 		ALLOC_INIT_ZVAL(generator->key);
7402 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
7403 	}
7404 
7405 	if (RETURN_VALUE_USED(opline)) {
7406 		/* If the return value of yield is used set the send
7407 		 * target and initialize it to NULL */
7408 		generator->send_target = &EX_T(opline->result.var).var.ptr;
7409 		Z_ADDREF(EG(uninitialized_zval));
7410 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
7411 	} else {
7412 		generator->send_target = NULL;
7413 	}
7414 
7415 	/* We increment to the next op, so we are at the correct position when the
7416 	 * generator is resumed. */
7417 	ZEND_VM_INC_OPCODE();
7418 
7419 	/* The GOTO VM uses a local opline variable. We need to set the opline
7420 	 * variable in execute_data so we don't resume at an old position. */
7421 	SAVE_OPLINE();
7422 
7423 	ZEND_VM_RETURN();
7424 }
7425 
ZEND_BW_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7426 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7427 {
7428 	USE_OPLINE
7429 	zend_free_op free_op1;
7430 
7431 	SAVE_OPLINE();
7432 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
7433 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC) TSRMLS_CC);
7434 	zval_dtor(free_op1.var);
7435 	CHECK_EXCEPTION();
7436 	ZEND_VM_NEXT_OPCODE();
7437 }
7438 
ZEND_BOOL_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7439 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7440 {
7441 	USE_OPLINE
7442 	zend_free_op free_op1;
7443 
7444 	SAVE_OPLINE();
7445 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
7446 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC) TSRMLS_CC);
7447 	zval_dtor(free_op1.var);
7448 	CHECK_EXCEPTION();
7449 	ZEND_VM_NEXT_OPCODE();
7450 }
7451 
ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7452 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7453 {
7454 	USE_OPLINE
7455 	zend_free_op free_op1;
7456 	zval *z;
7457 
7458 	SAVE_OPLINE();
7459 	z = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7460 
7461 	if (IS_TMP_VAR == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
7462 		INIT_PZVAL(z);
7463 	}
7464 	zend_print_variable(z);
7465 
7466 	zval_dtor(free_op1.var);
7467 	CHECK_EXCEPTION();
7468 	ZEND_VM_NEXT_OPCODE();
7469 }
7470 
ZEND_PRINT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7471 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7472 {
7473 	USE_OPLINE
7474 
7475 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
7476 	return ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7477 }
7478 
ZEND_JMPZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7479 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7480 {
7481 	USE_OPLINE
7482 	zend_free_op free_op1;
7483 	zval *val;
7484 	int ret;
7485 
7486 	SAVE_OPLINE();
7487 	val = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7488 
7489 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
7490 		ret = Z_LVAL_P(val);
7491 	} else {
7492 		ret = i_zend_is_true(val);
7493 		zval_dtor(free_op1.var);
7494 		if (UNEXPECTED(EG(exception) != NULL)) {
7495 			HANDLE_EXCEPTION();
7496 		}
7497 	}
7498 	if (!ret) {
7499 #if DEBUG_ZEND>=2
7500 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7501 #endif
7502 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
7503 		ZEND_VM_CONTINUE();
7504 	}
7505 
7506 	ZEND_VM_NEXT_OPCODE();
7507 }
7508 
ZEND_JMPNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7509 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7510 {
7511 	USE_OPLINE
7512 	zend_free_op free_op1;
7513 	zval *val;
7514 	int ret;
7515 
7516 	SAVE_OPLINE();
7517 	val = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7518 
7519 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
7520 		ret = Z_LVAL_P(val);
7521 	} else {
7522 		ret = i_zend_is_true(val);
7523 		zval_dtor(free_op1.var);
7524 		if (UNEXPECTED(EG(exception) != NULL)) {
7525 			HANDLE_EXCEPTION();
7526 		}
7527 	}
7528 	if (ret) {
7529 #if DEBUG_ZEND>=2
7530 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7531 #endif
7532 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
7533 		ZEND_VM_CONTINUE();
7534 	}
7535 
7536 	ZEND_VM_NEXT_OPCODE();
7537 }
7538 
ZEND_JMPZNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7539 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7540 {
7541 	USE_OPLINE
7542 	zend_free_op free_op1;
7543 	zval *val;
7544 	int retval;
7545 
7546 	SAVE_OPLINE();
7547 	val = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7548 
7549 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
7550 		retval = Z_LVAL_P(val);
7551 	} else {
7552 		retval = i_zend_is_true(val);
7553 		zval_dtor(free_op1.var);
7554 		if (UNEXPECTED(EG(exception) != NULL)) {
7555 			HANDLE_EXCEPTION();
7556 		}
7557 	}
7558 	if (EXPECTED(retval != 0)) {
7559 #if DEBUG_ZEND>=2
7560 		printf("Conditional jmp on true to %d\n", opline->extended_value);
7561 #endif
7562 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
7563 		ZEND_VM_CONTINUE(); /* CHECK_ME */
7564 	} else {
7565 #if DEBUG_ZEND>=2
7566 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
7567 #endif
7568 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
7569 		ZEND_VM_CONTINUE(); /* CHECK_ME */
7570 	}
7571 }
7572 
ZEND_JMPZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7573 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7574 {
7575 	USE_OPLINE
7576 	zend_free_op free_op1;
7577 	zval *val;
7578 	int retval;
7579 
7580 	SAVE_OPLINE();
7581 	val = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7582 
7583 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
7584 		retval = Z_LVAL_P(val);
7585 	} else {
7586 		retval = i_zend_is_true(val);
7587 		zval_dtor(free_op1.var);
7588 		if (UNEXPECTED(EG(exception) != NULL)) {
7589 			HANDLE_EXCEPTION();
7590 		}
7591 	}
7592 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
7593 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
7594 	if (!retval) {
7595 #if DEBUG_ZEND>=2
7596 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7597 #endif
7598 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
7599 		ZEND_VM_CONTINUE();
7600 	}
7601 	ZEND_VM_NEXT_OPCODE();
7602 }
7603 
ZEND_JMPNZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7604 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7605 {
7606 	USE_OPLINE
7607 	zend_free_op free_op1;
7608 	zval *val;
7609 	int retval;
7610 
7611 	SAVE_OPLINE();
7612 	val = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7613 
7614 	if (IS_TMP_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
7615 		retval = Z_LVAL_P(val);
7616 	} else {
7617 		retval = i_zend_is_true(val);
7618 		zval_dtor(free_op1.var);
7619 		if (UNEXPECTED(EG(exception) != NULL)) {
7620 			HANDLE_EXCEPTION();
7621 		}
7622 	}
7623 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
7624 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
7625 	if (retval) {
7626 #if DEBUG_ZEND>=2
7627 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
7628 #endif
7629 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
7630 		ZEND_VM_CONTINUE();
7631 	}
7632 	ZEND_VM_NEXT_OPCODE();
7633 }
7634 
ZEND_FREE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7635 static int ZEND_FASTCALL  ZEND_FREE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7636 {
7637 	USE_OPLINE
7638 
7639 	SAVE_OPLINE();
7640 	if (IS_TMP_VAR == IS_TMP_VAR) {
7641 		zendi_zval_dtor(EX_T(opline->op1.var).tmp_var);
7642 	} else {
7643 		zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
7644 	}
7645 	CHECK_EXCEPTION();
7646 	ZEND_VM_NEXT_OPCODE();
7647 }
7648 
ZEND_RETURN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7649 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7650 {
7651 	USE_OPLINE
7652 	zval *retval_ptr;
7653 	zend_free_op free_op1;
7654 
7655 	SAVE_OPLINE();
7656 	retval_ptr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7657 
7658 	if (!EG(return_value_ptr_ptr)) {
7659 		if (IS_TMP_VAR == IS_TMP_VAR) {
7660 			zval_dtor(free_op1.var);
7661 		}
7662 	} else {
7663 		if (IS_TMP_VAR == IS_CONST ||
7664 		    IS_TMP_VAR == IS_TMP_VAR ||
7665 		    PZVAL_IS_REF(retval_ptr)) {
7666 			zval *ret;
7667 
7668 			ALLOC_ZVAL(ret);
7669 			INIT_PZVAL_COPY(ret, retval_ptr);
7670 			if (IS_TMP_VAR != IS_TMP_VAR) {
7671 				zval_copy_ctor(ret);
7672 			}
7673 			*EG(return_value_ptr_ptr) = ret;
7674 		} else if ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
7675 		           retval_ptr == &EG(uninitialized_zval)) {
7676 			zval *ret;
7677 
7678 			ALLOC_INIT_ZVAL(ret);
7679 			*EG(return_value_ptr_ptr) = ret;
7680 		} else {
7681 			*EG(return_value_ptr_ptr) = retval_ptr;
7682 			Z_ADDREF_P(retval_ptr);
7683 		}
7684 	}
7685 
7686 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7687 }
7688 
ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7689 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7690 {
7691 	USE_OPLINE
7692 	zval *retval_ptr;
7693 	zval **retval_ptr_ptr;
7694 	zend_free_op free_op1;
7695 
7696 	SAVE_OPLINE();
7697 
7698 	do {
7699 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
7700 			/* Not supposed to happen, but we'll allow it */
7701 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
7702 
7703 			retval_ptr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7704 			if (!EG(return_value_ptr_ptr)) {
7705 				if (IS_TMP_VAR == IS_TMP_VAR) {
7706 					zval_dtor(free_op1.var);
7707 				}
7708 			} else if (!1) { /* Not a temp var */
7709 				zval *ret;
7710 
7711 				ALLOC_ZVAL(ret);
7712 				INIT_PZVAL_COPY(ret, retval_ptr);
7713 				zval_copy_ctor(ret);
7714 				*EG(return_value_ptr_ptr) = ret;
7715 			} else {
7716 				zval *ret;
7717 
7718 				ALLOC_ZVAL(ret);
7719 				INIT_PZVAL_COPY(ret, retval_ptr);
7720 				*EG(return_value_ptr_ptr) = ret;
7721 			}
7722 			break;
7723 		}
7724 
7725 		retval_ptr_ptr = NULL;
7726 
7727 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
7728 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
7729 		}
7730 
7731 		if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
7732 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
7733 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
7734 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
7735 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
7736 				if (EG(return_value_ptr_ptr)) {
7737 					zval *ret;
7738 
7739 					ALLOC_ZVAL(ret);
7740 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
7741 					zval_copy_ctor(ret);
7742 					*EG(return_value_ptr_ptr) = ret;
7743 				}
7744 				break;
7745 			}
7746 		}
7747 
7748 		if (EG(return_value_ptr_ptr)) {
7749 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
7750 			Z_ADDREF_PP(retval_ptr_ptr);
7751 
7752 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
7753 		}
7754 	} while (0);
7755 
7756 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
7757 }
7758 
ZEND_THROW_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7759 static int ZEND_FASTCALL  ZEND_THROW_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7760 {
7761 	USE_OPLINE
7762 	zval *value;
7763 	zval *exception;
7764 	zend_free_op free_op1;
7765 
7766 	SAVE_OPLINE();
7767 	value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7768 
7769 	if (IS_TMP_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
7770 		if (UNEXPECTED(EG(exception) != NULL)) {
7771 			HANDLE_EXCEPTION();
7772 		}
7773 		zend_error_noreturn(E_ERROR, "Can only throw objects");
7774 	}
7775 
7776 	zend_exception_save(TSRMLS_C);
7777 	/* Not sure if a complete copy is what we want here */
7778 	ALLOC_ZVAL(exception);
7779 	INIT_PZVAL_COPY(exception, value);
7780 	if (!1) {
7781 		zval_copy_ctor(exception);
7782 	}
7783 
7784 	zend_throw_exception_object(exception TSRMLS_CC);
7785 	zend_exception_restore(TSRMLS_C);
7786 
7787 	HANDLE_EXCEPTION();
7788 }
7789 
ZEND_SEND_VAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7790 static int ZEND_FASTCALL  ZEND_SEND_VAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7791 {
7792 	USE_OPLINE
7793 
7794 	SAVE_OPLINE();
7795 	if (opline->extended_value==ZEND_DO_FCALL_BY_NAME
7796 		&& ARG_MUST_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
7797 			zend_error_noreturn(E_ERROR, "Cannot pass parameter %d by reference", opline->op2.opline_num);
7798 	}
7799 	{
7800 		zval *valptr;
7801 		zval *value;
7802 		zend_free_op free_op1;
7803 
7804 		value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7805 
7806 		ALLOC_ZVAL(valptr);
7807 		INIT_PZVAL_COPY(valptr, value);
7808 		if (!1) {
7809 			zval_copy_ctor(valptr);
7810 		}
7811 		zend_vm_stack_push(valptr TSRMLS_CC);
7812 
7813 	}
7814 	CHECK_EXCEPTION();
7815 	ZEND_VM_NEXT_OPCODE();
7816 }
7817 
ZEND_BOOL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7818 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7819 {
7820 	USE_OPLINE
7821 	zend_free_op free_op1;
7822 	zval *retval = &EX_T(opline->result.var).tmp_var;
7823 
7824 	SAVE_OPLINE();
7825 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
7826 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC)));
7827 	zval_dtor(free_op1.var);
7828 
7829 	CHECK_EXCEPTION();
7830 	ZEND_VM_NEXT_OPCODE();
7831 }
7832 
ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7833 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7834 {
7835 	USE_OPLINE
7836 	zend_free_op free_op1;
7837 	zval *obj;
7838 	zend_class_entry *ce;
7839 	zend_function *clone;
7840 	zend_object_clone_obj_t clone_call;
7841 
7842 	SAVE_OPLINE();
7843 	obj = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7844 
7845 	if (IS_TMP_VAR == IS_CONST ||
7846 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
7847 		if (UNEXPECTED(EG(exception) != NULL)) {
7848 			HANDLE_EXCEPTION();
7849 		}
7850 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
7851 	}
7852 
7853 	ce = Z_OBJCE_P(obj);
7854 	clone = ce ? ce->clone : NULL;
7855 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
7856 	if (UNEXPECTED(clone_call == NULL)) {
7857 		if (ce) {
7858 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
7859 		} else {
7860 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
7861 		}
7862 	}
7863 
7864 	if (ce && clone) {
7865 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
7866 			/* Ensure that if we're calling a private function, we're allowed to do so.
7867 			 */
7868 			if (UNEXPECTED(ce != EG(scope))) {
7869 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
7870 			}
7871 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
7872 			/* Ensure that if we're calling a protected function, we're allowed to do so.
7873 			 */
7874 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
7875 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
7876 			}
7877 		}
7878 	}
7879 
7880 	if (EXPECTED(EG(exception) == NULL)) {
7881 		zval *retval;
7882 
7883 		ALLOC_ZVAL(retval);
7884 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
7885 		Z_TYPE_P(retval) = IS_OBJECT;
7886 		Z_SET_REFCOUNT_P(retval, 1);
7887 		Z_SET_ISREF_P(retval);
7888 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
7889 			zval_ptr_dtor(&retval);
7890 		} else {
7891 			AI_SET_PTR(&EX_T(opline->result.var), retval);
7892 		}
7893 	}
7894 
7895 	CHECK_EXCEPTION();
7896 	ZEND_VM_NEXT_OPCODE();
7897 }
7898 
ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7899 static int ZEND_FASTCALL  ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7900 {
7901 	USE_OPLINE
7902 	zend_free_op free_op1;
7903 	zval *expr;
7904 	zval *result = &EX_T(opline->result.var).tmp_var;
7905 
7906 	SAVE_OPLINE();
7907 	expr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7908 
7909 	if (opline->extended_value != IS_STRING) {
7910 		ZVAL_COPY_VALUE(result, expr);
7911 		if (!1) {
7912 			zendi_zval_copy_ctor(*result);
7913 		}
7914 	}
7915 	switch (opline->extended_value) {
7916 		case IS_NULL:
7917 			convert_to_null(result);
7918 			break;
7919 		case IS_BOOL:
7920 			convert_to_boolean(result);
7921 			break;
7922 		case IS_LONG:
7923 			convert_to_long(result);
7924 			break;
7925 		case IS_DOUBLE:
7926 			convert_to_double(result);
7927 			break;
7928 		case IS_STRING: {
7929 			zval var_copy;
7930 			int use_copy;
7931 
7932 			zend_make_printable_zval(expr, &var_copy, &use_copy);
7933 			if (use_copy) {
7934 				ZVAL_COPY_VALUE(result, &var_copy);
7935 				if (1) {
7936 					zval_dtor(free_op1.var);
7937 				}
7938 			} else {
7939 				ZVAL_COPY_VALUE(result, expr);
7940 				if (!1) {
7941 					zendi_zval_copy_ctor(*result);
7942 				}
7943 			}
7944 			break;
7945 		}
7946 		case IS_ARRAY:
7947 			convert_to_array(result);
7948 			break;
7949 		case IS_OBJECT:
7950 			convert_to_object(result);
7951 			break;
7952 	}
7953 
7954 	CHECK_EXCEPTION();
7955 	ZEND_VM_NEXT_OPCODE();
7956 }
7957 
ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)7958 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
7959 {
7960 	USE_OPLINE
7961 	zend_op_array *new_op_array=NULL;
7962 	zend_free_op free_op1;
7963 	zval *inc_filename;
7964 	zval *tmp_inc_filename = NULL;
7965 	zend_bool failure_retval=0;
7966 
7967 	SAVE_OPLINE();
7968 	inc_filename = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
7969 
7970 	if (inc_filename->type!=IS_STRING) {
7971 		MAKE_STD_ZVAL(tmp_inc_filename);
7972 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
7973 		zval_copy_ctor(tmp_inc_filename);
7974 		convert_to_string(tmp_inc_filename);
7975 		inc_filename = tmp_inc_filename;
7976 	}
7977 
7978 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
7979 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
7980 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
7981 		} else {
7982 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
7983 		}
7984 	} else {
7985 		switch (opline->extended_value) {
7986 			case ZEND_INCLUDE_ONCE:
7987 			case ZEND_REQUIRE_ONCE: {
7988 					zend_file_handle file_handle;
7989 					char *resolved_path;
7990 
7991 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
7992 					if (resolved_path) {
7993 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
7994 					} else {
7995 						resolved_path = Z_STRVAL_P(inc_filename);
7996 					}
7997 
7998 					if (failure_retval) {
7999 						/* do nothing, file already included */
8000 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
8001 
8002 						if (!file_handle.opened_path) {
8003 							file_handle.opened_path = estrdup(resolved_path);
8004 						}
8005 
8006 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
8007 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
8008 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
8009 						} else {
8010 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
8011 							failure_retval=1;
8012 						}
8013 					} else {
8014 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
8015 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
8016 						} else {
8017 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
8018 						}
8019 					}
8020 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
8021 						efree(resolved_path);
8022 					}
8023 				}
8024 				break;
8025 			case ZEND_INCLUDE:
8026 			case ZEND_REQUIRE:
8027 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
8028 				break;
8029 			case ZEND_EVAL: {
8030 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
8031 
8032 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
8033 					efree(eval_desc);
8034 				}
8035 				break;
8036 			EMPTY_SWITCH_DEFAULT_CASE()
8037 		}
8038 	}
8039 	if (tmp_inc_filename) {
8040 		zval_ptr_dtor(&tmp_inc_filename);
8041 	}
8042 	zval_dtor(free_op1.var);
8043 	if (UNEXPECTED(EG(exception) != NULL)) {
8044 		HANDLE_EXCEPTION();
8045 	} else if (EXPECTED(new_op_array != NULL)) {
8046 		EX(original_return_value) = EG(return_value_ptr_ptr);
8047 		EG(active_op_array) = new_op_array;
8048 		if (RETURN_VALUE_USED(opline)) {
8049 			EX_T(opline->result.var).var.ptr = NULL;
8050 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
8051 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
8052 		} else {
8053 			EG(return_value_ptr_ptr) = NULL;
8054 		}
8055 
8056 		EX(function_state).function = (zend_function *) new_op_array;
8057 		EX(object) = NULL;
8058 
8059 		if (!EG(active_symbol_table)) {
8060 			zend_rebuild_symbol_table(TSRMLS_C);
8061 		}
8062 
8063 		if (EXPECTED(zend_execute_ex == execute_ex)) {
8064 			ZEND_VM_ENTER();
8065 		} else {
8066 			zend_execute(new_op_array TSRMLS_CC);
8067 		}
8068 
8069 		EX(function_state).function = (zend_function *) EX(op_array);
8070 
8071 		EG(opline_ptr) = &EX(opline);
8072 		EG(active_op_array) = EX(op_array);
8073 		EG(return_value_ptr_ptr) = EX(original_return_value);
8074 		destroy_op_array(new_op_array TSRMLS_CC);
8075 		efree(new_op_array);
8076 		if (UNEXPECTED(EG(exception) != NULL)) {
8077 			zend_throw_exception_internal(NULL TSRMLS_CC);
8078 			HANDLE_EXCEPTION();
8079 		}
8080 
8081 	} else if (RETURN_VALUE_USED(opline)) {
8082 		zval *retval;
8083 
8084 		ALLOC_ZVAL(retval);
8085 		ZVAL_BOOL(retval, failure_retval);
8086 		INIT_PZVAL(retval);
8087 		AI_SET_PTR(&EX_T(opline->result.var), retval);
8088 	}
8089 	ZEND_VM_NEXT_OPCODE();
8090 }
8091 
ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8092 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8093 {
8094 	USE_OPLINE
8095 	zend_free_op free_op1;
8096 	zval *array_ptr, **array_ptr_ptr;
8097 	HashTable *fe_ht;
8098 	zend_object_iterator *iter = NULL;
8099 	zend_class_entry *ce = NULL;
8100 	zend_bool is_empty = 0;
8101 
8102 	SAVE_OPLINE();
8103 
8104 	if ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
8105 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
8106 		array_ptr_ptr = NULL;
8107 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
8108 			MAKE_STD_ZVAL(array_ptr);
8109 			ZVAL_NULL(array_ptr);
8110 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
8111 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
8112 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
8113 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
8114 			}
8115 
8116 			ce = Z_OBJCE_PP(array_ptr_ptr);
8117 			if (!ce || ce->get_iterator == NULL) {
8118 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
8119 				Z_ADDREF_PP(array_ptr_ptr);
8120 			}
8121 			array_ptr = *array_ptr_ptr;
8122 		} else {
8123 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
8124 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
8125 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
8126 					Z_SET_ISREF_PP(array_ptr_ptr);
8127 				}
8128 			}
8129 			array_ptr = *array_ptr_ptr;
8130 			Z_ADDREF_P(array_ptr);
8131 		}
8132 	} else {
8133 		array_ptr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8134 		if (1) { /* IS_TMP_VAR */
8135 			zval *tmp;
8136 
8137 			ALLOC_ZVAL(tmp);
8138 			INIT_PZVAL_COPY(tmp, array_ptr);
8139 			array_ptr = tmp;
8140 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
8141 				ce = Z_OBJCE_P(array_ptr);
8142 				if (ce && ce->get_iterator) {
8143 					Z_DELREF_P(array_ptr);
8144 				}
8145 			}
8146 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
8147 			ce = Z_OBJCE_P(array_ptr);
8148 			if (!ce || !ce->get_iterator) {
8149 				Z_ADDREF_P(array_ptr);
8150 			}
8151 		} else if (IS_TMP_VAR == IS_CONST ||
8152 		           ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
8153 		            !Z_ISREF_P(array_ptr) &&
8154 		            Z_REFCOUNT_P(array_ptr) > 1)) {
8155 			zval *tmp;
8156 
8157 			ALLOC_ZVAL(tmp);
8158 			INIT_PZVAL_COPY(tmp, array_ptr);
8159 			zval_copy_ctor(tmp);
8160 			array_ptr = tmp;
8161 		} else {
8162 			Z_ADDREF_P(array_ptr);
8163 		}
8164 	}
8165 
8166 	if (ce && ce->get_iterator) {
8167 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
8168 
8169 		if (iter && EXPECTED(EG(exception) == NULL)) {
8170 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
8171 		} else {
8172 
8173 			if (!EG(exception)) {
8174 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
8175 			}
8176 			zend_throw_exception_internal(NULL TSRMLS_CC);
8177 			HANDLE_EXCEPTION();
8178 		}
8179 	}
8180 
8181 	EX_T(opline->result.var).fe.ptr = array_ptr;
8182 
8183 	if (iter) {
8184 		iter->index = 0;
8185 		if (iter->funcs->rewind) {
8186 			iter->funcs->rewind(iter TSRMLS_CC);
8187 			if (UNEXPECTED(EG(exception) != NULL)) {
8188 				zval_ptr_dtor(&array_ptr);
8189 
8190 				HANDLE_EXCEPTION();
8191 			}
8192 		}
8193 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
8194 		if (UNEXPECTED(EG(exception) != NULL)) {
8195 			zval_ptr_dtor(&array_ptr);
8196 
8197 			HANDLE_EXCEPTION();
8198 		}
8199 		iter->index = -1; /* will be set to 0 before using next handler */
8200 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
8201 		zend_hash_internal_pointer_reset(fe_ht);
8202 		if (ce) {
8203 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
8204 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
8205 				char *str_key;
8206 				uint str_key_len;
8207 				ulong int_key;
8208 				zend_uchar key_type;
8209 
8210 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
8211 				if (key_type != HASH_KEY_NON_EXISTENT &&
8212 					(key_type == HASH_KEY_IS_LONG ||
8213 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
8214 					break;
8215 				}
8216 				zend_hash_move_forward(fe_ht);
8217 			}
8218 		}
8219 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
8220 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
8221 	} else {
8222 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
8223 		is_empty = 1;
8224 	}
8225 
8226 	if (is_empty) {
8227 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
8228 	} else {
8229 		CHECK_EXCEPTION();
8230 		ZEND_VM_NEXT_OPCODE();
8231 	}
8232 }
8233 
ZEND_EXIT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8234 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8235 {
8236 #if 0 || (IS_TMP_VAR != IS_UNUSED)
8237 	USE_OPLINE
8238 
8239 	SAVE_OPLINE();
8240 	if (IS_TMP_VAR != IS_UNUSED) {
8241 		zend_free_op free_op1;
8242 		zval *ptr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8243 
8244 		if (Z_TYPE_P(ptr) == IS_LONG) {
8245 			EG(exit_status) = Z_LVAL_P(ptr);
8246 		} else {
8247 			zend_print_variable(ptr);
8248 		}
8249 		zval_dtor(free_op1.var);
8250 	}
8251 #endif
8252 	zend_bailout();
8253 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
8254 }
8255 
ZEND_END_SILENCE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8256 static int ZEND_FASTCALL  ZEND_END_SILENCE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8257 {
8258 	USE_OPLINE
8259 	zval restored_error_reporting;
8260 
8261 	SAVE_OPLINE();
8262 	if (!EG(error_reporting) && Z_LVAL(EX_T(opline->op1.var).tmp_var) != 0) {
8263 		Z_TYPE(restored_error_reporting) = IS_LONG;
8264 		Z_LVAL(restored_error_reporting) = Z_LVAL(EX_T(opline->op1.var).tmp_var);
8265 		EG(error_reporting) = Z_LVAL(restored_error_reporting);
8266 		convert_to_string(&restored_error_reporting);
8267 		if (EXPECTED(EG(error_reporting_ini_entry) != NULL)) {
8268 			if (EXPECTED(EG(error_reporting_ini_entry)->modified &&
8269 			    EG(error_reporting_ini_entry)->value != EG(error_reporting_ini_entry)->orig_value)) {
8270 				efree(EG(error_reporting_ini_entry)->value);
8271 			}
8272 			EG(error_reporting_ini_entry)->value = Z_STRVAL(restored_error_reporting);
8273 			EG(error_reporting_ini_entry)->value_length = Z_STRLEN(restored_error_reporting);
8274 		} else {
8275 			zendi_zval_dtor(restored_error_reporting);
8276 		}
8277 	}
8278 	if (EX(old_error_reporting) == &EX_T(opline->op1.var).tmp_var) {
8279 		EX(old_error_reporting) = NULL;
8280 	}
8281 	CHECK_EXCEPTION();
8282 	ZEND_VM_NEXT_OPCODE();
8283 }
8284 
ZEND_JMP_SET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8285 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8286 {
8287 	USE_OPLINE
8288 	zend_free_op free_op1;
8289 	zval *value;
8290 
8291 	SAVE_OPLINE();
8292 	value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8293 
8294 	if (i_zend_is_true(value)) {
8295 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
8296 		if (!1) {
8297 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
8298 		}
8299 
8300 #if DEBUG_ZEND>=2
8301 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
8302 #endif
8303 		ZEND_VM_JMP(opline->op2.jmp_addr);
8304 	}
8305 
8306 	zval_dtor(free_op1.var);
8307 	CHECK_EXCEPTION();
8308 	ZEND_VM_NEXT_OPCODE();
8309 }
8310 
ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8311 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8312 {
8313 	USE_OPLINE
8314 	zend_free_op free_op1;
8315 	zval *value, *ret;
8316 
8317 	SAVE_OPLINE();
8318 	value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8319 
8320 	if (i_zend_is_true(value)) {
8321 		if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
8322 			Z_ADDREF_P(value);
8323 			EX_T(opline->result.var).var.ptr = value;
8324 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
8325 		} else {
8326 			ALLOC_ZVAL(ret);
8327 			INIT_PZVAL_COPY(ret, value);
8328 			EX_T(opline->result.var).var.ptr = ret;
8329 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
8330 			if (!1) {
8331 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
8332 			}
8333 		}
8334 
8335 #if DEBUG_ZEND>=2
8336 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
8337 #endif
8338 		ZEND_VM_JMP(opline->op2.jmp_addr);
8339 	}
8340 
8341 	zval_dtor(free_op1.var);
8342 	CHECK_EXCEPTION();
8343 	ZEND_VM_NEXT_OPCODE();
8344 }
8345 
ZEND_QM_ASSIGN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8346 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8347 {
8348 	USE_OPLINE
8349 	zend_free_op free_op1;
8350 	zval *value;
8351 
8352 	SAVE_OPLINE();
8353 	value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8354 
8355 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
8356 	if (!1) {
8357 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
8358 	}
8359 
8360 	CHECK_EXCEPTION();
8361 	ZEND_VM_NEXT_OPCODE();
8362 }
8363 
ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8364 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8365 {
8366 	USE_OPLINE
8367 	zend_free_op free_op1;
8368 	zval *value, *ret;
8369 
8370 	SAVE_OPLINE();
8371 	value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8372 
8373 	if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
8374 		Z_ADDREF_P(value);
8375 		EX_T(opline->result.var).var.ptr = value;
8376 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
8377 	} else {
8378 		ALLOC_ZVAL(ret);
8379 		INIT_PZVAL_COPY(ret, value);
8380 		EX_T(opline->result.var).var.ptr = ret;
8381 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
8382 		if (!1) {
8383 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
8384 		}
8385 	}
8386 
8387 	CHECK_EXCEPTION();
8388 	ZEND_VM_NEXT_OPCODE();
8389 }
8390 
ZEND_INSTANCEOF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8391 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8392 {
8393 	USE_OPLINE
8394 	zend_free_op free_op1;
8395 	zval *expr;
8396 	zend_bool result;
8397 
8398 	SAVE_OPLINE();
8399 	expr = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8400 
8401 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
8402 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
8403 	} else {
8404 		result = 0;
8405 	}
8406 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
8407 	zval_dtor(free_op1.var);
8408 	CHECK_EXCEPTION();
8409 	ZEND_VM_NEXT_OPCODE();
8410 }
8411 
ZEND_ADD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8412 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8413 {
8414 	USE_OPLINE
8415 	zend_free_op free_op1;
8416 
8417 	SAVE_OPLINE();
8418 	fast_add_function(&EX_T(opline->result.var).tmp_var,
8419 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8420 		opline->op2.zv TSRMLS_CC);
8421 	zval_dtor(free_op1.var);
8422 
8423 	CHECK_EXCEPTION();
8424 	ZEND_VM_NEXT_OPCODE();
8425 }
8426 
ZEND_SUB_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8427 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8428 {
8429 	USE_OPLINE
8430 	zend_free_op free_op1;
8431 
8432 	SAVE_OPLINE();
8433 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
8434 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8435 		opline->op2.zv TSRMLS_CC);
8436 	zval_dtor(free_op1.var);
8437 
8438 	CHECK_EXCEPTION();
8439 	ZEND_VM_NEXT_OPCODE();
8440 }
8441 
ZEND_MUL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8442 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8443 {
8444 	USE_OPLINE
8445 	zend_free_op free_op1;
8446 
8447 	SAVE_OPLINE();
8448 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
8449 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8450 		opline->op2.zv TSRMLS_CC);
8451 	zval_dtor(free_op1.var);
8452 
8453 	CHECK_EXCEPTION();
8454 	ZEND_VM_NEXT_OPCODE();
8455 }
8456 
ZEND_DIV_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8457 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8458 {
8459 	USE_OPLINE
8460 	zend_free_op free_op1;
8461 
8462 	SAVE_OPLINE();
8463 	fast_div_function(&EX_T(opline->result.var).tmp_var,
8464 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8465 		opline->op2.zv TSRMLS_CC);
8466 	zval_dtor(free_op1.var);
8467 
8468 	CHECK_EXCEPTION();
8469 	ZEND_VM_NEXT_OPCODE();
8470 }
8471 
ZEND_MOD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8472 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8473 {
8474 	USE_OPLINE
8475 	zend_free_op free_op1;
8476 
8477 	SAVE_OPLINE();
8478 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
8479 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8480 		opline->op2.zv TSRMLS_CC);
8481 	zval_dtor(free_op1.var);
8482 
8483 	CHECK_EXCEPTION();
8484 	ZEND_VM_NEXT_OPCODE();
8485 }
8486 
ZEND_SL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8487 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8488 {
8489 	USE_OPLINE
8490 	zend_free_op free_op1;
8491 
8492 	SAVE_OPLINE();
8493 	shift_left_function(&EX_T(opline->result.var).tmp_var,
8494 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8495 		opline->op2.zv TSRMLS_CC);
8496 	zval_dtor(free_op1.var);
8497 
8498 	CHECK_EXCEPTION();
8499 	ZEND_VM_NEXT_OPCODE();
8500 }
8501 
ZEND_SR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8502 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8503 {
8504 	USE_OPLINE
8505 	zend_free_op free_op1;
8506 
8507 	SAVE_OPLINE();
8508 	shift_right_function(&EX_T(opline->result.var).tmp_var,
8509 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8510 		opline->op2.zv TSRMLS_CC);
8511 	zval_dtor(free_op1.var);
8512 
8513 	CHECK_EXCEPTION();
8514 	ZEND_VM_NEXT_OPCODE();
8515 }
8516 
ZEND_CONCAT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8517 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8518 {
8519 	USE_OPLINE
8520 	zend_free_op free_op1;
8521 
8522 	SAVE_OPLINE();
8523 	concat_function(&EX_T(opline->result.var).tmp_var,
8524 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8525 		opline->op2.zv TSRMLS_CC);
8526 	zval_dtor(free_op1.var);
8527 
8528 	CHECK_EXCEPTION();
8529 	ZEND_VM_NEXT_OPCODE();
8530 }
8531 
ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8532 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8533 {
8534 	USE_OPLINE
8535 	zend_free_op free_op1;
8536 
8537 	SAVE_OPLINE();
8538 	is_identical_function(&EX_T(opline->result.var).tmp_var,
8539 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8540 		opline->op2.zv TSRMLS_CC);
8541 	zval_dtor(free_op1.var);
8542 
8543 	CHECK_EXCEPTION();
8544 	ZEND_VM_NEXT_OPCODE();
8545 }
8546 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8547 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8548 {
8549 	USE_OPLINE
8550 	zend_free_op free_op1;
8551 	zval *result = &EX_T(opline->result.var).tmp_var;
8552 
8553 	SAVE_OPLINE();
8554 	is_identical_function(result,
8555 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8556 		opline->op2.zv TSRMLS_CC);
8557 	Z_LVAL_P(result) = !Z_LVAL_P(result);
8558 	zval_dtor(free_op1.var);
8559 
8560 	CHECK_EXCEPTION();
8561 	ZEND_VM_NEXT_OPCODE();
8562 }
8563 
ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8564 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8565 {
8566 	USE_OPLINE
8567 	zend_free_op free_op1;
8568 	zval *result = &EX_T(opline->result.var).tmp_var;
8569 
8570 	SAVE_OPLINE();
8571 	ZVAL_BOOL(result, fast_equal_function(result,
8572 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8573 		opline->op2.zv TSRMLS_CC));
8574 	zval_dtor(free_op1.var);
8575 
8576 	CHECK_EXCEPTION();
8577 	ZEND_VM_NEXT_OPCODE();
8578 }
8579 
ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8580 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8581 {
8582 	USE_OPLINE
8583 	zend_free_op free_op1;
8584 	zval *result = &EX_T(opline->result.var).tmp_var;
8585 
8586 	SAVE_OPLINE();
8587 	ZVAL_BOOL(result, fast_not_equal_function(result,
8588 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8589 		opline->op2.zv TSRMLS_CC));
8590 	zval_dtor(free_op1.var);
8591 
8592 	CHECK_EXCEPTION();
8593 	ZEND_VM_NEXT_OPCODE();
8594 }
8595 
ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8596 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8597 {
8598 	USE_OPLINE
8599 	zend_free_op free_op1;
8600 	zval *result = &EX_T(opline->result.var).tmp_var;
8601 
8602 	SAVE_OPLINE();
8603 	ZVAL_BOOL(result, fast_is_smaller_function(result,
8604 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8605 		opline->op2.zv TSRMLS_CC));
8606 	zval_dtor(free_op1.var);
8607 
8608 	CHECK_EXCEPTION();
8609 	ZEND_VM_NEXT_OPCODE();
8610 }
8611 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8612 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8613 {
8614 	USE_OPLINE
8615 	zend_free_op free_op1;
8616 	zval *result = &EX_T(opline->result.var).tmp_var;
8617 
8618 	SAVE_OPLINE();
8619 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
8620 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8621 		opline->op2.zv TSRMLS_CC));
8622 	zval_dtor(free_op1.var);
8623 
8624 	CHECK_EXCEPTION();
8625 	ZEND_VM_NEXT_OPCODE();
8626 }
8627 
ZEND_BW_OR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8628 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8629 {
8630 	USE_OPLINE
8631 	zend_free_op free_op1;
8632 
8633 	SAVE_OPLINE();
8634 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
8635 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8636 		opline->op2.zv TSRMLS_CC);
8637 	zval_dtor(free_op1.var);
8638 
8639 	CHECK_EXCEPTION();
8640 	ZEND_VM_NEXT_OPCODE();
8641 }
8642 
ZEND_BW_AND_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8643 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8644 {
8645 	USE_OPLINE
8646 	zend_free_op free_op1;
8647 
8648 	SAVE_OPLINE();
8649 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
8650 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8651 		opline->op2.zv TSRMLS_CC);
8652 	zval_dtor(free_op1.var);
8653 
8654 	CHECK_EXCEPTION();
8655 	ZEND_VM_NEXT_OPCODE();
8656 }
8657 
ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8658 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8659 {
8660 	USE_OPLINE
8661 	zend_free_op free_op1;
8662 
8663 	SAVE_OPLINE();
8664 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
8665 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8666 		opline->op2.zv TSRMLS_CC);
8667 	zval_dtor(free_op1.var);
8668 
8669 	CHECK_EXCEPTION();
8670 	ZEND_VM_NEXT_OPCODE();
8671 }
8672 
ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8673 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8674 {
8675 	USE_OPLINE
8676 	zend_free_op free_op1;
8677 
8678 	SAVE_OPLINE();
8679 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
8680 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
8681 		opline->op2.zv TSRMLS_CC);
8682 	zval_dtor(free_op1.var);
8683 
8684 	CHECK_EXCEPTION();
8685 	ZEND_VM_NEXT_OPCODE();
8686 }
8687 
zend_fetch_var_address_helper_SPEC_TMP_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)8688 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
8689 {
8690 	USE_OPLINE
8691 	zend_free_op free_op1;
8692 	zval *varname;
8693 	zval **retval;
8694 	zval tmp_varname;
8695 	HashTable *target_symbol_table;
8696 	ulong hash_value;
8697 
8698 	SAVE_OPLINE();
8699 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8700 
8701  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
8702 		ZVAL_COPY_VALUE(&tmp_varname, varname);
8703 		zval_copy_ctor(&tmp_varname);
8704 		Z_SET_REFCOUNT(tmp_varname, 1);
8705 		Z_UNSET_ISREF(tmp_varname);
8706 		convert_to_string(&tmp_varname);
8707 		varname = &tmp_varname;
8708 	}
8709 
8710 	if (IS_CONST != IS_UNUSED) {
8711 		zend_class_entry *ce;
8712 
8713 		if (IS_CONST == IS_CONST) {
8714 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
8715 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
8716 			} else {
8717 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
8718 				if (UNEXPECTED(ce == NULL)) {
8719 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
8720 						zval_dtor(&tmp_varname);
8721 					}
8722 					zval_dtor(free_op1.var);
8723 					CHECK_EXCEPTION();
8724 					ZEND_VM_NEXT_OPCODE();
8725 				}
8726 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
8727 			}
8728 		} else {
8729 			ce = EX_T(opline->op2.var).class_entry;
8730 		}
8731 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
8732 		zval_dtor(free_op1.var);
8733 	} else {
8734 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
8735 /*
8736 		if (!target_symbol_table) {
8737 			CHECK_EXCEPTION();
8738 			ZEND_VM_NEXT_OPCODE();
8739 		}
8740 */
8741 		if (IS_TMP_VAR == IS_CONST) {
8742 			hash_value = Z_HASH_P(varname);
8743 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
8744 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
8745 		} else {
8746 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
8747 		}
8748 
8749 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
8750 			switch (type) {
8751 				case BP_VAR_R:
8752 				case BP_VAR_UNSET:
8753 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
8754 					/* break missing intentionally */
8755 				case BP_VAR_IS:
8756 					retval = &EG(uninitialized_zval_ptr);
8757 					break;
8758 				case BP_VAR_RW:
8759 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
8760 					/* break missing intentionally */
8761 				case BP_VAR_W:
8762 					Z_ADDREF_P(&EG(uninitialized_zval));
8763 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
8764 					break;
8765 				EMPTY_SWITCH_DEFAULT_CASE()
8766 			}
8767 		}
8768 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
8769 			case ZEND_FETCH_GLOBAL:
8770 				if (IS_TMP_VAR != IS_TMP_VAR) {
8771 					zval_dtor(free_op1.var);
8772 				}
8773 				break;
8774 			case ZEND_FETCH_LOCAL:
8775 				zval_dtor(free_op1.var);
8776 				break;
8777 			case ZEND_FETCH_STATIC:
8778 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
8779 				break;
8780 			case ZEND_FETCH_GLOBAL_LOCK:
8781 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
8782 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
8783 				}
8784 				break;
8785 		}
8786 	}
8787 
8788 
8789 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
8790 		zval_dtor(&tmp_varname);
8791 	}
8792 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
8793 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
8794 	}
8795 	PZVAL_LOCK(*retval);
8796 	switch (type) {
8797 		case BP_VAR_R:
8798 		case BP_VAR_IS:
8799 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
8800 			break;
8801 		case BP_VAR_UNSET: {
8802 			zend_free_op free_res;
8803 
8804 			PZVAL_UNLOCK(*retval, &free_res);
8805 			if (retval != &EG(uninitialized_zval_ptr)) {
8806 				SEPARATE_ZVAL_IF_NOT_REF(retval);
8807 			}
8808 			PZVAL_LOCK(*retval);
8809 			FREE_OP_VAR_PTR(free_res);
8810 		}
8811 		/* break missing intentionally */
8812 		default:
8813 			EX_T(opline->result.var).var.ptr_ptr = retval;
8814 			break;
8815 	}
8816 	CHECK_EXCEPTION();
8817 	ZEND_VM_NEXT_OPCODE();
8818 }
8819 
ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8820 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8821 {
8822 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8823 }
8824 
ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8825 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8826 {
8827 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8828 }
8829 
ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8830 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8831 {
8832 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8833 }
8834 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8835 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8836 {
8837 	USE_OPLINE
8838 
8839 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8840 }
8841 
ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8842 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8843 {
8844 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8845 }
8846 
ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8847 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8848 {
8849 	return zend_fetch_var_address_helper_SPEC_TMP_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
8850 }
8851 
ZEND_FETCH_DIM_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8852 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8853 {
8854 	USE_OPLINE
8855 	zend_free_op free_op1;
8856 	zval *container;
8857 
8858 	SAVE_OPLINE();
8859 
8860 	if (IS_TMP_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
8861 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
8862 	}
8863 	container = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8864 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
8865 
8866 	zval_dtor(free_op1.var);
8867 	CHECK_EXCEPTION();
8868 	ZEND_VM_NEXT_OPCODE();
8869 }
8870 
ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8871 static int ZEND_FASTCALL  ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8872 {
8873 	USE_OPLINE
8874 	zend_free_op free_op1;
8875 	zval *container;
8876 
8877 	SAVE_OPLINE();
8878 	container = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8879 
8880 	if (UNEXPECTED(Z_TYPE_P(container) != IS_ARRAY)) {
8881 		PZVAL_LOCK(&EG(uninitialized_zval));
8882 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
8883 	} else {
8884 
8885 		zval *value = *zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
8886 
8887 		PZVAL_LOCK(value);
8888 		AI_SET_PTR(&EX_T(opline->result.var), value);
8889 
8890 	}
8891 	CHECK_EXCEPTION();
8892 	ZEND_VM_NEXT_OPCODE();
8893 }
8894 
ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8895 static int ZEND_FASTCALL  ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8896 {
8897 	USE_OPLINE
8898 	zval *str = &EX_T(opline->result.var).tmp_var;
8899 
8900 	SAVE_OPLINE();
8901 
8902 	if (IS_TMP_VAR == IS_UNUSED) {
8903 		/* Initialize for erealloc in add_char_to_string */
8904 		Z_STRVAL_P(str) = NULL;
8905 		Z_STRLEN_P(str) = 0;
8906 		Z_TYPE_P(str) = IS_STRING;
8907 
8908 		INIT_PZVAL(str);
8909 	}
8910 
8911 	add_char_to_string(str, str, opline->op2.zv);
8912 
8913 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
8914 	/*CHECK_EXCEPTION();*/
8915 	ZEND_VM_NEXT_OPCODE();
8916 }
8917 
ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8918 static int ZEND_FASTCALL  ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8919 {
8920 	USE_OPLINE
8921 	zval *str = &EX_T(opline->result.var).tmp_var;
8922 
8923 	SAVE_OPLINE();
8924 
8925 	if (IS_TMP_VAR == IS_UNUSED) {
8926 		/* Initialize for erealloc in add_string_to_string */
8927 		Z_STRVAL_P(str) = NULL;
8928 		Z_STRLEN_P(str) = 0;
8929 		Z_TYPE_P(str) = IS_STRING;
8930 
8931 		INIT_PZVAL(str);
8932 	}
8933 
8934 	add_string_to_string(str, str, opline->op2.zv);
8935 
8936 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
8937 	/*CHECK_EXCEPTION();*/
8938 	ZEND_VM_NEXT_OPCODE();
8939 }
8940 
ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)8941 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
8942 {
8943 	USE_OPLINE
8944 	zval *function_name;
8945 	char *function_name_strval;
8946 	int function_name_strlen;
8947 	zend_free_op free_op1;
8948 	call_slot *call = EX(call_slots) + opline->result.num;
8949 
8950 	SAVE_OPLINE();
8951 
8952 	function_name = opline->op2.zv;
8953 
8954 	if (IS_CONST != IS_CONST &&
8955 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
8956 		if (UNEXPECTED(EG(exception) != NULL)) {
8957 			HANDLE_EXCEPTION();
8958 		}
8959 		zend_error_noreturn(E_ERROR, "Method name must be a string");
8960 	}
8961 
8962 	function_name_strval = Z_STRVAL_P(function_name);
8963 	function_name_strlen = Z_STRLEN_P(function_name);
8964 
8965 	call->object = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
8966 
8967 	if (EXPECTED(call->object != NULL) &&
8968 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
8969 		call->called_scope = Z_OBJCE_P(call->object);
8970 
8971 		if (IS_CONST != IS_CONST ||
8972 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
8973 		    zval *object = call->object;
8974 
8975 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
8976 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
8977 			}
8978 
8979 			/* First, locate the function. */
8980 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
8981 			if (UNEXPECTED(call->fbc == NULL)) {
8982 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
8983 			}
8984 			if (IS_CONST == IS_CONST &&
8985 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
8986 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
8987 			    EXPECTED(call->object == object)) {
8988 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
8989 			}
8990 		}
8991 	} else {
8992 		if (UNEXPECTED(EG(exception) != NULL)) {
8993 
8994 			HANDLE_EXCEPTION();
8995 		}
8996 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
8997 	}
8998 
8999 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
9000 		call->object = NULL;
9001 	} else {
9002 		if (!PZVAL_IS_REF(call->object)) {
9003 			Z_ADDREF_P(call->object); /* For $this pointer */
9004 		} else {
9005 			zval *this_ptr;
9006 			ALLOC_ZVAL(this_ptr);
9007 			INIT_PZVAL_COPY(this_ptr, call->object);
9008 			zval_copy_ctor(this_ptr);
9009 			call->object = this_ptr;
9010 		}
9011 	}
9012 	call->is_ctor_call = 0;
9013 	EX(call) = call;
9014 
9015 
9016 	CHECK_EXCEPTION();
9017 	ZEND_VM_NEXT_OPCODE();
9018 }
9019 
ZEND_CASE_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9020 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9021 {
9022 	USE_OPLINE
9023 	zend_free_op free_op1;
9024 
9025 	SAVE_OPLINE();
9026 	if (IS_TMP_VAR==IS_VAR) {
9027 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
9028 	}
9029 	is_equal_function(&EX_T(opline->result.var).tmp_var,
9030 				 _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9031 				 opline->op2.zv TSRMLS_CC);
9032 
9033 	CHECK_EXCEPTION();
9034 	ZEND_VM_NEXT_OPCODE();
9035 }
9036 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9037 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9038 {
9039 	USE_OPLINE
9040 	zend_free_op free_op1;
9041 	zval *expr_ptr;
9042 
9043 	SAVE_OPLINE();
9044 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9045 		zval **expr_ptr_ptr = NULL;
9046 
9047 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
9048 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
9049 		}
9050 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
9051 		expr_ptr = *expr_ptr_ptr;
9052 		Z_ADDREF_P(expr_ptr);
9053 	} else {
9054 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9055 		if (1) { /* temporary variable */
9056 			zval *new_expr;
9057 
9058 			ALLOC_ZVAL(new_expr);
9059 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9060 			expr_ptr = new_expr;
9061 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
9062 			zval *new_expr;
9063 
9064 			ALLOC_ZVAL(new_expr);
9065 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9066 			expr_ptr = new_expr;
9067 			zendi_zval_copy_ctor(*expr_ptr);
9068 		} else {
9069 			Z_ADDREF_P(expr_ptr);
9070 		}
9071 	}
9072 
9073 	if (IS_CONST != IS_UNUSED) {
9074 
9075 		zval *offset = opline->op2.zv;
9076 		ulong hval;
9077 
9078 		switch (Z_TYPE_P(offset)) {
9079 			case IS_DOUBLE:
9080 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
9081 				goto num_index;
9082 			case IS_LONG:
9083 			case IS_BOOL:
9084 				hval = Z_LVAL_P(offset);
9085 num_index:
9086 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
9087 				break;
9088 			case IS_STRING:
9089 				if (IS_CONST == IS_CONST) {
9090 					hval = Z_HASH_P(offset);
9091 				} else {
9092 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
9093 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
9094 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
9095 					} else {
9096 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
9097 					}
9098 				}
9099 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
9100 				break;
9101 			case IS_NULL:
9102 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
9103 				break;
9104 			default:
9105 				zend_error(E_WARNING, "Illegal offset type");
9106 				zval_ptr_dtor(&expr_ptr);
9107 				/* do nothing */
9108 				break;
9109 		}
9110 
9111 	} else {
9112 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
9113 	}
9114 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9115 
9116 	} else {
9117 
9118 	}
9119 	CHECK_EXCEPTION();
9120 	ZEND_VM_NEXT_OPCODE();
9121 }
9122 
ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9123 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9124 {
9125 	USE_OPLINE
9126 
9127 	array_init(&EX_T(opline->result.var).tmp_var);
9128 	if (IS_TMP_VAR == IS_UNUSED) {
9129 		ZEND_VM_NEXT_OPCODE();
9130 #if 0 || IS_TMP_VAR != IS_UNUSED
9131 	} else {
9132 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9133 #endif
9134 	}
9135 }
9136 
ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9137 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9138 {
9139 	USE_OPLINE
9140 	zval tmp, *varname;
9141 	HashTable *target_symbol_table;
9142 	zend_free_op free_op1;
9143 
9144 	SAVE_OPLINE();
9145 	if (IS_TMP_VAR == IS_CV &&
9146 	    IS_CONST == IS_UNUSED &&
9147 	    (opline->extended_value & ZEND_QUICK_SET)) {
9148 		if (EG(active_symbol_table)) {
9149 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9150 
9151 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
9152 			EX_CV(opline->op1.var) = NULL;
9153 		} else if (EX_CV(opline->op1.var)) {
9154 			zval_ptr_dtor(EX_CV(opline->op1.var));
9155 			EX_CV(opline->op1.var) = NULL;
9156 		}
9157 		CHECK_EXCEPTION();
9158 		ZEND_VM_NEXT_OPCODE();
9159 	}
9160 
9161 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9162 
9163 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
9164 		ZVAL_COPY_VALUE(&tmp, varname);
9165 		zval_copy_ctor(&tmp);
9166 		convert_to_string(&tmp);
9167 		varname = &tmp;
9168 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9169 		Z_ADDREF_P(varname);
9170 	}
9171 
9172 	if (IS_CONST != IS_UNUSED) {
9173 		zend_class_entry *ce;
9174 
9175 		if (IS_CONST == IS_CONST) {
9176 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9177 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
9178 			} else {
9179 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9180 				if (UNEXPECTED(EG(exception) != NULL)) {
9181 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9182 						zval_dtor(&tmp);
9183 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9184 						zval_ptr_dtor(&varname);
9185 					}
9186 					zval_dtor(free_op1.var);
9187 					HANDLE_EXCEPTION();
9188 				}
9189 				if (UNEXPECTED(ce == NULL)) {
9190 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
9191 				}
9192 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
9193 			}
9194 		} else {
9195 			ce = EX_T(opline->op2.var).class_entry;
9196 		}
9197 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9198 	} else {
9199 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
9200 
9201 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9202 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
9203 	}
9204 
9205 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9206 		zval_dtor(&tmp);
9207 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
9208 		zval_ptr_dtor(&varname);
9209 	}
9210 	zval_dtor(free_op1.var);
9211 	CHECK_EXCEPTION();
9212 	ZEND_VM_NEXT_OPCODE();
9213 }
9214 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9215 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9216 {
9217 	USE_OPLINE
9218 	zval **value;
9219 	zend_bool isset = 1;
9220 
9221 	SAVE_OPLINE();
9222 	if (IS_TMP_VAR == IS_CV &&
9223 	    IS_CONST == IS_UNUSED &&
9224 	    (opline->extended_value & ZEND_QUICK_SET)) {
9225 		if (EX_CV(opline->op1.var)) {
9226 			value = EX_CV(opline->op1.var);
9227 		} else if (EG(active_symbol_table)) {
9228 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
9229 
9230 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
9231 				isset = 0;
9232 			}
9233 		} else {
9234 			isset = 0;
9235 		}
9236 	} else {
9237 		HashTable *target_symbol_table;
9238 		zend_free_op free_op1;
9239 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9240 
9241 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
9242 			ZVAL_COPY_VALUE(&tmp, varname);
9243 			zval_copy_ctor(&tmp);
9244 			convert_to_string(&tmp);
9245 			varname = &tmp;
9246 		}
9247 
9248 		if (IS_CONST != IS_UNUSED) {
9249 			zend_class_entry *ce;
9250 
9251 			if (IS_CONST == IS_CONST) {
9252 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
9253 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
9254 				} else {
9255 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
9256 					if (UNEXPECTED(ce == NULL)) {
9257 						CHECK_EXCEPTION();
9258 						ZEND_VM_NEXT_OPCODE();
9259 					}
9260 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
9261 				}
9262 			} else {
9263 				ce = EX_T(opline->op2.var).class_entry;
9264 			}
9265 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
9266 			if (!value) {
9267 				isset = 0;
9268 			}
9269 		} else {
9270 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
9271 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
9272 				isset = 0;
9273 			}
9274 		}
9275 
9276 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
9277 			zval_dtor(&tmp);
9278 		}
9279 		zval_dtor(free_op1.var);
9280 	}
9281 
9282 	if (opline->extended_value & ZEND_ISSET) {
9283 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
9284 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
9285 		} else {
9286 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
9287 		}
9288 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
9289 		if (!isset || !i_zend_is_true(*value)) {
9290 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
9291 		} else {
9292 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
9293 		}
9294 	}
9295 
9296 	CHECK_EXCEPTION();
9297 	ZEND_VM_NEXT_OPCODE();
9298 }
9299 
ZEND_YIELD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9300 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9301 {
9302 	USE_OPLINE
9303 
9304 	/* The generator object is stored in return_value_ptr_ptr */
9305 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
9306 
9307 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
9308 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
9309 	}
9310 
9311 	/* Destroy the previously yielded value */
9312 	if (generator->value) {
9313 		zval_ptr_dtor(&generator->value);
9314 	}
9315 
9316 	/* Destroy the previously yielded key */
9317 	if (generator->key) {
9318 		zval_ptr_dtor(&generator->key);
9319 	}
9320 
9321 	/* Set the new yielded value */
9322 	if (IS_TMP_VAR != IS_UNUSED) {
9323 		zend_free_op free_op1;
9324 
9325 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
9326 			/* Constants and temporary variables aren't yieldable by reference,
9327 			 * but we still allow them with a notice. */
9328 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
9329 				zval *value, *copy;
9330 
9331 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
9332 
9333 				value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9334 				ALLOC_ZVAL(copy);
9335 				INIT_PZVAL_COPY(copy, value);
9336 
9337 				/* Temporary variables don't need ctor copying */
9338 				if (!1) {
9339 					zval_copy_ctor(copy);
9340 				}
9341 
9342 				generator->value = copy;
9343 			} else {
9344 				zval **value_ptr = NULL;
9345 
9346 				if (IS_TMP_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
9347 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
9348 				}
9349 
9350 				/* If a function call result is yielded and the function did
9351 				 * not return by reference we throw a notice. */
9352 				if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
9353 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
9354 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
9355 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
9356 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
9357 
9358 					Z_ADDREF_PP(value_ptr);
9359 					generator->value = *value_ptr;
9360 				} else {
9361 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
9362 					Z_ADDREF_PP(value_ptr);
9363 					generator->value = *value_ptr;
9364 				}
9365 
9366 			}
9367 		} else {
9368 			zval *value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9369 
9370 			/* Consts, temporary variables and references need copying */
9371 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
9372 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
9373 			) {
9374 				zval *copy;
9375 
9376 				ALLOC_ZVAL(copy);
9377 				INIT_PZVAL_COPY(copy, value);
9378 
9379 				/* Temporary variables don't need ctor copying */
9380 				if (!1) {
9381 					zval_copy_ctor(copy);
9382 				}
9383 
9384 				generator->value = copy;
9385 			} else {
9386 				Z_ADDREF_P(value);
9387 				generator->value = value;
9388 			}
9389 
9390 		}
9391 	} else {
9392 		/* If no value was specified yield null */
9393 		Z_ADDREF(EG(uninitialized_zval));
9394 		generator->value = &EG(uninitialized_zval);
9395 	}
9396 
9397 	/* Set the new yielded key */
9398 	if (IS_CONST != IS_UNUSED) {
9399 
9400 		zval *key = opline->op2.zv;
9401 
9402 		/* Consts, temporary variables and references need copying */
9403 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
9404 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
9405 		) {
9406 			zval *copy;
9407 
9408 			ALLOC_ZVAL(copy);
9409 			INIT_PZVAL_COPY(copy, key);
9410 
9411 			/* Temporary variables don't need ctor copying */
9412 			if (!0) {
9413 				zval_copy_ctor(copy);
9414 			}
9415 
9416 			generator->key = copy;
9417 		} else {
9418 			Z_ADDREF_P(key);
9419 			generator->key = key;
9420 		}
9421 
9422 		if (Z_TYPE_P(generator->key) == IS_LONG
9423 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
9424 		) {
9425 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
9426 		}
9427 
9428 	} else {
9429 		/* If no key was specified we use auto-increment keys */
9430 		generator->largest_used_integer_key++;
9431 
9432 		ALLOC_INIT_ZVAL(generator->key);
9433 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
9434 	}
9435 
9436 	if (RETURN_VALUE_USED(opline)) {
9437 		/* If the return value of yield is used set the send
9438 		 * target and initialize it to NULL */
9439 		generator->send_target = &EX_T(opline->result.var).var.ptr;
9440 		Z_ADDREF(EG(uninitialized_zval));
9441 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
9442 	} else {
9443 		generator->send_target = NULL;
9444 	}
9445 
9446 	/* We increment to the next op, so we are at the correct position when the
9447 	 * generator is resumed. */
9448 	ZEND_VM_INC_OPCODE();
9449 
9450 	/* The GOTO VM uses a local opline variable. We need to set the opline
9451 	 * variable in execute_data so we don't resume at an old position. */
9452 	SAVE_OPLINE();
9453 
9454 	ZEND_VM_RETURN();
9455 }
9456 
ZEND_ADD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9457 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9458 {
9459 	USE_OPLINE
9460 	zend_free_op free_op1, free_op2;
9461 
9462 	SAVE_OPLINE();
9463 	fast_add_function(&EX_T(opline->result.var).tmp_var,
9464 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9465 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9466 	zval_dtor(free_op1.var);
9467 	zval_dtor(free_op2.var);
9468 	CHECK_EXCEPTION();
9469 	ZEND_VM_NEXT_OPCODE();
9470 }
9471 
ZEND_SUB_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9472 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9473 {
9474 	USE_OPLINE
9475 	zend_free_op free_op1, free_op2;
9476 
9477 	SAVE_OPLINE();
9478 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
9479 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9480 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9481 	zval_dtor(free_op1.var);
9482 	zval_dtor(free_op2.var);
9483 	CHECK_EXCEPTION();
9484 	ZEND_VM_NEXT_OPCODE();
9485 }
9486 
ZEND_MUL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9487 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9488 {
9489 	USE_OPLINE
9490 	zend_free_op free_op1, free_op2;
9491 
9492 	SAVE_OPLINE();
9493 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
9494 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9495 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9496 	zval_dtor(free_op1.var);
9497 	zval_dtor(free_op2.var);
9498 	CHECK_EXCEPTION();
9499 	ZEND_VM_NEXT_OPCODE();
9500 }
9501 
ZEND_DIV_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9502 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9503 {
9504 	USE_OPLINE
9505 	zend_free_op free_op1, free_op2;
9506 
9507 	SAVE_OPLINE();
9508 	fast_div_function(&EX_T(opline->result.var).tmp_var,
9509 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9510 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9511 	zval_dtor(free_op1.var);
9512 	zval_dtor(free_op2.var);
9513 	CHECK_EXCEPTION();
9514 	ZEND_VM_NEXT_OPCODE();
9515 }
9516 
ZEND_MOD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9517 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9518 {
9519 	USE_OPLINE
9520 	zend_free_op free_op1, free_op2;
9521 
9522 	SAVE_OPLINE();
9523 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
9524 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9525 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9526 	zval_dtor(free_op1.var);
9527 	zval_dtor(free_op2.var);
9528 	CHECK_EXCEPTION();
9529 	ZEND_VM_NEXT_OPCODE();
9530 }
9531 
ZEND_SL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9532 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9533 {
9534 	USE_OPLINE
9535 	zend_free_op free_op1, free_op2;
9536 
9537 	SAVE_OPLINE();
9538 	shift_left_function(&EX_T(opline->result.var).tmp_var,
9539 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9540 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9541 	zval_dtor(free_op1.var);
9542 	zval_dtor(free_op2.var);
9543 	CHECK_EXCEPTION();
9544 	ZEND_VM_NEXT_OPCODE();
9545 }
9546 
ZEND_SR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9547 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9548 {
9549 	USE_OPLINE
9550 	zend_free_op free_op1, free_op2;
9551 
9552 	SAVE_OPLINE();
9553 	shift_right_function(&EX_T(opline->result.var).tmp_var,
9554 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9555 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9556 	zval_dtor(free_op1.var);
9557 	zval_dtor(free_op2.var);
9558 	CHECK_EXCEPTION();
9559 	ZEND_VM_NEXT_OPCODE();
9560 }
9561 
ZEND_CONCAT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9562 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9563 {
9564 	USE_OPLINE
9565 	zend_free_op free_op1, free_op2;
9566 
9567 	SAVE_OPLINE();
9568 	concat_function(&EX_T(opline->result.var).tmp_var,
9569 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9570 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9571 	zval_dtor(free_op1.var);
9572 	zval_dtor(free_op2.var);
9573 	CHECK_EXCEPTION();
9574 	ZEND_VM_NEXT_OPCODE();
9575 }
9576 
ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9577 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9578 {
9579 	USE_OPLINE
9580 	zend_free_op free_op1, free_op2;
9581 
9582 	SAVE_OPLINE();
9583 	is_identical_function(&EX_T(opline->result.var).tmp_var,
9584 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9585 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9586 	zval_dtor(free_op1.var);
9587 	zval_dtor(free_op2.var);
9588 	CHECK_EXCEPTION();
9589 	ZEND_VM_NEXT_OPCODE();
9590 }
9591 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9592 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9593 {
9594 	USE_OPLINE
9595 	zend_free_op free_op1, free_op2;
9596 	zval *result = &EX_T(opline->result.var).tmp_var;
9597 
9598 	SAVE_OPLINE();
9599 	is_identical_function(result,
9600 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9601 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9602 	Z_LVAL_P(result) = !Z_LVAL_P(result);
9603 	zval_dtor(free_op1.var);
9604 	zval_dtor(free_op2.var);
9605 	CHECK_EXCEPTION();
9606 	ZEND_VM_NEXT_OPCODE();
9607 }
9608 
ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9609 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9610 {
9611 	USE_OPLINE
9612 	zend_free_op free_op1, free_op2;
9613 	zval *result = &EX_T(opline->result.var).tmp_var;
9614 
9615 	SAVE_OPLINE();
9616 	ZVAL_BOOL(result, fast_equal_function(result,
9617 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9618 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
9619 	zval_dtor(free_op1.var);
9620 	zval_dtor(free_op2.var);
9621 	CHECK_EXCEPTION();
9622 	ZEND_VM_NEXT_OPCODE();
9623 }
9624 
ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9625 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9626 {
9627 	USE_OPLINE
9628 	zend_free_op free_op1, free_op2;
9629 	zval *result = &EX_T(opline->result.var).tmp_var;
9630 
9631 	SAVE_OPLINE();
9632 	ZVAL_BOOL(result, fast_not_equal_function(result,
9633 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9634 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
9635 	zval_dtor(free_op1.var);
9636 	zval_dtor(free_op2.var);
9637 	CHECK_EXCEPTION();
9638 	ZEND_VM_NEXT_OPCODE();
9639 }
9640 
ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9641 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9642 {
9643 	USE_OPLINE
9644 	zend_free_op free_op1, free_op2;
9645 	zval *result = &EX_T(opline->result.var).tmp_var;
9646 
9647 	SAVE_OPLINE();
9648 	ZVAL_BOOL(result, fast_is_smaller_function(result,
9649 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9650 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
9651 	zval_dtor(free_op1.var);
9652 	zval_dtor(free_op2.var);
9653 	CHECK_EXCEPTION();
9654 	ZEND_VM_NEXT_OPCODE();
9655 }
9656 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9657 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9658 {
9659 	USE_OPLINE
9660 	zend_free_op free_op1, free_op2;
9661 	zval *result = &EX_T(opline->result.var).tmp_var;
9662 
9663 	SAVE_OPLINE();
9664 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
9665 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9666 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
9667 	zval_dtor(free_op1.var);
9668 	zval_dtor(free_op2.var);
9669 	CHECK_EXCEPTION();
9670 	ZEND_VM_NEXT_OPCODE();
9671 }
9672 
ZEND_BW_OR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9673 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9674 {
9675 	USE_OPLINE
9676 	zend_free_op free_op1, free_op2;
9677 
9678 	SAVE_OPLINE();
9679 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
9680 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9681 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9682 	zval_dtor(free_op1.var);
9683 	zval_dtor(free_op2.var);
9684 	CHECK_EXCEPTION();
9685 	ZEND_VM_NEXT_OPCODE();
9686 }
9687 
ZEND_BW_AND_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9688 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9689 {
9690 	USE_OPLINE
9691 	zend_free_op free_op1, free_op2;
9692 
9693 	SAVE_OPLINE();
9694 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
9695 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9696 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9697 	zval_dtor(free_op1.var);
9698 	zval_dtor(free_op2.var);
9699 	CHECK_EXCEPTION();
9700 	ZEND_VM_NEXT_OPCODE();
9701 }
9702 
ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9703 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9704 {
9705 	USE_OPLINE
9706 	zend_free_op free_op1, free_op2;
9707 
9708 	SAVE_OPLINE();
9709 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
9710 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9711 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9712 	zval_dtor(free_op1.var);
9713 	zval_dtor(free_op2.var);
9714 	CHECK_EXCEPTION();
9715 	ZEND_VM_NEXT_OPCODE();
9716 }
9717 
ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9718 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9719 {
9720 	USE_OPLINE
9721 	zend_free_op free_op1, free_op2;
9722 
9723 	SAVE_OPLINE();
9724 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
9725 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9726 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9727 	zval_dtor(free_op1.var);
9728 	zval_dtor(free_op2.var);
9729 	CHECK_EXCEPTION();
9730 	ZEND_VM_NEXT_OPCODE();
9731 }
9732 
ZEND_FETCH_DIM_R_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9733 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9734 {
9735 	USE_OPLINE
9736 	zend_free_op free_op1, free_op2;
9737 	zval *container;
9738 
9739 	SAVE_OPLINE();
9740 
9741 	if (IS_TMP_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
9742 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
9743 	}
9744 	container = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9745 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
9746 	zval_dtor(free_op2.var);
9747 	zval_dtor(free_op1.var);
9748 	CHECK_EXCEPTION();
9749 	ZEND_VM_NEXT_OPCODE();
9750 }
9751 
ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9752 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9753 {
9754 	USE_OPLINE
9755 	zend_free_op free_op2;
9756 	zval *str = &EX_T(opline->result.var).tmp_var;
9757 	zval *var;
9758 	zval var_copy;
9759 	int use_copy = 0;
9760 
9761 	SAVE_OPLINE();
9762 	var = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
9763 
9764 	if (IS_TMP_VAR == IS_UNUSED) {
9765 		/* Initialize for erealloc in add_string_to_string */
9766 		Z_STRVAL_P(str) = NULL;
9767 		Z_STRLEN_P(str) = 0;
9768 		Z_TYPE_P(str) = IS_STRING;
9769 
9770 		INIT_PZVAL(str);
9771 	}
9772 
9773 	if (Z_TYPE_P(var) != IS_STRING) {
9774 		zend_make_printable_zval(var, &var_copy, &use_copy);
9775 
9776 		if (use_copy) {
9777 			var = &var_copy;
9778 		}
9779 	}
9780 	add_string_to_string(str, str, var);
9781 
9782 	if (use_copy) {
9783 		zval_dtor(var);
9784 	}
9785 	/* original comment, possibly problematic:
9786 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
9787 	 * (Zeev):  I don't think it's problematic, we only use variables
9788 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
9789 	 * string offsets or overloaded objects
9790 	 */
9791 	zval_dtor(free_op2.var);
9792 
9793 	CHECK_EXCEPTION();
9794 	ZEND_VM_NEXT_OPCODE();
9795 }
9796 
ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9797 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9798 {
9799 	USE_OPLINE
9800 	zval *function_name;
9801 	char *function_name_strval;
9802 	int function_name_strlen;
9803 	zend_free_op free_op1, free_op2;
9804 	call_slot *call = EX(call_slots) + opline->result.num;
9805 
9806 	SAVE_OPLINE();
9807 
9808 	function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
9809 
9810 	if (IS_TMP_VAR != IS_CONST &&
9811 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
9812 		if (UNEXPECTED(EG(exception) != NULL)) {
9813 			HANDLE_EXCEPTION();
9814 		}
9815 		zend_error_noreturn(E_ERROR, "Method name must be a string");
9816 	}
9817 
9818 	function_name_strval = Z_STRVAL_P(function_name);
9819 	function_name_strlen = Z_STRLEN_P(function_name);
9820 
9821 	call->object = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9822 
9823 	if (EXPECTED(call->object != NULL) &&
9824 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
9825 		call->called_scope = Z_OBJCE_P(call->object);
9826 
9827 		if (IS_TMP_VAR != IS_CONST ||
9828 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
9829 		    zval *object = call->object;
9830 
9831 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
9832 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
9833 			}
9834 
9835 			/* First, locate the function. */
9836 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
9837 			if (UNEXPECTED(call->fbc == NULL)) {
9838 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
9839 			}
9840 			if (IS_TMP_VAR == IS_CONST &&
9841 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
9842 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
9843 			    EXPECTED(call->object == object)) {
9844 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
9845 			}
9846 		}
9847 	} else {
9848 		if (UNEXPECTED(EG(exception) != NULL)) {
9849 			zval_dtor(free_op2.var);
9850 			HANDLE_EXCEPTION();
9851 		}
9852 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
9853 	}
9854 
9855 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
9856 		call->object = NULL;
9857 	} else {
9858 		if (!PZVAL_IS_REF(call->object)) {
9859 			Z_ADDREF_P(call->object); /* For $this pointer */
9860 		} else {
9861 			zval *this_ptr;
9862 			ALLOC_ZVAL(this_ptr);
9863 			INIT_PZVAL_COPY(this_ptr, call->object);
9864 			zval_copy_ctor(this_ptr);
9865 			call->object = this_ptr;
9866 		}
9867 	}
9868 	call->is_ctor_call = 0;
9869 	EX(call) = call;
9870 
9871 	zval_dtor(free_op2.var);
9872 
9873 	CHECK_EXCEPTION();
9874 	ZEND_VM_NEXT_OPCODE();
9875 }
9876 
ZEND_CASE_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9877 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9878 {
9879 	USE_OPLINE
9880 	zend_free_op free_op1, free_op2;
9881 
9882 	SAVE_OPLINE();
9883 	if (IS_TMP_VAR==IS_VAR) {
9884 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
9885 	}
9886 	is_equal_function(&EX_T(opline->result.var).tmp_var,
9887 				 _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
9888 				 _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
9889 
9890 	zval_dtor(free_op2.var);
9891 	CHECK_EXCEPTION();
9892 	ZEND_VM_NEXT_OPCODE();
9893 }
9894 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9895 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9896 {
9897 	USE_OPLINE
9898 	zend_free_op free_op1;
9899 	zval *expr_ptr;
9900 
9901 	SAVE_OPLINE();
9902 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9903 		zval **expr_ptr_ptr = NULL;
9904 
9905 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
9906 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
9907 		}
9908 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
9909 		expr_ptr = *expr_ptr_ptr;
9910 		Z_ADDREF_P(expr_ptr);
9911 	} else {
9912 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
9913 		if (1) { /* temporary variable */
9914 			zval *new_expr;
9915 
9916 			ALLOC_ZVAL(new_expr);
9917 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9918 			expr_ptr = new_expr;
9919 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
9920 			zval *new_expr;
9921 
9922 			ALLOC_ZVAL(new_expr);
9923 			INIT_PZVAL_COPY(new_expr, expr_ptr);
9924 			expr_ptr = new_expr;
9925 			zendi_zval_copy_ctor(*expr_ptr);
9926 		} else {
9927 			Z_ADDREF_P(expr_ptr);
9928 		}
9929 	}
9930 
9931 	if (IS_TMP_VAR != IS_UNUSED) {
9932 		zend_free_op free_op2;
9933 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
9934 		ulong hval;
9935 
9936 		switch (Z_TYPE_P(offset)) {
9937 			case IS_DOUBLE:
9938 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
9939 				goto num_index;
9940 			case IS_LONG:
9941 			case IS_BOOL:
9942 				hval = Z_LVAL_P(offset);
9943 num_index:
9944 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
9945 				break;
9946 			case IS_STRING:
9947 				if (IS_TMP_VAR == IS_CONST) {
9948 					hval = Z_HASH_P(offset);
9949 				} else {
9950 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
9951 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
9952 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
9953 					} else {
9954 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
9955 					}
9956 				}
9957 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
9958 				break;
9959 			case IS_NULL:
9960 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
9961 				break;
9962 			default:
9963 				zend_error(E_WARNING, "Illegal offset type");
9964 				zval_ptr_dtor(&expr_ptr);
9965 				/* do nothing */
9966 				break;
9967 		}
9968 		zval_dtor(free_op2.var);
9969 	} else {
9970 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
9971 	}
9972 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
9973 
9974 	} else {
9975 
9976 	}
9977 	CHECK_EXCEPTION();
9978 	ZEND_VM_NEXT_OPCODE();
9979 }
9980 
ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9981 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9982 {
9983 	USE_OPLINE
9984 
9985 	array_init(&EX_T(opline->result.var).tmp_var);
9986 	if (IS_TMP_VAR == IS_UNUSED) {
9987 		ZEND_VM_NEXT_OPCODE();
9988 #if 0 || IS_TMP_VAR != IS_UNUSED
9989 	} else {
9990 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
9991 #endif
9992 	}
9993 }
9994 
ZEND_YIELD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)9995 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
9996 {
9997 	USE_OPLINE
9998 
9999 	/* The generator object is stored in return_value_ptr_ptr */
10000 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
10001 
10002 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
10003 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
10004 	}
10005 
10006 	/* Destroy the previously yielded value */
10007 	if (generator->value) {
10008 		zval_ptr_dtor(&generator->value);
10009 	}
10010 
10011 	/* Destroy the previously yielded key */
10012 	if (generator->key) {
10013 		zval_ptr_dtor(&generator->key);
10014 	}
10015 
10016 	/* Set the new yielded value */
10017 	if (IS_TMP_VAR != IS_UNUSED) {
10018 		zend_free_op free_op1;
10019 
10020 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
10021 			/* Constants and temporary variables aren't yieldable by reference,
10022 			 * but we still allow them with a notice. */
10023 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
10024 				zval *value, *copy;
10025 
10026 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
10027 
10028 				value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10029 				ALLOC_ZVAL(copy);
10030 				INIT_PZVAL_COPY(copy, value);
10031 
10032 				/* Temporary variables don't need ctor copying */
10033 				if (!1) {
10034 					zval_copy_ctor(copy);
10035 				}
10036 
10037 				generator->value = copy;
10038 			} else {
10039 				zval **value_ptr = NULL;
10040 
10041 				if (IS_TMP_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
10042 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
10043 				}
10044 
10045 				/* If a function call result is yielded and the function did
10046 				 * not return by reference we throw a notice. */
10047 				if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
10048 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
10049 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
10050 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
10051 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
10052 
10053 					Z_ADDREF_PP(value_ptr);
10054 					generator->value = *value_ptr;
10055 				} else {
10056 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
10057 					Z_ADDREF_PP(value_ptr);
10058 					generator->value = *value_ptr;
10059 				}
10060 
10061 			}
10062 		} else {
10063 			zval *value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10064 
10065 			/* Consts, temporary variables and references need copying */
10066 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
10067 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
10068 			) {
10069 				zval *copy;
10070 
10071 				ALLOC_ZVAL(copy);
10072 				INIT_PZVAL_COPY(copy, value);
10073 
10074 				/* Temporary variables don't need ctor copying */
10075 				if (!1) {
10076 					zval_copy_ctor(copy);
10077 				}
10078 
10079 				generator->value = copy;
10080 			} else {
10081 				Z_ADDREF_P(value);
10082 				generator->value = value;
10083 			}
10084 
10085 		}
10086 	} else {
10087 		/* If no value was specified yield null */
10088 		Z_ADDREF(EG(uninitialized_zval));
10089 		generator->value = &EG(uninitialized_zval);
10090 	}
10091 
10092 	/* Set the new yielded key */
10093 	if (IS_TMP_VAR != IS_UNUSED) {
10094 		zend_free_op free_op2;
10095 		zval *key = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
10096 
10097 		/* Consts, temporary variables and references need copying */
10098 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
10099 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
10100 		) {
10101 			zval *copy;
10102 
10103 			ALLOC_ZVAL(copy);
10104 			INIT_PZVAL_COPY(copy, key);
10105 
10106 			/* Temporary variables don't need ctor copying */
10107 			if (!1) {
10108 				zval_copy_ctor(copy);
10109 			}
10110 
10111 			generator->key = copy;
10112 		} else {
10113 			Z_ADDREF_P(key);
10114 			generator->key = key;
10115 		}
10116 
10117 		if (Z_TYPE_P(generator->key) == IS_LONG
10118 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
10119 		) {
10120 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
10121 		}
10122 
10123 	} else {
10124 		/* If no key was specified we use auto-increment keys */
10125 		generator->largest_used_integer_key++;
10126 
10127 		ALLOC_INIT_ZVAL(generator->key);
10128 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
10129 	}
10130 
10131 	if (RETURN_VALUE_USED(opline)) {
10132 		/* If the return value of yield is used set the send
10133 		 * target and initialize it to NULL */
10134 		generator->send_target = &EX_T(opline->result.var).var.ptr;
10135 		Z_ADDREF(EG(uninitialized_zval));
10136 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
10137 	} else {
10138 		generator->send_target = NULL;
10139 	}
10140 
10141 	/* We increment to the next op, so we are at the correct position when the
10142 	 * generator is resumed. */
10143 	ZEND_VM_INC_OPCODE();
10144 
10145 	/* The GOTO VM uses a local opline variable. We need to set the opline
10146 	 * variable in execute_data so we don't resume at an old position. */
10147 	SAVE_OPLINE();
10148 
10149 	ZEND_VM_RETURN();
10150 }
10151 
ZEND_ADD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10152 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10153 {
10154 	USE_OPLINE
10155 	zend_free_op free_op1, free_op2;
10156 
10157 	SAVE_OPLINE();
10158 	fast_add_function(&EX_T(opline->result.var).tmp_var,
10159 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10160 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10161 	zval_dtor(free_op1.var);
10162 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10163 	CHECK_EXCEPTION();
10164 	ZEND_VM_NEXT_OPCODE();
10165 }
10166 
ZEND_SUB_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10167 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10168 {
10169 	USE_OPLINE
10170 	zend_free_op free_op1, free_op2;
10171 
10172 	SAVE_OPLINE();
10173 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
10174 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10175 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10176 	zval_dtor(free_op1.var);
10177 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10178 	CHECK_EXCEPTION();
10179 	ZEND_VM_NEXT_OPCODE();
10180 }
10181 
ZEND_MUL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10182 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10183 {
10184 	USE_OPLINE
10185 	zend_free_op free_op1, free_op2;
10186 
10187 	SAVE_OPLINE();
10188 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
10189 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10190 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10191 	zval_dtor(free_op1.var);
10192 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10193 	CHECK_EXCEPTION();
10194 	ZEND_VM_NEXT_OPCODE();
10195 }
10196 
ZEND_DIV_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10197 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10198 {
10199 	USE_OPLINE
10200 	zend_free_op free_op1, free_op2;
10201 
10202 	SAVE_OPLINE();
10203 	fast_div_function(&EX_T(opline->result.var).tmp_var,
10204 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10205 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10206 	zval_dtor(free_op1.var);
10207 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10208 	CHECK_EXCEPTION();
10209 	ZEND_VM_NEXT_OPCODE();
10210 }
10211 
ZEND_MOD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10212 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10213 {
10214 	USE_OPLINE
10215 	zend_free_op free_op1, free_op2;
10216 
10217 	SAVE_OPLINE();
10218 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
10219 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10220 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10221 	zval_dtor(free_op1.var);
10222 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10223 	CHECK_EXCEPTION();
10224 	ZEND_VM_NEXT_OPCODE();
10225 }
10226 
ZEND_SL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10227 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10228 {
10229 	USE_OPLINE
10230 	zend_free_op free_op1, free_op2;
10231 
10232 	SAVE_OPLINE();
10233 	shift_left_function(&EX_T(opline->result.var).tmp_var,
10234 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10235 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10236 	zval_dtor(free_op1.var);
10237 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10238 	CHECK_EXCEPTION();
10239 	ZEND_VM_NEXT_OPCODE();
10240 }
10241 
ZEND_SR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10242 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10243 {
10244 	USE_OPLINE
10245 	zend_free_op free_op1, free_op2;
10246 
10247 	SAVE_OPLINE();
10248 	shift_right_function(&EX_T(opline->result.var).tmp_var,
10249 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10250 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10251 	zval_dtor(free_op1.var);
10252 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10253 	CHECK_EXCEPTION();
10254 	ZEND_VM_NEXT_OPCODE();
10255 }
10256 
ZEND_CONCAT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10257 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10258 {
10259 	USE_OPLINE
10260 	zend_free_op free_op1, free_op2;
10261 
10262 	SAVE_OPLINE();
10263 	concat_function(&EX_T(opline->result.var).tmp_var,
10264 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10265 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10266 	zval_dtor(free_op1.var);
10267 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10268 	CHECK_EXCEPTION();
10269 	ZEND_VM_NEXT_OPCODE();
10270 }
10271 
ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10272 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10273 {
10274 	USE_OPLINE
10275 	zend_free_op free_op1, free_op2;
10276 
10277 	SAVE_OPLINE();
10278 	is_identical_function(&EX_T(opline->result.var).tmp_var,
10279 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10280 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10281 	zval_dtor(free_op1.var);
10282 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10283 	CHECK_EXCEPTION();
10284 	ZEND_VM_NEXT_OPCODE();
10285 }
10286 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10287 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10288 {
10289 	USE_OPLINE
10290 	zend_free_op free_op1, free_op2;
10291 	zval *result = &EX_T(opline->result.var).tmp_var;
10292 
10293 	SAVE_OPLINE();
10294 	is_identical_function(result,
10295 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10296 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10297 	Z_LVAL_P(result) = !Z_LVAL_P(result);
10298 	zval_dtor(free_op1.var);
10299 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10300 	CHECK_EXCEPTION();
10301 	ZEND_VM_NEXT_OPCODE();
10302 }
10303 
ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10304 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10305 {
10306 	USE_OPLINE
10307 	zend_free_op free_op1, free_op2;
10308 	zval *result = &EX_T(opline->result.var).tmp_var;
10309 
10310 	SAVE_OPLINE();
10311 	ZVAL_BOOL(result, fast_equal_function(result,
10312 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10313 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
10314 	zval_dtor(free_op1.var);
10315 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10316 	CHECK_EXCEPTION();
10317 	ZEND_VM_NEXT_OPCODE();
10318 }
10319 
ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10320 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10321 {
10322 	USE_OPLINE
10323 	zend_free_op free_op1, free_op2;
10324 	zval *result = &EX_T(opline->result.var).tmp_var;
10325 
10326 	SAVE_OPLINE();
10327 	ZVAL_BOOL(result, fast_not_equal_function(result,
10328 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10329 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
10330 	zval_dtor(free_op1.var);
10331 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10332 	CHECK_EXCEPTION();
10333 	ZEND_VM_NEXT_OPCODE();
10334 }
10335 
ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10336 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10337 {
10338 	USE_OPLINE
10339 	zend_free_op free_op1, free_op2;
10340 	zval *result = &EX_T(opline->result.var).tmp_var;
10341 
10342 	SAVE_OPLINE();
10343 	ZVAL_BOOL(result, fast_is_smaller_function(result,
10344 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10345 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
10346 	zval_dtor(free_op1.var);
10347 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10348 	CHECK_EXCEPTION();
10349 	ZEND_VM_NEXT_OPCODE();
10350 }
10351 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10352 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10353 {
10354 	USE_OPLINE
10355 	zend_free_op free_op1, free_op2;
10356 	zval *result = &EX_T(opline->result.var).tmp_var;
10357 
10358 	SAVE_OPLINE();
10359 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
10360 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10361 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
10362 	zval_dtor(free_op1.var);
10363 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10364 	CHECK_EXCEPTION();
10365 	ZEND_VM_NEXT_OPCODE();
10366 }
10367 
ZEND_BW_OR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10368 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10369 {
10370 	USE_OPLINE
10371 	zend_free_op free_op1, free_op2;
10372 
10373 	SAVE_OPLINE();
10374 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
10375 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10376 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10377 	zval_dtor(free_op1.var);
10378 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10379 	CHECK_EXCEPTION();
10380 	ZEND_VM_NEXT_OPCODE();
10381 }
10382 
ZEND_BW_AND_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10383 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10384 {
10385 	USE_OPLINE
10386 	zend_free_op free_op1, free_op2;
10387 
10388 	SAVE_OPLINE();
10389 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
10390 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10391 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10392 	zval_dtor(free_op1.var);
10393 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10394 	CHECK_EXCEPTION();
10395 	ZEND_VM_NEXT_OPCODE();
10396 }
10397 
ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10398 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10399 {
10400 	USE_OPLINE
10401 	zend_free_op free_op1, free_op2;
10402 
10403 	SAVE_OPLINE();
10404 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
10405 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10406 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10407 	zval_dtor(free_op1.var);
10408 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10409 	CHECK_EXCEPTION();
10410 	ZEND_VM_NEXT_OPCODE();
10411 }
10412 
ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10413 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10414 {
10415 	USE_OPLINE
10416 	zend_free_op free_op1, free_op2;
10417 
10418 	SAVE_OPLINE();
10419 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
10420 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10421 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10422 	zval_dtor(free_op1.var);
10423 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10424 	CHECK_EXCEPTION();
10425 	ZEND_VM_NEXT_OPCODE();
10426 }
10427 
zend_fetch_var_address_helper_SPEC_TMP_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)10428 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
10429 {
10430 	USE_OPLINE
10431 	zend_free_op free_op1;
10432 	zval *varname;
10433 	zval **retval;
10434 	zval tmp_varname;
10435 	HashTable *target_symbol_table;
10436 	ulong hash_value;
10437 
10438 	SAVE_OPLINE();
10439 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10440 
10441  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
10442 		ZVAL_COPY_VALUE(&tmp_varname, varname);
10443 		zval_copy_ctor(&tmp_varname);
10444 		Z_SET_REFCOUNT(tmp_varname, 1);
10445 		Z_UNSET_ISREF(tmp_varname);
10446 		convert_to_string(&tmp_varname);
10447 		varname = &tmp_varname;
10448 	}
10449 
10450 	if (IS_VAR != IS_UNUSED) {
10451 		zend_class_entry *ce;
10452 
10453 		if (IS_VAR == IS_CONST) {
10454 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
10455 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
10456 			} else {
10457 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
10458 				if (UNEXPECTED(ce == NULL)) {
10459 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
10460 						zval_dtor(&tmp_varname);
10461 					}
10462 					zval_dtor(free_op1.var);
10463 					CHECK_EXCEPTION();
10464 					ZEND_VM_NEXT_OPCODE();
10465 				}
10466 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
10467 			}
10468 		} else {
10469 			ce = EX_T(opline->op2.var).class_entry;
10470 		}
10471 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
10472 		zval_dtor(free_op1.var);
10473 	} else {
10474 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
10475 /*
10476 		if (!target_symbol_table) {
10477 			CHECK_EXCEPTION();
10478 			ZEND_VM_NEXT_OPCODE();
10479 		}
10480 */
10481 		if (IS_TMP_VAR == IS_CONST) {
10482 			hash_value = Z_HASH_P(varname);
10483 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
10484 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
10485 		} else {
10486 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
10487 		}
10488 
10489 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
10490 			switch (type) {
10491 				case BP_VAR_R:
10492 				case BP_VAR_UNSET:
10493 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
10494 					/* break missing intentionally */
10495 				case BP_VAR_IS:
10496 					retval = &EG(uninitialized_zval_ptr);
10497 					break;
10498 				case BP_VAR_RW:
10499 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
10500 					/* break missing intentionally */
10501 				case BP_VAR_W:
10502 					Z_ADDREF_P(&EG(uninitialized_zval));
10503 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
10504 					break;
10505 				EMPTY_SWITCH_DEFAULT_CASE()
10506 			}
10507 		}
10508 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
10509 			case ZEND_FETCH_GLOBAL:
10510 				if (IS_TMP_VAR != IS_TMP_VAR) {
10511 					zval_dtor(free_op1.var);
10512 				}
10513 				break;
10514 			case ZEND_FETCH_LOCAL:
10515 				zval_dtor(free_op1.var);
10516 				break;
10517 			case ZEND_FETCH_STATIC:
10518 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
10519 				break;
10520 			case ZEND_FETCH_GLOBAL_LOCK:
10521 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
10522 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
10523 				}
10524 				break;
10525 		}
10526 	}
10527 
10528 
10529 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
10530 		zval_dtor(&tmp_varname);
10531 	}
10532 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
10533 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
10534 	}
10535 	PZVAL_LOCK(*retval);
10536 	switch (type) {
10537 		case BP_VAR_R:
10538 		case BP_VAR_IS:
10539 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
10540 			break;
10541 		case BP_VAR_UNSET: {
10542 			zend_free_op free_res;
10543 
10544 			PZVAL_UNLOCK(*retval, &free_res);
10545 			if (retval != &EG(uninitialized_zval_ptr)) {
10546 				SEPARATE_ZVAL_IF_NOT_REF(retval);
10547 			}
10548 			PZVAL_LOCK(*retval);
10549 			FREE_OP_VAR_PTR(free_res);
10550 		}
10551 		/* break missing intentionally */
10552 		default:
10553 			EX_T(opline->result.var).var.ptr_ptr = retval;
10554 			break;
10555 	}
10556 	CHECK_EXCEPTION();
10557 	ZEND_VM_NEXT_OPCODE();
10558 }
10559 
ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10560 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10561 {
10562 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10563 }
10564 
ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10565 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10566 {
10567 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10568 }
10569 
ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10570 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10571 {
10572 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10573 }
10574 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10575 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10576 {
10577 	USE_OPLINE
10578 
10579 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10580 }
10581 
ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10582 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10583 {
10584 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10585 }
10586 
ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10587 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10588 {
10589 	return zend_fetch_var_address_helper_SPEC_TMP_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10590 }
10591 
ZEND_FETCH_DIM_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10592 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10593 {
10594 	USE_OPLINE
10595 	zend_free_op free_op1, free_op2;
10596 	zval *container;
10597 
10598 	SAVE_OPLINE();
10599 
10600 	if (IS_TMP_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
10601 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
10602 	}
10603 	container = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10604 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
10605 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10606 	zval_dtor(free_op1.var);
10607 	CHECK_EXCEPTION();
10608 	ZEND_VM_NEXT_OPCODE();
10609 }
10610 
ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10611 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10612 {
10613 	USE_OPLINE
10614 	zend_free_op free_op2;
10615 	zval *str = &EX_T(opline->result.var).tmp_var;
10616 	zval *var;
10617 	zval var_copy;
10618 	int use_copy = 0;
10619 
10620 	SAVE_OPLINE();
10621 	var = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
10622 
10623 	if (IS_TMP_VAR == IS_UNUSED) {
10624 		/* Initialize for erealloc in add_string_to_string */
10625 		Z_STRVAL_P(str) = NULL;
10626 		Z_STRLEN_P(str) = 0;
10627 		Z_TYPE_P(str) = IS_STRING;
10628 
10629 		INIT_PZVAL(str);
10630 	}
10631 
10632 	if (Z_TYPE_P(var) != IS_STRING) {
10633 		zend_make_printable_zval(var, &var_copy, &use_copy);
10634 
10635 		if (use_copy) {
10636 			var = &var_copy;
10637 		}
10638 	}
10639 	add_string_to_string(str, str, var);
10640 
10641 	if (use_copy) {
10642 		zval_dtor(var);
10643 	}
10644 	/* original comment, possibly problematic:
10645 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
10646 	 * (Zeev):  I don't think it's problematic, we only use variables
10647 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
10648 	 * string offsets or overloaded objects
10649 	 */
10650 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10651 
10652 	CHECK_EXCEPTION();
10653 	ZEND_VM_NEXT_OPCODE();
10654 }
10655 
ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10656 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10657 {
10658 	USE_OPLINE
10659 	zval *function_name;
10660 	char *function_name_strval;
10661 	int function_name_strlen;
10662 	zend_free_op free_op1, free_op2;
10663 	call_slot *call = EX(call_slots) + opline->result.num;
10664 
10665 	SAVE_OPLINE();
10666 
10667 	function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
10668 
10669 	if (IS_VAR != IS_CONST &&
10670 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
10671 		if (UNEXPECTED(EG(exception) != NULL)) {
10672 			HANDLE_EXCEPTION();
10673 		}
10674 		zend_error_noreturn(E_ERROR, "Method name must be a string");
10675 	}
10676 
10677 	function_name_strval = Z_STRVAL_P(function_name);
10678 	function_name_strlen = Z_STRLEN_P(function_name);
10679 
10680 	call->object = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10681 
10682 	if (EXPECTED(call->object != NULL) &&
10683 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
10684 		call->called_scope = Z_OBJCE_P(call->object);
10685 
10686 		if (IS_VAR != IS_CONST ||
10687 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
10688 		    zval *object = call->object;
10689 
10690 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
10691 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
10692 			}
10693 
10694 			/* First, locate the function. */
10695 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
10696 			if (UNEXPECTED(call->fbc == NULL)) {
10697 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
10698 			}
10699 			if (IS_VAR == IS_CONST &&
10700 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
10701 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
10702 			    EXPECTED(call->object == object)) {
10703 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
10704 			}
10705 		}
10706 	} else {
10707 		if (UNEXPECTED(EG(exception) != NULL)) {
10708 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10709 			HANDLE_EXCEPTION();
10710 		}
10711 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
10712 	}
10713 
10714 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
10715 		call->object = NULL;
10716 	} else {
10717 		if (!PZVAL_IS_REF(call->object)) {
10718 			Z_ADDREF_P(call->object); /* For $this pointer */
10719 		} else {
10720 			zval *this_ptr;
10721 			ALLOC_ZVAL(this_ptr);
10722 			INIT_PZVAL_COPY(this_ptr, call->object);
10723 			zval_copy_ctor(this_ptr);
10724 			call->object = this_ptr;
10725 		}
10726 	}
10727 	call->is_ctor_call = 0;
10728 	EX(call) = call;
10729 
10730 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10731 
10732 	CHECK_EXCEPTION();
10733 	ZEND_VM_NEXT_OPCODE();
10734 }
10735 
ZEND_CASE_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10736 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10737 {
10738 	USE_OPLINE
10739 	zend_free_op free_op1, free_op2;
10740 
10741 	SAVE_OPLINE();
10742 	if (IS_TMP_VAR==IS_VAR) {
10743 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
10744 	}
10745 	is_equal_function(&EX_T(opline->result.var).tmp_var,
10746 				 _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
10747 				 _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
10748 
10749 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10750 	CHECK_EXCEPTION();
10751 	ZEND_VM_NEXT_OPCODE();
10752 }
10753 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10754 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10755 {
10756 	USE_OPLINE
10757 	zend_free_op free_op1;
10758 	zval *expr_ptr;
10759 
10760 	SAVE_OPLINE();
10761 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
10762 		zval **expr_ptr_ptr = NULL;
10763 
10764 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
10765 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
10766 		}
10767 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
10768 		expr_ptr = *expr_ptr_ptr;
10769 		Z_ADDREF_P(expr_ptr);
10770 	} else {
10771 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10772 		if (1) { /* temporary variable */
10773 			zval *new_expr;
10774 
10775 			ALLOC_ZVAL(new_expr);
10776 			INIT_PZVAL_COPY(new_expr, expr_ptr);
10777 			expr_ptr = new_expr;
10778 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
10779 			zval *new_expr;
10780 
10781 			ALLOC_ZVAL(new_expr);
10782 			INIT_PZVAL_COPY(new_expr, expr_ptr);
10783 			expr_ptr = new_expr;
10784 			zendi_zval_copy_ctor(*expr_ptr);
10785 		} else {
10786 			Z_ADDREF_P(expr_ptr);
10787 		}
10788 	}
10789 
10790 	if (IS_VAR != IS_UNUSED) {
10791 		zend_free_op free_op2;
10792 		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
10793 		ulong hval;
10794 
10795 		switch (Z_TYPE_P(offset)) {
10796 			case IS_DOUBLE:
10797 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
10798 				goto num_index;
10799 			case IS_LONG:
10800 			case IS_BOOL:
10801 				hval = Z_LVAL_P(offset);
10802 num_index:
10803 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
10804 				break;
10805 			case IS_STRING:
10806 				if (IS_VAR == IS_CONST) {
10807 					hval = Z_HASH_P(offset);
10808 				} else {
10809 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
10810 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
10811 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
10812 					} else {
10813 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
10814 					}
10815 				}
10816 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
10817 				break;
10818 			case IS_NULL:
10819 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
10820 				break;
10821 			default:
10822 				zend_error(E_WARNING, "Illegal offset type");
10823 				zval_ptr_dtor(&expr_ptr);
10824 				/* do nothing */
10825 				break;
10826 		}
10827 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
10828 	} else {
10829 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
10830 	}
10831 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
10832 
10833 	} else {
10834 
10835 	}
10836 	CHECK_EXCEPTION();
10837 	ZEND_VM_NEXT_OPCODE();
10838 }
10839 
ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10840 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10841 {
10842 	USE_OPLINE
10843 
10844 	array_init(&EX_T(opline->result.var).tmp_var);
10845 	if (IS_TMP_VAR == IS_UNUSED) {
10846 		ZEND_VM_NEXT_OPCODE();
10847 #if 0 || IS_TMP_VAR != IS_UNUSED
10848 	} else {
10849 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
10850 #endif
10851 	}
10852 }
10853 
ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10854 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10855 {
10856 	USE_OPLINE
10857 	zval tmp, *varname;
10858 	HashTable *target_symbol_table;
10859 	zend_free_op free_op1;
10860 
10861 	SAVE_OPLINE();
10862 	if (IS_TMP_VAR == IS_CV &&
10863 	    IS_VAR == IS_UNUSED &&
10864 	    (opline->extended_value & ZEND_QUICK_SET)) {
10865 		if (EG(active_symbol_table)) {
10866 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
10867 
10868 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
10869 			EX_CV(opline->op1.var) = NULL;
10870 		} else if (EX_CV(opline->op1.var)) {
10871 			zval_ptr_dtor(EX_CV(opline->op1.var));
10872 			EX_CV(opline->op1.var) = NULL;
10873 		}
10874 		CHECK_EXCEPTION();
10875 		ZEND_VM_NEXT_OPCODE();
10876 	}
10877 
10878 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10879 
10880 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
10881 		ZVAL_COPY_VALUE(&tmp, varname);
10882 		zval_copy_ctor(&tmp);
10883 		convert_to_string(&tmp);
10884 		varname = &tmp;
10885 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
10886 		Z_ADDREF_P(varname);
10887 	}
10888 
10889 	if (IS_VAR != IS_UNUSED) {
10890 		zend_class_entry *ce;
10891 
10892 		if (IS_VAR == IS_CONST) {
10893 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
10894 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
10895 			} else {
10896 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
10897 				if (UNEXPECTED(EG(exception) != NULL)) {
10898 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
10899 						zval_dtor(&tmp);
10900 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
10901 						zval_ptr_dtor(&varname);
10902 					}
10903 					zval_dtor(free_op1.var);
10904 					HANDLE_EXCEPTION();
10905 				}
10906 				if (UNEXPECTED(ce == NULL)) {
10907 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
10908 				}
10909 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
10910 			}
10911 		} else {
10912 			ce = EX_T(opline->op2.var).class_entry;
10913 		}
10914 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
10915 	} else {
10916 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
10917 
10918 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
10919 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
10920 	}
10921 
10922 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
10923 		zval_dtor(&tmp);
10924 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
10925 		zval_ptr_dtor(&varname);
10926 	}
10927 	zval_dtor(free_op1.var);
10928 	CHECK_EXCEPTION();
10929 	ZEND_VM_NEXT_OPCODE();
10930 }
10931 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)10932 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
10933 {
10934 	USE_OPLINE
10935 	zval **value;
10936 	zend_bool isset = 1;
10937 
10938 	SAVE_OPLINE();
10939 	if (IS_TMP_VAR == IS_CV &&
10940 	    IS_VAR == IS_UNUSED &&
10941 	    (opline->extended_value & ZEND_QUICK_SET)) {
10942 		if (EX_CV(opline->op1.var)) {
10943 			value = EX_CV(opline->op1.var);
10944 		} else if (EG(active_symbol_table)) {
10945 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
10946 
10947 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
10948 				isset = 0;
10949 			}
10950 		} else {
10951 			isset = 0;
10952 		}
10953 	} else {
10954 		HashTable *target_symbol_table;
10955 		zend_free_op free_op1;
10956 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
10957 
10958 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
10959 			ZVAL_COPY_VALUE(&tmp, varname);
10960 			zval_copy_ctor(&tmp);
10961 			convert_to_string(&tmp);
10962 			varname = &tmp;
10963 		}
10964 
10965 		if (IS_VAR != IS_UNUSED) {
10966 			zend_class_entry *ce;
10967 
10968 			if (IS_VAR == IS_CONST) {
10969 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
10970 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
10971 				} else {
10972 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
10973 					if (UNEXPECTED(ce == NULL)) {
10974 						CHECK_EXCEPTION();
10975 						ZEND_VM_NEXT_OPCODE();
10976 					}
10977 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
10978 				}
10979 			} else {
10980 				ce = EX_T(opline->op2.var).class_entry;
10981 			}
10982 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
10983 			if (!value) {
10984 				isset = 0;
10985 			}
10986 		} else {
10987 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
10988 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
10989 				isset = 0;
10990 			}
10991 		}
10992 
10993 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
10994 			zval_dtor(&tmp);
10995 		}
10996 		zval_dtor(free_op1.var);
10997 	}
10998 
10999 	if (opline->extended_value & ZEND_ISSET) {
11000 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
11001 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
11002 		} else {
11003 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
11004 		}
11005 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
11006 		if (!isset || !i_zend_is_true(*value)) {
11007 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
11008 		} else {
11009 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
11010 		}
11011 	}
11012 
11013 	CHECK_EXCEPTION();
11014 	ZEND_VM_NEXT_OPCODE();
11015 }
11016 
ZEND_YIELD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11017 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11018 {
11019 	USE_OPLINE
11020 
11021 	/* The generator object is stored in return_value_ptr_ptr */
11022 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
11023 
11024 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
11025 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
11026 	}
11027 
11028 	/* Destroy the previously yielded value */
11029 	if (generator->value) {
11030 		zval_ptr_dtor(&generator->value);
11031 	}
11032 
11033 	/* Destroy the previously yielded key */
11034 	if (generator->key) {
11035 		zval_ptr_dtor(&generator->key);
11036 	}
11037 
11038 	/* Set the new yielded value */
11039 	if (IS_TMP_VAR != IS_UNUSED) {
11040 		zend_free_op free_op1;
11041 
11042 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
11043 			/* Constants and temporary variables aren't yieldable by reference,
11044 			 * but we still allow them with a notice. */
11045 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
11046 				zval *value, *copy;
11047 
11048 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
11049 
11050 				value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11051 				ALLOC_ZVAL(copy);
11052 				INIT_PZVAL_COPY(copy, value);
11053 
11054 				/* Temporary variables don't need ctor copying */
11055 				if (!1) {
11056 					zval_copy_ctor(copy);
11057 				}
11058 
11059 				generator->value = copy;
11060 			} else {
11061 				zval **value_ptr = NULL;
11062 
11063 				if (IS_TMP_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
11064 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
11065 				}
11066 
11067 				/* If a function call result is yielded and the function did
11068 				 * not return by reference we throw a notice. */
11069 				if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
11070 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
11071 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
11072 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
11073 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
11074 
11075 					Z_ADDREF_PP(value_ptr);
11076 					generator->value = *value_ptr;
11077 				} else {
11078 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
11079 					Z_ADDREF_PP(value_ptr);
11080 					generator->value = *value_ptr;
11081 				}
11082 
11083 			}
11084 		} else {
11085 			zval *value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11086 
11087 			/* Consts, temporary variables and references need copying */
11088 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
11089 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
11090 			) {
11091 				zval *copy;
11092 
11093 				ALLOC_ZVAL(copy);
11094 				INIT_PZVAL_COPY(copy, value);
11095 
11096 				/* Temporary variables don't need ctor copying */
11097 				if (!1) {
11098 					zval_copy_ctor(copy);
11099 				}
11100 
11101 				generator->value = copy;
11102 			} else {
11103 				Z_ADDREF_P(value);
11104 				generator->value = value;
11105 			}
11106 
11107 		}
11108 	} else {
11109 		/* If no value was specified yield null */
11110 		Z_ADDREF(EG(uninitialized_zval));
11111 		generator->value = &EG(uninitialized_zval);
11112 	}
11113 
11114 	/* Set the new yielded key */
11115 	if (IS_VAR != IS_UNUSED) {
11116 		zend_free_op free_op2;
11117 		zval *key = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
11118 
11119 		/* Consts, temporary variables and references need copying */
11120 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
11121 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
11122 		) {
11123 			zval *copy;
11124 
11125 			ALLOC_ZVAL(copy);
11126 			INIT_PZVAL_COPY(copy, key);
11127 
11128 			/* Temporary variables don't need ctor copying */
11129 			if (!0) {
11130 				zval_copy_ctor(copy);
11131 			}
11132 
11133 			generator->key = copy;
11134 		} else {
11135 			Z_ADDREF_P(key);
11136 			generator->key = key;
11137 		}
11138 
11139 		if (Z_TYPE_P(generator->key) == IS_LONG
11140 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
11141 		) {
11142 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
11143 		}
11144 
11145 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
11146 	} else {
11147 		/* If no key was specified we use auto-increment keys */
11148 		generator->largest_used_integer_key++;
11149 
11150 		ALLOC_INIT_ZVAL(generator->key);
11151 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
11152 	}
11153 
11154 	if (RETURN_VALUE_USED(opline)) {
11155 		/* If the return value of yield is used set the send
11156 		 * target and initialize it to NULL */
11157 		generator->send_target = &EX_T(opline->result.var).var.ptr;
11158 		Z_ADDREF(EG(uninitialized_zval));
11159 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
11160 	} else {
11161 		generator->send_target = NULL;
11162 	}
11163 
11164 	/* We increment to the next op, so we are at the correct position when the
11165 	 * generator is resumed. */
11166 	ZEND_VM_INC_OPCODE();
11167 
11168 	/* The GOTO VM uses a local opline variable. We need to set the opline
11169 	 * variable in execute_data so we don't resume at an old position. */
11170 	SAVE_OPLINE();
11171 
11172 	ZEND_VM_RETURN();
11173 }
11174 
zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)11175 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
11176 {
11177 	USE_OPLINE
11178 	zend_free_op free_op1;
11179 	zval *varname;
11180 	zval **retval;
11181 	zval tmp_varname;
11182 	HashTable *target_symbol_table;
11183 	ulong hash_value;
11184 
11185 	SAVE_OPLINE();
11186 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11187 
11188  	if (IS_TMP_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
11189 		ZVAL_COPY_VALUE(&tmp_varname, varname);
11190 		zval_copy_ctor(&tmp_varname);
11191 		Z_SET_REFCOUNT(tmp_varname, 1);
11192 		Z_UNSET_ISREF(tmp_varname);
11193 		convert_to_string(&tmp_varname);
11194 		varname = &tmp_varname;
11195 	}
11196 
11197 	if (IS_UNUSED != IS_UNUSED) {
11198 		zend_class_entry *ce;
11199 
11200 		if (IS_UNUSED == IS_CONST) {
11201 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
11202 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
11203 			} else {
11204 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
11205 				if (UNEXPECTED(ce == NULL)) {
11206 					if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
11207 						zval_dtor(&tmp_varname);
11208 					}
11209 					zval_dtor(free_op1.var);
11210 					CHECK_EXCEPTION();
11211 					ZEND_VM_NEXT_OPCODE();
11212 				}
11213 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
11214 			}
11215 		} else {
11216 			ce = EX_T(opline->op2.var).class_entry;
11217 		}
11218 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
11219 		zval_dtor(free_op1.var);
11220 	} else {
11221 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
11222 /*
11223 		if (!target_symbol_table) {
11224 			CHECK_EXCEPTION();
11225 			ZEND_VM_NEXT_OPCODE();
11226 		}
11227 */
11228 		if (IS_TMP_VAR == IS_CONST) {
11229 			hash_value = Z_HASH_P(varname);
11230 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
11231 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
11232 		} else {
11233 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
11234 		}
11235 
11236 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
11237 			switch (type) {
11238 				case BP_VAR_R:
11239 				case BP_VAR_UNSET:
11240 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
11241 					/* break missing intentionally */
11242 				case BP_VAR_IS:
11243 					retval = &EG(uninitialized_zval_ptr);
11244 					break;
11245 				case BP_VAR_RW:
11246 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
11247 					/* break missing intentionally */
11248 				case BP_VAR_W:
11249 					Z_ADDREF_P(&EG(uninitialized_zval));
11250 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
11251 					break;
11252 				EMPTY_SWITCH_DEFAULT_CASE()
11253 			}
11254 		}
11255 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
11256 			case ZEND_FETCH_GLOBAL:
11257 				if (IS_TMP_VAR != IS_TMP_VAR) {
11258 					zval_dtor(free_op1.var);
11259 				}
11260 				break;
11261 			case ZEND_FETCH_LOCAL:
11262 				zval_dtor(free_op1.var);
11263 				break;
11264 			case ZEND_FETCH_STATIC:
11265 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
11266 				break;
11267 			case ZEND_FETCH_GLOBAL_LOCK:
11268 				if (IS_TMP_VAR == IS_VAR && !free_op1.var) {
11269 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
11270 				}
11271 				break;
11272 		}
11273 	}
11274 
11275 
11276 	if (IS_TMP_VAR != IS_CONST && varname == &tmp_varname) {
11277 		zval_dtor(&tmp_varname);
11278 	}
11279 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
11280 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
11281 	}
11282 	PZVAL_LOCK(*retval);
11283 	switch (type) {
11284 		case BP_VAR_R:
11285 		case BP_VAR_IS:
11286 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
11287 			break;
11288 		case BP_VAR_UNSET: {
11289 			zend_free_op free_res;
11290 
11291 			PZVAL_UNLOCK(*retval, &free_res);
11292 			if (retval != &EG(uninitialized_zval_ptr)) {
11293 				SEPARATE_ZVAL_IF_NOT_REF(retval);
11294 			}
11295 			PZVAL_LOCK(*retval);
11296 			FREE_OP_VAR_PTR(free_res);
11297 		}
11298 		/* break missing intentionally */
11299 		default:
11300 			EX_T(opline->result.var).var.ptr_ptr = retval;
11301 			break;
11302 	}
11303 	CHECK_EXCEPTION();
11304 	ZEND_VM_NEXT_OPCODE();
11305 }
11306 
ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11307 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11308 {
11309 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11310 }
11311 
ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11312 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11313 {
11314 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11315 }
11316 
ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11317 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11318 {
11319 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11320 }
11321 
ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11322 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11323 {
11324 	USE_OPLINE
11325 
11326 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11327 }
11328 
ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11329 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11330 {
11331 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11332 }
11333 
ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11334 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11335 {
11336 	return zend_fetch_var_address_helper_SPEC_TMP_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11337 }
11338 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11339 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11340 {
11341 	USE_OPLINE
11342 	zend_free_op free_op1;
11343 	zval *expr_ptr;
11344 
11345 	SAVE_OPLINE();
11346 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
11347 		zval **expr_ptr_ptr = NULL;
11348 
11349 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
11350 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
11351 		}
11352 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
11353 		expr_ptr = *expr_ptr_ptr;
11354 		Z_ADDREF_P(expr_ptr);
11355 	} else {
11356 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11357 		if (1) { /* temporary variable */
11358 			zval *new_expr;
11359 
11360 			ALLOC_ZVAL(new_expr);
11361 			INIT_PZVAL_COPY(new_expr, expr_ptr);
11362 			expr_ptr = new_expr;
11363 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
11364 			zval *new_expr;
11365 
11366 			ALLOC_ZVAL(new_expr);
11367 			INIT_PZVAL_COPY(new_expr, expr_ptr);
11368 			expr_ptr = new_expr;
11369 			zendi_zval_copy_ctor(*expr_ptr);
11370 		} else {
11371 			Z_ADDREF_P(expr_ptr);
11372 		}
11373 	}
11374 
11375 	if (IS_UNUSED != IS_UNUSED) {
11376 
11377 		zval *offset = NULL;
11378 		ulong hval;
11379 
11380 		switch (Z_TYPE_P(offset)) {
11381 			case IS_DOUBLE:
11382 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
11383 				goto num_index;
11384 			case IS_LONG:
11385 			case IS_BOOL:
11386 				hval = Z_LVAL_P(offset);
11387 num_index:
11388 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
11389 				break;
11390 			case IS_STRING:
11391 				if (IS_UNUSED == IS_CONST) {
11392 					hval = Z_HASH_P(offset);
11393 				} else {
11394 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
11395 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
11396 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
11397 					} else {
11398 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
11399 					}
11400 				}
11401 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
11402 				break;
11403 			case IS_NULL:
11404 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
11405 				break;
11406 			default:
11407 				zend_error(E_WARNING, "Illegal offset type");
11408 				zval_ptr_dtor(&expr_ptr);
11409 				/* do nothing */
11410 				break;
11411 		}
11412 
11413 	} else {
11414 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
11415 	}
11416 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
11417 
11418 	} else {
11419 
11420 	}
11421 	CHECK_EXCEPTION();
11422 	ZEND_VM_NEXT_OPCODE();
11423 }
11424 
ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11425 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11426 {
11427 	USE_OPLINE
11428 
11429 	array_init(&EX_T(opline->result.var).tmp_var);
11430 	if (IS_TMP_VAR == IS_UNUSED) {
11431 		ZEND_VM_NEXT_OPCODE();
11432 #if 0 || IS_TMP_VAR != IS_UNUSED
11433 	} else {
11434 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
11435 #endif
11436 	}
11437 }
11438 
ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11439 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11440 {
11441 	USE_OPLINE
11442 	zval tmp, *varname;
11443 	HashTable *target_symbol_table;
11444 	zend_free_op free_op1;
11445 
11446 	SAVE_OPLINE();
11447 	if (IS_TMP_VAR == IS_CV &&
11448 	    IS_UNUSED == IS_UNUSED &&
11449 	    (opline->extended_value & ZEND_QUICK_SET)) {
11450 		if (EG(active_symbol_table)) {
11451 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
11452 
11453 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
11454 			EX_CV(opline->op1.var) = NULL;
11455 		} else if (EX_CV(opline->op1.var)) {
11456 			zval_ptr_dtor(EX_CV(opline->op1.var));
11457 			EX_CV(opline->op1.var) = NULL;
11458 		}
11459 		CHECK_EXCEPTION();
11460 		ZEND_VM_NEXT_OPCODE();
11461 	}
11462 
11463 	varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11464 
11465 	if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
11466 		ZVAL_COPY_VALUE(&tmp, varname);
11467 		zval_copy_ctor(&tmp);
11468 		convert_to_string(&tmp);
11469 		varname = &tmp;
11470 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
11471 		Z_ADDREF_P(varname);
11472 	}
11473 
11474 	if (IS_UNUSED != IS_UNUSED) {
11475 		zend_class_entry *ce;
11476 
11477 		if (IS_UNUSED == IS_CONST) {
11478 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
11479 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
11480 			} else {
11481 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
11482 				if (UNEXPECTED(EG(exception) != NULL)) {
11483 					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
11484 						zval_dtor(&tmp);
11485 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
11486 						zval_ptr_dtor(&varname);
11487 					}
11488 					zval_dtor(free_op1.var);
11489 					HANDLE_EXCEPTION();
11490 				}
11491 				if (UNEXPECTED(ce == NULL)) {
11492 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
11493 				}
11494 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
11495 			}
11496 		} else {
11497 			ce = EX_T(opline->op2.var).class_entry;
11498 		}
11499 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
11500 	} else {
11501 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
11502 
11503 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
11504 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
11505 	}
11506 
11507 	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
11508 		zval_dtor(&tmp);
11509 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
11510 		zval_ptr_dtor(&varname);
11511 	}
11512 	zval_dtor(free_op1.var);
11513 	CHECK_EXCEPTION();
11514 	ZEND_VM_NEXT_OPCODE();
11515 }
11516 
ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11517 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11518 {
11519 	USE_OPLINE
11520 	zval **value;
11521 	zend_bool isset = 1;
11522 
11523 	SAVE_OPLINE();
11524 	if (IS_TMP_VAR == IS_CV &&
11525 	    IS_UNUSED == IS_UNUSED &&
11526 	    (opline->extended_value & ZEND_QUICK_SET)) {
11527 		if (EX_CV(opline->op1.var)) {
11528 			value = EX_CV(opline->op1.var);
11529 		} else if (EG(active_symbol_table)) {
11530 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
11531 
11532 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
11533 				isset = 0;
11534 			}
11535 		} else {
11536 			isset = 0;
11537 		}
11538 	} else {
11539 		HashTable *target_symbol_table;
11540 		zend_free_op free_op1;
11541 		zval tmp, *varname = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11542 
11543 		if (IS_TMP_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
11544 			ZVAL_COPY_VALUE(&tmp, varname);
11545 			zval_copy_ctor(&tmp);
11546 			convert_to_string(&tmp);
11547 			varname = &tmp;
11548 		}
11549 
11550 		if (IS_UNUSED != IS_UNUSED) {
11551 			zend_class_entry *ce;
11552 
11553 			if (IS_UNUSED == IS_CONST) {
11554 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
11555 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
11556 				} else {
11557 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
11558 					if (UNEXPECTED(ce == NULL)) {
11559 						CHECK_EXCEPTION();
11560 						ZEND_VM_NEXT_OPCODE();
11561 					}
11562 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
11563 				}
11564 			} else {
11565 				ce = EX_T(opline->op2.var).class_entry;
11566 			}
11567 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_TMP_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
11568 			if (!value) {
11569 				isset = 0;
11570 			}
11571 		} else {
11572 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
11573 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
11574 				isset = 0;
11575 			}
11576 		}
11577 
11578 		if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
11579 			zval_dtor(&tmp);
11580 		}
11581 		zval_dtor(free_op1.var);
11582 	}
11583 
11584 	if (opline->extended_value & ZEND_ISSET) {
11585 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
11586 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
11587 		} else {
11588 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
11589 		}
11590 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
11591 		if (!isset || !i_zend_is_true(*value)) {
11592 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
11593 		} else {
11594 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
11595 		}
11596 	}
11597 
11598 	CHECK_EXCEPTION();
11599 	ZEND_VM_NEXT_OPCODE();
11600 }
11601 
ZEND_YIELD_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11602 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11603 {
11604 	USE_OPLINE
11605 
11606 	/* The generator object is stored in return_value_ptr_ptr */
11607 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
11608 
11609 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
11610 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
11611 	}
11612 
11613 	/* Destroy the previously yielded value */
11614 	if (generator->value) {
11615 		zval_ptr_dtor(&generator->value);
11616 	}
11617 
11618 	/* Destroy the previously yielded key */
11619 	if (generator->key) {
11620 		zval_ptr_dtor(&generator->key);
11621 	}
11622 
11623 	/* Set the new yielded value */
11624 	if (IS_TMP_VAR != IS_UNUSED) {
11625 		zend_free_op free_op1;
11626 
11627 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
11628 			/* Constants and temporary variables aren't yieldable by reference,
11629 			 * but we still allow them with a notice. */
11630 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
11631 				zval *value, *copy;
11632 
11633 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
11634 
11635 				value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11636 				ALLOC_ZVAL(copy);
11637 				INIT_PZVAL_COPY(copy, value);
11638 
11639 				/* Temporary variables don't need ctor copying */
11640 				if (!1) {
11641 					zval_copy_ctor(copy);
11642 				}
11643 
11644 				generator->value = copy;
11645 			} else {
11646 				zval **value_ptr = NULL;
11647 
11648 				if (IS_TMP_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
11649 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
11650 				}
11651 
11652 				/* If a function call result is yielded and the function did
11653 				 * not return by reference we throw a notice. */
11654 				if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
11655 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
11656 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
11657 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
11658 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
11659 
11660 					Z_ADDREF_PP(value_ptr);
11661 					generator->value = *value_ptr;
11662 				} else {
11663 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
11664 					Z_ADDREF_PP(value_ptr);
11665 					generator->value = *value_ptr;
11666 				}
11667 
11668 			}
11669 		} else {
11670 			zval *value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
11671 
11672 			/* Consts, temporary variables and references need copying */
11673 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
11674 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
11675 			) {
11676 				zval *copy;
11677 
11678 				ALLOC_ZVAL(copy);
11679 				INIT_PZVAL_COPY(copy, value);
11680 
11681 				/* Temporary variables don't need ctor copying */
11682 				if (!1) {
11683 					zval_copy_ctor(copy);
11684 				}
11685 
11686 				generator->value = copy;
11687 			} else {
11688 				Z_ADDREF_P(value);
11689 				generator->value = value;
11690 			}
11691 
11692 		}
11693 	} else {
11694 		/* If no value was specified yield null */
11695 		Z_ADDREF(EG(uninitialized_zval));
11696 		generator->value = &EG(uninitialized_zval);
11697 	}
11698 
11699 	/* Set the new yielded key */
11700 	if (IS_UNUSED != IS_UNUSED) {
11701 
11702 		zval *key = NULL;
11703 
11704 		/* Consts, temporary variables and references need copying */
11705 		if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
11706 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
11707 		) {
11708 			zval *copy;
11709 
11710 			ALLOC_ZVAL(copy);
11711 			INIT_PZVAL_COPY(copy, key);
11712 
11713 			/* Temporary variables don't need ctor copying */
11714 			if (!0) {
11715 				zval_copy_ctor(copy);
11716 			}
11717 
11718 			generator->key = copy;
11719 		} else {
11720 			Z_ADDREF_P(key);
11721 			generator->key = key;
11722 		}
11723 
11724 		if (Z_TYPE_P(generator->key) == IS_LONG
11725 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
11726 		) {
11727 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
11728 		}
11729 
11730 	} else {
11731 		/* If no key was specified we use auto-increment keys */
11732 		generator->largest_used_integer_key++;
11733 
11734 		ALLOC_INIT_ZVAL(generator->key);
11735 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
11736 	}
11737 
11738 	if (RETURN_VALUE_USED(opline)) {
11739 		/* If the return value of yield is used set the send
11740 		 * target and initialize it to NULL */
11741 		generator->send_target = &EX_T(opline->result.var).var.ptr;
11742 		Z_ADDREF(EG(uninitialized_zval));
11743 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
11744 	} else {
11745 		generator->send_target = NULL;
11746 	}
11747 
11748 	/* We increment to the next op, so we are at the correct position when the
11749 	 * generator is resumed. */
11750 	ZEND_VM_INC_OPCODE();
11751 
11752 	/* The GOTO VM uses a local opline variable. We need to set the opline
11753 	 * variable in execute_data so we don't resume at an old position. */
11754 	SAVE_OPLINE();
11755 
11756 	ZEND_VM_RETURN();
11757 }
11758 
ZEND_ADD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11759 static int ZEND_FASTCALL  ZEND_ADD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11760 {
11761 	USE_OPLINE
11762 	zend_free_op free_op1;
11763 
11764 	SAVE_OPLINE();
11765 	fast_add_function(&EX_T(opline->result.var).tmp_var,
11766 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11767 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11768 	zval_dtor(free_op1.var);
11769 
11770 	CHECK_EXCEPTION();
11771 	ZEND_VM_NEXT_OPCODE();
11772 }
11773 
ZEND_SUB_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11774 static int ZEND_FASTCALL  ZEND_SUB_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11775 {
11776 	USE_OPLINE
11777 	zend_free_op free_op1;
11778 
11779 	SAVE_OPLINE();
11780 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
11781 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11782 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11783 	zval_dtor(free_op1.var);
11784 
11785 	CHECK_EXCEPTION();
11786 	ZEND_VM_NEXT_OPCODE();
11787 }
11788 
ZEND_MUL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11789 static int ZEND_FASTCALL  ZEND_MUL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11790 {
11791 	USE_OPLINE
11792 	zend_free_op free_op1;
11793 
11794 	SAVE_OPLINE();
11795 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
11796 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11797 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11798 	zval_dtor(free_op1.var);
11799 
11800 	CHECK_EXCEPTION();
11801 	ZEND_VM_NEXT_OPCODE();
11802 }
11803 
ZEND_DIV_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11804 static int ZEND_FASTCALL  ZEND_DIV_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11805 {
11806 	USE_OPLINE
11807 	zend_free_op free_op1;
11808 
11809 	SAVE_OPLINE();
11810 	fast_div_function(&EX_T(opline->result.var).tmp_var,
11811 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11812 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11813 	zval_dtor(free_op1.var);
11814 
11815 	CHECK_EXCEPTION();
11816 	ZEND_VM_NEXT_OPCODE();
11817 }
11818 
ZEND_MOD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11819 static int ZEND_FASTCALL  ZEND_MOD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11820 {
11821 	USE_OPLINE
11822 	zend_free_op free_op1;
11823 
11824 	SAVE_OPLINE();
11825 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
11826 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11827 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11828 	zval_dtor(free_op1.var);
11829 
11830 	CHECK_EXCEPTION();
11831 	ZEND_VM_NEXT_OPCODE();
11832 }
11833 
ZEND_SL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11834 static int ZEND_FASTCALL  ZEND_SL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11835 {
11836 	USE_OPLINE
11837 	zend_free_op free_op1;
11838 
11839 	SAVE_OPLINE();
11840 	shift_left_function(&EX_T(opline->result.var).tmp_var,
11841 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11842 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11843 	zval_dtor(free_op1.var);
11844 
11845 	CHECK_EXCEPTION();
11846 	ZEND_VM_NEXT_OPCODE();
11847 }
11848 
ZEND_SR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11849 static int ZEND_FASTCALL  ZEND_SR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11850 {
11851 	USE_OPLINE
11852 	zend_free_op free_op1;
11853 
11854 	SAVE_OPLINE();
11855 	shift_right_function(&EX_T(opline->result.var).tmp_var,
11856 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11857 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11858 	zval_dtor(free_op1.var);
11859 
11860 	CHECK_EXCEPTION();
11861 	ZEND_VM_NEXT_OPCODE();
11862 }
11863 
ZEND_CONCAT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11864 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11865 {
11866 	USE_OPLINE
11867 	zend_free_op free_op1;
11868 
11869 	SAVE_OPLINE();
11870 	concat_function(&EX_T(opline->result.var).tmp_var,
11871 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11872 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11873 	zval_dtor(free_op1.var);
11874 
11875 	CHECK_EXCEPTION();
11876 	ZEND_VM_NEXT_OPCODE();
11877 }
11878 
ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11879 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11880 {
11881 	USE_OPLINE
11882 	zend_free_op free_op1;
11883 
11884 	SAVE_OPLINE();
11885 	is_identical_function(&EX_T(opline->result.var).tmp_var,
11886 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11887 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11888 	zval_dtor(free_op1.var);
11889 
11890 	CHECK_EXCEPTION();
11891 	ZEND_VM_NEXT_OPCODE();
11892 }
11893 
ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11894 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11895 {
11896 	USE_OPLINE
11897 	zend_free_op free_op1;
11898 	zval *result = &EX_T(opline->result.var).tmp_var;
11899 
11900 	SAVE_OPLINE();
11901 	is_identical_function(result,
11902 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11903 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11904 	Z_LVAL_P(result) = !Z_LVAL_P(result);
11905 	zval_dtor(free_op1.var);
11906 
11907 	CHECK_EXCEPTION();
11908 	ZEND_VM_NEXT_OPCODE();
11909 }
11910 
ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11911 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11912 {
11913 	USE_OPLINE
11914 	zend_free_op free_op1;
11915 	zval *result = &EX_T(opline->result.var).tmp_var;
11916 
11917 	SAVE_OPLINE();
11918 	ZVAL_BOOL(result, fast_equal_function(result,
11919 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11920 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
11921 	zval_dtor(free_op1.var);
11922 
11923 	CHECK_EXCEPTION();
11924 	ZEND_VM_NEXT_OPCODE();
11925 }
11926 
ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11927 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11928 {
11929 	USE_OPLINE
11930 	zend_free_op free_op1;
11931 	zval *result = &EX_T(opline->result.var).tmp_var;
11932 
11933 	SAVE_OPLINE();
11934 	ZVAL_BOOL(result, fast_not_equal_function(result,
11935 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11936 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
11937 	zval_dtor(free_op1.var);
11938 
11939 	CHECK_EXCEPTION();
11940 	ZEND_VM_NEXT_OPCODE();
11941 }
11942 
ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11943 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11944 {
11945 	USE_OPLINE
11946 	zend_free_op free_op1;
11947 	zval *result = &EX_T(opline->result.var).tmp_var;
11948 
11949 	SAVE_OPLINE();
11950 	ZVAL_BOOL(result, fast_is_smaller_function(result,
11951 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11952 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
11953 	zval_dtor(free_op1.var);
11954 
11955 	CHECK_EXCEPTION();
11956 	ZEND_VM_NEXT_OPCODE();
11957 }
11958 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11959 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11960 {
11961 	USE_OPLINE
11962 	zend_free_op free_op1;
11963 	zval *result = &EX_T(opline->result.var).tmp_var;
11964 
11965 	SAVE_OPLINE();
11966 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
11967 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11968 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
11969 	zval_dtor(free_op1.var);
11970 
11971 	CHECK_EXCEPTION();
11972 	ZEND_VM_NEXT_OPCODE();
11973 }
11974 
ZEND_BW_OR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11975 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11976 {
11977 	USE_OPLINE
11978 	zend_free_op free_op1;
11979 
11980 	SAVE_OPLINE();
11981 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
11982 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11983 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11984 	zval_dtor(free_op1.var);
11985 
11986 	CHECK_EXCEPTION();
11987 	ZEND_VM_NEXT_OPCODE();
11988 }
11989 
ZEND_BW_AND_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)11990 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
11991 {
11992 	USE_OPLINE
11993 	zend_free_op free_op1;
11994 
11995 	SAVE_OPLINE();
11996 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
11997 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
11998 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
11999 	zval_dtor(free_op1.var);
12000 
12001 	CHECK_EXCEPTION();
12002 	ZEND_VM_NEXT_OPCODE();
12003 }
12004 
ZEND_BW_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12005 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12006 {
12007 	USE_OPLINE
12008 	zend_free_op free_op1;
12009 
12010 	SAVE_OPLINE();
12011 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
12012 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
12013 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
12014 	zval_dtor(free_op1.var);
12015 
12016 	CHECK_EXCEPTION();
12017 	ZEND_VM_NEXT_OPCODE();
12018 }
12019 
ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12020 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12021 {
12022 	USE_OPLINE
12023 	zend_free_op free_op1;
12024 
12025 	SAVE_OPLINE();
12026 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
12027 		_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
12028 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
12029 	zval_dtor(free_op1.var);
12030 
12031 	CHECK_EXCEPTION();
12032 	ZEND_VM_NEXT_OPCODE();
12033 }
12034 
ZEND_FETCH_DIM_R_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12035 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12036 {
12037 	USE_OPLINE
12038 	zend_free_op free_op1;
12039 	zval *container;
12040 
12041 	SAVE_OPLINE();
12042 
12043 	if (IS_TMP_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
12044 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
12045 	}
12046 	container = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12047 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
12048 
12049 	zval_dtor(free_op1.var);
12050 	CHECK_EXCEPTION();
12051 	ZEND_VM_NEXT_OPCODE();
12052 }
12053 
ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12054 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12055 {
12056 	USE_OPLINE
12057 
12058 	zval *str = &EX_T(opline->result.var).tmp_var;
12059 	zval *var;
12060 	zval var_copy;
12061 	int use_copy = 0;
12062 
12063 	SAVE_OPLINE();
12064 	var = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
12065 
12066 	if (IS_TMP_VAR == IS_UNUSED) {
12067 		/* Initialize for erealloc in add_string_to_string */
12068 		Z_STRVAL_P(str) = NULL;
12069 		Z_STRLEN_P(str) = 0;
12070 		Z_TYPE_P(str) = IS_STRING;
12071 
12072 		INIT_PZVAL(str);
12073 	}
12074 
12075 	if (Z_TYPE_P(var) != IS_STRING) {
12076 		zend_make_printable_zval(var, &var_copy, &use_copy);
12077 
12078 		if (use_copy) {
12079 			var = &var_copy;
12080 		}
12081 	}
12082 	add_string_to_string(str, str, var);
12083 
12084 	if (use_copy) {
12085 		zval_dtor(var);
12086 	}
12087 	/* original comment, possibly problematic:
12088 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
12089 	 * (Zeev):  I don't think it's problematic, we only use variables
12090 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
12091 	 * string offsets or overloaded objects
12092 	 */
12093 
12094 	CHECK_EXCEPTION();
12095 	ZEND_VM_NEXT_OPCODE();
12096 }
12097 
ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12098 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12099 {
12100 	USE_OPLINE
12101 	zval *function_name;
12102 	char *function_name_strval;
12103 	int function_name_strlen;
12104 	zend_free_op free_op1;
12105 	call_slot *call = EX(call_slots) + opline->result.num;
12106 
12107 	SAVE_OPLINE();
12108 
12109 	function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
12110 
12111 	if (IS_CV != IS_CONST &&
12112 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
12113 		if (UNEXPECTED(EG(exception) != NULL)) {
12114 			HANDLE_EXCEPTION();
12115 		}
12116 		zend_error_noreturn(E_ERROR, "Method name must be a string");
12117 	}
12118 
12119 	function_name_strval = Z_STRVAL_P(function_name);
12120 	function_name_strlen = Z_STRLEN_P(function_name);
12121 
12122 	call->object = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12123 
12124 	if (EXPECTED(call->object != NULL) &&
12125 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
12126 		call->called_scope = Z_OBJCE_P(call->object);
12127 
12128 		if (IS_CV != IS_CONST ||
12129 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
12130 		    zval *object = call->object;
12131 
12132 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
12133 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
12134 			}
12135 
12136 			/* First, locate the function. */
12137 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
12138 			if (UNEXPECTED(call->fbc == NULL)) {
12139 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
12140 			}
12141 			if (IS_CV == IS_CONST &&
12142 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
12143 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
12144 			    EXPECTED(call->object == object)) {
12145 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
12146 			}
12147 		}
12148 	} else {
12149 		if (UNEXPECTED(EG(exception) != NULL)) {
12150 
12151 			HANDLE_EXCEPTION();
12152 		}
12153 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
12154 	}
12155 
12156 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
12157 		call->object = NULL;
12158 	} else {
12159 		if (!PZVAL_IS_REF(call->object)) {
12160 			Z_ADDREF_P(call->object); /* For $this pointer */
12161 		} else {
12162 			zval *this_ptr;
12163 			ALLOC_ZVAL(this_ptr);
12164 			INIT_PZVAL_COPY(this_ptr, call->object);
12165 			zval_copy_ctor(this_ptr);
12166 			call->object = this_ptr;
12167 		}
12168 	}
12169 	call->is_ctor_call = 0;
12170 	EX(call) = call;
12171 
12172 
12173 	CHECK_EXCEPTION();
12174 	ZEND_VM_NEXT_OPCODE();
12175 }
12176 
ZEND_CASE_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12177 static int ZEND_FASTCALL  ZEND_CASE_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12178 {
12179 	USE_OPLINE
12180 	zend_free_op free_op1;
12181 
12182 	SAVE_OPLINE();
12183 	if (IS_TMP_VAR==IS_VAR) {
12184 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
12185 	}
12186 	is_equal_function(&EX_T(opline->result.var).tmp_var,
12187 				 _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
12188 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
12189 
12190 	CHECK_EXCEPTION();
12191 	ZEND_VM_NEXT_OPCODE();
12192 }
12193 
ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12194 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12195 {
12196 	USE_OPLINE
12197 	zend_free_op free_op1;
12198 	zval *expr_ptr;
12199 
12200 	SAVE_OPLINE();
12201 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
12202 		zval **expr_ptr_ptr = NULL;
12203 
12204 		if (IS_TMP_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
12205 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
12206 		}
12207 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
12208 		expr_ptr = *expr_ptr_ptr;
12209 		Z_ADDREF_P(expr_ptr);
12210 	} else {
12211 		expr_ptr=_get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12212 		if (1) { /* temporary variable */
12213 			zval *new_expr;
12214 
12215 			ALLOC_ZVAL(new_expr);
12216 			INIT_PZVAL_COPY(new_expr, expr_ptr);
12217 			expr_ptr = new_expr;
12218 		} else if (IS_TMP_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
12219 			zval *new_expr;
12220 
12221 			ALLOC_ZVAL(new_expr);
12222 			INIT_PZVAL_COPY(new_expr, expr_ptr);
12223 			expr_ptr = new_expr;
12224 			zendi_zval_copy_ctor(*expr_ptr);
12225 		} else {
12226 			Z_ADDREF_P(expr_ptr);
12227 		}
12228 	}
12229 
12230 	if (IS_CV != IS_UNUSED) {
12231 
12232 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
12233 		ulong hval;
12234 
12235 		switch (Z_TYPE_P(offset)) {
12236 			case IS_DOUBLE:
12237 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
12238 				goto num_index;
12239 			case IS_LONG:
12240 			case IS_BOOL:
12241 				hval = Z_LVAL_P(offset);
12242 num_index:
12243 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
12244 				break;
12245 			case IS_STRING:
12246 				if (IS_CV == IS_CONST) {
12247 					hval = Z_HASH_P(offset);
12248 				} else {
12249 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
12250 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
12251 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
12252 					} else {
12253 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
12254 					}
12255 				}
12256 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
12257 				break;
12258 			case IS_NULL:
12259 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
12260 				break;
12261 			default:
12262 				zend_error(E_WARNING, "Illegal offset type");
12263 				zval_ptr_dtor(&expr_ptr);
12264 				/* do nothing */
12265 				break;
12266 		}
12267 
12268 	} else {
12269 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
12270 	}
12271 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
12272 
12273 	} else {
12274 
12275 	}
12276 	CHECK_EXCEPTION();
12277 	ZEND_VM_NEXT_OPCODE();
12278 }
12279 
ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12280 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12281 {
12282 	USE_OPLINE
12283 
12284 	array_init(&EX_T(opline->result.var).tmp_var);
12285 	if (IS_TMP_VAR == IS_UNUSED) {
12286 		ZEND_VM_NEXT_OPCODE();
12287 #if 0 || IS_TMP_VAR != IS_UNUSED
12288 	} else {
12289 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12290 #endif
12291 	}
12292 }
12293 
ZEND_YIELD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12294 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12295 {
12296 	USE_OPLINE
12297 
12298 	/* The generator object is stored in return_value_ptr_ptr */
12299 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
12300 
12301 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
12302 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
12303 	}
12304 
12305 	/* Destroy the previously yielded value */
12306 	if (generator->value) {
12307 		zval_ptr_dtor(&generator->value);
12308 	}
12309 
12310 	/* Destroy the previously yielded key */
12311 	if (generator->key) {
12312 		zval_ptr_dtor(&generator->key);
12313 	}
12314 
12315 	/* Set the new yielded value */
12316 	if (IS_TMP_VAR != IS_UNUSED) {
12317 		zend_free_op free_op1;
12318 
12319 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
12320 			/* Constants and temporary variables aren't yieldable by reference,
12321 			 * but we still allow them with a notice. */
12322 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR) {
12323 				zval *value, *copy;
12324 
12325 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
12326 
12327 				value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12328 				ALLOC_ZVAL(copy);
12329 				INIT_PZVAL_COPY(copy, value);
12330 
12331 				/* Temporary variables don't need ctor copying */
12332 				if (!1) {
12333 					zval_copy_ctor(copy);
12334 				}
12335 
12336 				generator->value = copy;
12337 			} else {
12338 				zval **value_ptr = NULL;
12339 
12340 				if (IS_TMP_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
12341 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
12342 				}
12343 
12344 				/* If a function call result is yielded and the function did
12345 				 * not return by reference we throw a notice. */
12346 				if (IS_TMP_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
12347 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
12348 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
12349 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
12350 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
12351 
12352 					Z_ADDREF_PP(value_ptr);
12353 					generator->value = *value_ptr;
12354 				} else {
12355 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
12356 					Z_ADDREF_PP(value_ptr);
12357 					generator->value = *value_ptr;
12358 				}
12359 
12360 			}
12361 		} else {
12362 			zval *value = _get_zval_ptr_tmp(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12363 
12364 			/* Consts, temporary variables and references need copying */
12365 			if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
12366 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
12367 			) {
12368 				zval *copy;
12369 
12370 				ALLOC_ZVAL(copy);
12371 				INIT_PZVAL_COPY(copy, value);
12372 
12373 				/* Temporary variables don't need ctor copying */
12374 				if (!1) {
12375 					zval_copy_ctor(copy);
12376 				}
12377 
12378 				generator->value = copy;
12379 			} else {
12380 				Z_ADDREF_P(value);
12381 				generator->value = value;
12382 			}
12383 
12384 		}
12385 	} else {
12386 		/* If no value was specified yield null */
12387 		Z_ADDREF(EG(uninitialized_zval));
12388 		generator->value = &EG(uninitialized_zval);
12389 	}
12390 
12391 	/* Set the new yielded key */
12392 	if (IS_CV != IS_UNUSED) {
12393 
12394 		zval *key = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
12395 
12396 		/* Consts, temporary variables and references need copying */
12397 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
12398 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
12399 		) {
12400 			zval *copy;
12401 
12402 			ALLOC_ZVAL(copy);
12403 			INIT_PZVAL_COPY(copy, key);
12404 
12405 			/* Temporary variables don't need ctor copying */
12406 			if (!0) {
12407 				zval_copy_ctor(copy);
12408 			}
12409 
12410 			generator->key = copy;
12411 		} else {
12412 			Z_ADDREF_P(key);
12413 			generator->key = key;
12414 		}
12415 
12416 		if (Z_TYPE_P(generator->key) == IS_LONG
12417 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
12418 		) {
12419 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
12420 		}
12421 
12422 	} else {
12423 		/* If no key was specified we use auto-increment keys */
12424 		generator->largest_used_integer_key++;
12425 
12426 		ALLOC_INIT_ZVAL(generator->key);
12427 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
12428 	}
12429 
12430 	if (RETURN_VALUE_USED(opline)) {
12431 		/* If the return value of yield is used set the send
12432 		 * target and initialize it to NULL */
12433 		generator->send_target = &EX_T(opline->result.var).var.ptr;
12434 		Z_ADDREF(EG(uninitialized_zval));
12435 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
12436 	} else {
12437 		generator->send_target = NULL;
12438 	}
12439 
12440 	/* We increment to the next op, so we are at the correct position when the
12441 	 * generator is resumed. */
12442 	ZEND_VM_INC_OPCODE();
12443 
12444 	/* The GOTO VM uses a local opline variable. We need to set the opline
12445 	 * variable in execute_data so we don't resume at an old position. */
12446 	SAVE_OPLINE();
12447 
12448 	ZEND_VM_RETURN();
12449 }
12450 
ZEND_BW_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12451 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12452 {
12453 	USE_OPLINE
12454 	zend_free_op free_op1;
12455 
12456 	SAVE_OPLINE();
12457 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
12458 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC) TSRMLS_CC);
12459 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12460 	CHECK_EXCEPTION();
12461 	ZEND_VM_NEXT_OPCODE();
12462 }
12463 
ZEND_BOOL_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12464 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12465 {
12466 	USE_OPLINE
12467 	zend_free_op free_op1;
12468 
12469 	SAVE_OPLINE();
12470 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
12471 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC) TSRMLS_CC);
12472 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12473 	CHECK_EXCEPTION();
12474 	ZEND_VM_NEXT_OPCODE();
12475 }
12476 
ZEND_PRE_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12477 static int ZEND_FASTCALL  ZEND_PRE_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12478 {
12479 	USE_OPLINE
12480 	zend_free_op free_op1;
12481 	zval **var_ptr;
12482 
12483 	SAVE_OPLINE();
12484 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12485 
12486 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
12487 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12488 	}
12489 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
12490 		if (RETURN_VALUE_USED(opline)) {
12491 			PZVAL_LOCK(&EG(uninitialized_zval));
12492 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
12493 		}
12494 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12495 		CHECK_EXCEPTION();
12496 		ZEND_VM_NEXT_OPCODE();
12497 	}
12498 
12499 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
12500 
12501 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
12502 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
12503 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
12504 		/* proxy object */
12505 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
12506 		Z_ADDREF_P(val);
12507 		fast_increment_function(val);
12508 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
12509 		zval_ptr_dtor(&val);
12510 	} else {
12511 		fast_increment_function(*var_ptr);
12512 	}
12513 
12514 	if (RETURN_VALUE_USED(opline)) {
12515 		PZVAL_LOCK(*var_ptr);
12516 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
12517 	}
12518 
12519 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12520 	CHECK_EXCEPTION();
12521 	ZEND_VM_NEXT_OPCODE();
12522 }
12523 
ZEND_PRE_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12524 static int ZEND_FASTCALL  ZEND_PRE_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12525 {
12526 	USE_OPLINE
12527 	zend_free_op free_op1;
12528 	zval **var_ptr;
12529 
12530 	SAVE_OPLINE();
12531 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12532 
12533 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
12534 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12535 	}
12536 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
12537 		if (RETURN_VALUE_USED(opline)) {
12538 			PZVAL_LOCK(&EG(uninitialized_zval));
12539 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
12540 		}
12541 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12542 		CHECK_EXCEPTION();
12543 		ZEND_VM_NEXT_OPCODE();
12544 	}
12545 
12546 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
12547 
12548 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
12549 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
12550 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
12551 		/* proxy object */
12552 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
12553 		Z_ADDREF_P(val);
12554 		fast_decrement_function(val);
12555 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
12556 		zval_ptr_dtor(&val);
12557 	} else {
12558 		fast_decrement_function(*var_ptr);
12559 	}
12560 
12561 	if (RETURN_VALUE_USED(opline)) {
12562 		PZVAL_LOCK(*var_ptr);
12563 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
12564 	}
12565 
12566 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12567 	CHECK_EXCEPTION();
12568 	ZEND_VM_NEXT_OPCODE();
12569 }
12570 
ZEND_POST_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12571 static int ZEND_FASTCALL  ZEND_POST_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12572 {
12573 	USE_OPLINE
12574 	zend_free_op free_op1;
12575 	zval **var_ptr, *retval;
12576 
12577 	SAVE_OPLINE();
12578 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12579 
12580 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
12581 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12582 	}
12583 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
12584 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
12585 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12586 		CHECK_EXCEPTION();
12587 		ZEND_VM_NEXT_OPCODE();
12588 	}
12589 
12590 	retval = &EX_T(opline->result.var).tmp_var;
12591 	ZVAL_COPY_VALUE(retval, *var_ptr);
12592 	zendi_zval_copy_ctor(*retval);
12593 
12594 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
12595 
12596 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
12597 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
12598 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
12599 		/* proxy object */
12600 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
12601 		Z_ADDREF_P(val);
12602 		fast_increment_function(val);
12603 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
12604 		zval_ptr_dtor(&val);
12605 	} else {
12606 		fast_increment_function(*var_ptr);
12607 	}
12608 
12609 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12610 	CHECK_EXCEPTION();
12611 	ZEND_VM_NEXT_OPCODE();
12612 }
12613 
ZEND_POST_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12614 static int ZEND_FASTCALL  ZEND_POST_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12615 {
12616 	USE_OPLINE
12617 	zend_free_op free_op1;
12618 	zval **var_ptr, *retval;
12619 
12620 	SAVE_OPLINE();
12621 	var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12622 
12623 	if (IS_VAR == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
12624 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
12625 	}
12626 	if (IS_VAR == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
12627 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
12628 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12629 		CHECK_EXCEPTION();
12630 		ZEND_VM_NEXT_OPCODE();
12631 	}
12632 
12633 	retval = &EX_T(opline->result.var).tmp_var;
12634 	ZVAL_COPY_VALUE(retval, *var_ptr);
12635 	zendi_zval_copy_ctor(*retval);
12636 
12637 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
12638 
12639 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
12640 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
12641 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
12642 		/* proxy object */
12643 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
12644 		Z_ADDREF_P(val);
12645 		fast_decrement_function(val);
12646 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
12647 		zval_ptr_dtor(&val);
12648 	} else {
12649 		fast_decrement_function(*var_ptr);
12650 	}
12651 
12652 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12653 	CHECK_EXCEPTION();
12654 	ZEND_VM_NEXT_OPCODE();
12655 }
12656 
ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12657 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12658 {
12659 	USE_OPLINE
12660 	zend_free_op free_op1;
12661 	zval *z;
12662 
12663 	SAVE_OPLINE();
12664 	z = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12665 
12666 	if (IS_VAR == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
12667 		INIT_PZVAL(z);
12668 	}
12669 	zend_print_variable(z);
12670 
12671 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12672 	CHECK_EXCEPTION();
12673 	ZEND_VM_NEXT_OPCODE();
12674 }
12675 
ZEND_PRINT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12676 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12677 {
12678 	USE_OPLINE
12679 
12680 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
12681 	return ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12682 }
12683 
ZEND_JMPZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12684 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12685 {
12686 	USE_OPLINE
12687 	zend_free_op free_op1;
12688 	zval *val;
12689 	int ret;
12690 
12691 	SAVE_OPLINE();
12692 	val = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12693 
12694 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
12695 		ret = Z_LVAL_P(val);
12696 	} else {
12697 		ret = i_zend_is_true(val);
12698 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12699 		if (UNEXPECTED(EG(exception) != NULL)) {
12700 			HANDLE_EXCEPTION();
12701 		}
12702 	}
12703 	if (!ret) {
12704 #if DEBUG_ZEND>=2
12705 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
12706 #endif
12707 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
12708 		ZEND_VM_CONTINUE();
12709 	}
12710 
12711 	ZEND_VM_NEXT_OPCODE();
12712 }
12713 
ZEND_JMPNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12714 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12715 {
12716 	USE_OPLINE
12717 	zend_free_op free_op1;
12718 	zval *val;
12719 	int ret;
12720 
12721 	SAVE_OPLINE();
12722 	val = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12723 
12724 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
12725 		ret = Z_LVAL_P(val);
12726 	} else {
12727 		ret = i_zend_is_true(val);
12728 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12729 		if (UNEXPECTED(EG(exception) != NULL)) {
12730 			HANDLE_EXCEPTION();
12731 		}
12732 	}
12733 	if (ret) {
12734 #if DEBUG_ZEND>=2
12735 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
12736 #endif
12737 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
12738 		ZEND_VM_CONTINUE();
12739 	}
12740 
12741 	ZEND_VM_NEXT_OPCODE();
12742 }
12743 
ZEND_JMPZNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12744 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12745 {
12746 	USE_OPLINE
12747 	zend_free_op free_op1;
12748 	zval *val;
12749 	int retval;
12750 
12751 	SAVE_OPLINE();
12752 	val = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12753 
12754 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
12755 		retval = Z_LVAL_P(val);
12756 	} else {
12757 		retval = i_zend_is_true(val);
12758 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12759 		if (UNEXPECTED(EG(exception) != NULL)) {
12760 			HANDLE_EXCEPTION();
12761 		}
12762 	}
12763 	if (EXPECTED(retval != 0)) {
12764 #if DEBUG_ZEND>=2
12765 		printf("Conditional jmp on true to %d\n", opline->extended_value);
12766 #endif
12767 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
12768 		ZEND_VM_CONTINUE(); /* CHECK_ME */
12769 	} else {
12770 #if DEBUG_ZEND>=2
12771 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
12772 #endif
12773 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
12774 		ZEND_VM_CONTINUE(); /* CHECK_ME */
12775 	}
12776 }
12777 
ZEND_JMPZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12778 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12779 {
12780 	USE_OPLINE
12781 	zend_free_op free_op1;
12782 	zval *val;
12783 	int retval;
12784 
12785 	SAVE_OPLINE();
12786 	val = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12787 
12788 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
12789 		retval = Z_LVAL_P(val);
12790 	} else {
12791 		retval = i_zend_is_true(val);
12792 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12793 		if (UNEXPECTED(EG(exception) != NULL)) {
12794 			HANDLE_EXCEPTION();
12795 		}
12796 	}
12797 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
12798 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
12799 	if (!retval) {
12800 #if DEBUG_ZEND>=2
12801 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
12802 #endif
12803 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
12804 		ZEND_VM_CONTINUE();
12805 	}
12806 	ZEND_VM_NEXT_OPCODE();
12807 }
12808 
ZEND_JMPNZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12809 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12810 {
12811 	USE_OPLINE
12812 	zend_free_op free_op1;
12813 	zval *val;
12814 	int retval;
12815 
12816 	SAVE_OPLINE();
12817 	val = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12818 
12819 	if (IS_VAR == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
12820 		retval = Z_LVAL_P(val);
12821 	} else {
12822 		retval = i_zend_is_true(val);
12823 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12824 		if (UNEXPECTED(EG(exception) != NULL)) {
12825 			HANDLE_EXCEPTION();
12826 		}
12827 	}
12828 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
12829 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
12830 	if (retval) {
12831 #if DEBUG_ZEND>=2
12832 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
12833 #endif
12834 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
12835 		ZEND_VM_CONTINUE();
12836 	}
12837 	ZEND_VM_NEXT_OPCODE();
12838 }
12839 
ZEND_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12840 static int ZEND_FASTCALL  ZEND_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12841 {
12842 	USE_OPLINE
12843 
12844 	SAVE_OPLINE();
12845 	if (IS_VAR == IS_TMP_VAR) {
12846 		zendi_zval_dtor(EX_T(opline->op1.var).tmp_var);
12847 	} else {
12848 		zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
12849 	}
12850 	CHECK_EXCEPTION();
12851 	ZEND_VM_NEXT_OPCODE();
12852 }
12853 
ZEND_RETURN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12854 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12855 {
12856 	USE_OPLINE
12857 	zval *retval_ptr;
12858 	zend_free_op free_op1;
12859 
12860 	SAVE_OPLINE();
12861 	retval_ptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12862 
12863 	if (!EG(return_value_ptr_ptr)) {
12864 		if (IS_VAR == IS_TMP_VAR) {
12865 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12866 		}
12867 	} else {
12868 		if (IS_VAR == IS_CONST ||
12869 		    IS_VAR == IS_TMP_VAR ||
12870 		    PZVAL_IS_REF(retval_ptr)) {
12871 			zval *ret;
12872 
12873 			ALLOC_ZVAL(ret);
12874 			INIT_PZVAL_COPY(ret, retval_ptr);
12875 			if (IS_VAR != IS_TMP_VAR) {
12876 				zval_copy_ctor(ret);
12877 			}
12878 			*EG(return_value_ptr_ptr) = ret;
12879 		} else if ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
12880 		           retval_ptr == &EG(uninitialized_zval)) {
12881 			zval *ret;
12882 
12883 			ALLOC_INIT_ZVAL(ret);
12884 			*EG(return_value_ptr_ptr) = ret;
12885 		} else {
12886 			*EG(return_value_ptr_ptr) = retval_ptr;
12887 			Z_ADDREF_P(retval_ptr);
12888 		}
12889 	}
12890 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12891 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12892 }
12893 
ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12894 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12895 {
12896 	USE_OPLINE
12897 	zval *retval_ptr;
12898 	zval **retval_ptr_ptr;
12899 	zend_free_op free_op1;
12900 
12901 	SAVE_OPLINE();
12902 
12903 	do {
12904 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
12905 			/* Not supposed to happen, but we'll allow it */
12906 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
12907 
12908 			retval_ptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12909 			if (!EG(return_value_ptr_ptr)) {
12910 				if (IS_VAR == IS_TMP_VAR) {
12911 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12912 				}
12913 			} else if (!0) { /* Not a temp var */
12914 				zval *ret;
12915 
12916 				ALLOC_ZVAL(ret);
12917 				INIT_PZVAL_COPY(ret, retval_ptr);
12918 				zval_copy_ctor(ret);
12919 				*EG(return_value_ptr_ptr) = ret;
12920 			} else {
12921 				zval *ret;
12922 
12923 				ALLOC_ZVAL(ret);
12924 				INIT_PZVAL_COPY(ret, retval_ptr);
12925 				*EG(return_value_ptr_ptr) = ret;
12926 			}
12927 			break;
12928 		}
12929 
12930 		retval_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12931 
12932 		if (IS_VAR == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
12933 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
12934 		}
12935 
12936 		if (IS_VAR == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
12937 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
12938 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
12939 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
12940 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
12941 				if (EG(return_value_ptr_ptr)) {
12942 					zval *ret;
12943 
12944 					ALLOC_ZVAL(ret);
12945 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
12946 					zval_copy_ctor(ret);
12947 					*EG(return_value_ptr_ptr) = ret;
12948 				}
12949 				break;
12950 			}
12951 		}
12952 
12953 		if (EG(return_value_ptr_ptr)) {
12954 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
12955 			Z_ADDREF_PP(retval_ptr_ptr);
12956 
12957 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
12958 		}
12959 	} while (0);
12960 
12961 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12962 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
12963 }
12964 
ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)12965 static int ZEND_FASTCALL  ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
12966 {
12967 	USE_OPLINE
12968 	zval *value;
12969 	zval *exception;
12970 	zend_free_op free_op1;
12971 
12972 	SAVE_OPLINE();
12973 	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
12974 
12975 	if (IS_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
12976 		if (UNEXPECTED(EG(exception) != NULL)) {
12977 			HANDLE_EXCEPTION();
12978 		}
12979 		zend_error_noreturn(E_ERROR, "Can only throw objects");
12980 	}
12981 
12982 	zend_exception_save(TSRMLS_C);
12983 	/* Not sure if a complete copy is what we want here */
12984 	ALLOC_ZVAL(exception);
12985 	INIT_PZVAL_COPY(exception, value);
12986 	if (!0) {
12987 		zval_copy_ctor(exception);
12988 	}
12989 
12990 	zend_throw_exception_object(exception TSRMLS_CC);
12991 	zend_exception_restore(TSRMLS_C);
12992 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
12993 	HANDLE_EXCEPTION();
12994 }
12995 
zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS)12996 static int ZEND_FASTCALL zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS)
12997 {
12998 	USE_OPLINE
12999 	zval *varptr;
13000 	zend_free_op free_op1;
13001 	varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13002 
13003 	if (varptr == &EG(uninitialized_zval)) {
13004 		ALLOC_ZVAL(varptr);
13005 		INIT_ZVAL(*varptr);
13006 		Z_SET_REFCOUNT_P(varptr, 0);
13007 	} else if (PZVAL_IS_REF(varptr)) {
13008 		zval *original_var = varptr;
13009 
13010 		ALLOC_ZVAL(varptr);
13011 		ZVAL_COPY_VALUE(varptr, original_var);
13012 		Z_UNSET_ISREF_P(varptr);
13013 		Z_SET_REFCOUNT_P(varptr, 0);
13014 		zval_copy_ctor(varptr);
13015 	}
13016 	Z_ADDREF_P(varptr);
13017 	zend_vm_stack_push(varptr TSRMLS_CC);
13018 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};  /* for string offsets */
13019 
13020 	CHECK_EXCEPTION();
13021 	ZEND_VM_NEXT_OPCODE();
13022 }
13023 
ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13024 static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13025 {
13026 	USE_OPLINE
13027 	zend_free_op free_op1;
13028 	zval *varptr;
13029 
13030 	SAVE_OPLINE();
13031 	if (opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) { /* Had function_ptr at compile_time */
13032 		if (!(opline->extended_value & ZEND_ARG_SEND_BY_REF)) {
13033 			return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13034 		}
13035 	} else if (!ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
13036 		return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13037 	}
13038 
13039 	if (IS_VAR == IS_VAR &&
13040 		(opline->extended_value & ZEND_ARG_SEND_FUNCTION) &&
13041 		EX_T(opline->op1.var).var.fcall_returned_reference &&
13042 		EX_T(opline->op1.var).var.ptr) {
13043 		varptr = EX_T(opline->op1.var).var.ptr;
13044 		PZVAL_UNLOCK_EX(varptr, &free_op1, 0);
13045 	} else {
13046 		varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13047 	}
13048 	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
13049 	     EX_T(opline->op1.var).var.fcall_returned_reference) &&
13050 	    varptr != &EG(uninitialized_zval) &&
13051 	    (PZVAL_IS_REF(varptr) ||
13052 	     (Z_REFCOUNT_P(varptr) == 1 && (IS_VAR == IS_CV || free_op1.var)))) {
13053 		Z_SET_ISREF_P(varptr);
13054 		Z_ADDREF_P(varptr);
13055 		zend_vm_stack_push(varptr TSRMLS_CC);
13056 	} else {
13057 		zval *valptr;
13058 
13059 		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
13060 			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
13061 			!ARG_MAY_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
13062 			zend_error(E_STRICT, "Only variables should be passed by reference");
13063 		}
13064 		ALLOC_ZVAL(valptr);
13065 		INIT_PZVAL_COPY(valptr, varptr);
13066 		if (!0) {
13067 			zval_copy_ctor(valptr);
13068 		}
13069 		zend_vm_stack_push(valptr TSRMLS_CC);
13070 	}
13071 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13072 	CHECK_EXCEPTION();
13073 	ZEND_VM_NEXT_OPCODE();
13074 }
13075 
ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13076 static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13077 {
13078 	USE_OPLINE
13079 	zend_free_op free_op1;
13080 	zval **varptr_ptr;
13081 	zval *varptr;
13082 
13083 	SAVE_OPLINE();
13084 	varptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13085 
13086 	if (IS_VAR == IS_VAR && UNEXPECTED(varptr_ptr == NULL)) {
13087 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
13088 	}
13089 
13090 	if (IS_VAR == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
13091 		ALLOC_INIT_ZVAL(varptr);
13092 		zend_vm_stack_push(varptr TSRMLS_CC);
13093 		CHECK_EXCEPTION();
13094 		ZEND_VM_NEXT_OPCODE();
13095 	}
13096 
13097 	if (opline->extended_value == ZEND_DO_FCALL_BY_NAME &&
13098 	    EX(function_state).function->type == ZEND_INTERNAL_FUNCTION &&
13099 	    !ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
13100 		return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13101 	}
13102 
13103 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
13104 	varptr = *varptr_ptr;
13105 	Z_ADDREF_P(varptr);
13106 	zend_vm_stack_push(varptr TSRMLS_CC);
13107 
13108 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13109 	CHECK_EXCEPTION();
13110 	ZEND_VM_NEXT_OPCODE();
13111 }
13112 
ZEND_SEND_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13113 static int ZEND_FASTCALL  ZEND_SEND_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13114 {
13115 	USE_OPLINE
13116 
13117 	if ((opline->extended_value == ZEND_DO_FCALL_BY_NAME)
13118 		&& ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
13119 		return ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13120 	}
13121 	SAVE_OPLINE();
13122 	return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
13123 }
13124 
ZEND_BOOL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13125 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13126 {
13127 	USE_OPLINE
13128 	zend_free_op free_op1;
13129 	zval *retval = &EX_T(opline->result.var).tmp_var;
13130 
13131 	SAVE_OPLINE();
13132 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
13133 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC)));
13134 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13135 
13136 	CHECK_EXCEPTION();
13137 	ZEND_VM_NEXT_OPCODE();
13138 }
13139 
ZEND_SWITCH_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13140 static int ZEND_FASTCALL  ZEND_SWITCH_FREE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13141 {
13142 	USE_OPLINE
13143 
13144 	SAVE_OPLINE();
13145 	zval_ptr_dtor(&EX_T(opline->op1.var).var.ptr);
13146 	CHECK_EXCEPTION();
13147 	ZEND_VM_NEXT_OPCODE();
13148 }
13149 
ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13150 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13151 {
13152 	USE_OPLINE
13153 	zend_free_op free_op1;
13154 	zval *obj;
13155 	zend_class_entry *ce;
13156 	zend_function *clone;
13157 	zend_object_clone_obj_t clone_call;
13158 
13159 	SAVE_OPLINE();
13160 	obj = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13161 
13162 	if (IS_VAR == IS_CONST ||
13163 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
13164 		if (UNEXPECTED(EG(exception) != NULL)) {
13165 			HANDLE_EXCEPTION();
13166 		}
13167 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
13168 	}
13169 
13170 	ce = Z_OBJCE_P(obj);
13171 	clone = ce ? ce->clone : NULL;
13172 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
13173 	if (UNEXPECTED(clone_call == NULL)) {
13174 		if (ce) {
13175 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
13176 		} else {
13177 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
13178 		}
13179 	}
13180 
13181 	if (ce && clone) {
13182 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
13183 			/* Ensure that if we're calling a private function, we're allowed to do so.
13184 			 */
13185 			if (UNEXPECTED(ce != EG(scope))) {
13186 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
13187 			}
13188 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
13189 			/* Ensure that if we're calling a protected function, we're allowed to do so.
13190 			 */
13191 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
13192 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
13193 			}
13194 		}
13195 	}
13196 
13197 	if (EXPECTED(EG(exception) == NULL)) {
13198 		zval *retval;
13199 
13200 		ALLOC_ZVAL(retval);
13201 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
13202 		Z_TYPE_P(retval) = IS_OBJECT;
13203 		Z_SET_REFCOUNT_P(retval, 1);
13204 		Z_SET_ISREF_P(retval);
13205 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
13206 			zval_ptr_dtor(&retval);
13207 		} else {
13208 			AI_SET_PTR(&EX_T(opline->result.var), retval);
13209 		}
13210 	}
13211 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13212 	CHECK_EXCEPTION();
13213 	ZEND_VM_NEXT_OPCODE();
13214 }
13215 
ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13216 static int ZEND_FASTCALL  ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13217 {
13218 	USE_OPLINE
13219 	zend_free_op free_op1;
13220 	zval *expr;
13221 	zval *result = &EX_T(opline->result.var).tmp_var;
13222 
13223 	SAVE_OPLINE();
13224 	expr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13225 
13226 	if (opline->extended_value != IS_STRING) {
13227 		ZVAL_COPY_VALUE(result, expr);
13228 		if (!0) {
13229 			zendi_zval_copy_ctor(*result);
13230 		}
13231 	}
13232 	switch (opline->extended_value) {
13233 		case IS_NULL:
13234 			convert_to_null(result);
13235 			break;
13236 		case IS_BOOL:
13237 			convert_to_boolean(result);
13238 			break;
13239 		case IS_LONG:
13240 			convert_to_long(result);
13241 			break;
13242 		case IS_DOUBLE:
13243 			convert_to_double(result);
13244 			break;
13245 		case IS_STRING: {
13246 			zval var_copy;
13247 			int use_copy;
13248 
13249 			zend_make_printable_zval(expr, &var_copy, &use_copy);
13250 			if (use_copy) {
13251 				ZVAL_COPY_VALUE(result, &var_copy);
13252 				if (0) {
13253 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13254 				}
13255 			} else {
13256 				ZVAL_COPY_VALUE(result, expr);
13257 				if (!0) {
13258 					zendi_zval_copy_ctor(*result);
13259 				}
13260 			}
13261 			break;
13262 		}
13263 		case IS_ARRAY:
13264 			convert_to_array(result);
13265 			break;
13266 		case IS_OBJECT:
13267 			convert_to_object(result);
13268 			break;
13269 	}
13270 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13271 	CHECK_EXCEPTION();
13272 	ZEND_VM_NEXT_OPCODE();
13273 }
13274 
ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13275 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13276 {
13277 	USE_OPLINE
13278 	zend_op_array *new_op_array=NULL;
13279 	zend_free_op free_op1;
13280 	zval *inc_filename;
13281 	zval *tmp_inc_filename = NULL;
13282 	zend_bool failure_retval=0;
13283 
13284 	SAVE_OPLINE();
13285 	inc_filename = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13286 
13287 	if (inc_filename->type!=IS_STRING) {
13288 		MAKE_STD_ZVAL(tmp_inc_filename);
13289 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
13290 		zval_copy_ctor(tmp_inc_filename);
13291 		convert_to_string(tmp_inc_filename);
13292 		inc_filename = tmp_inc_filename;
13293 	}
13294 
13295 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
13296 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
13297 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
13298 		} else {
13299 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
13300 		}
13301 	} else {
13302 		switch (opline->extended_value) {
13303 			case ZEND_INCLUDE_ONCE:
13304 			case ZEND_REQUIRE_ONCE: {
13305 					zend_file_handle file_handle;
13306 					char *resolved_path;
13307 
13308 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
13309 					if (resolved_path) {
13310 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
13311 					} else {
13312 						resolved_path = Z_STRVAL_P(inc_filename);
13313 					}
13314 
13315 					if (failure_retval) {
13316 						/* do nothing, file already included */
13317 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
13318 
13319 						if (!file_handle.opened_path) {
13320 							file_handle.opened_path = estrdup(resolved_path);
13321 						}
13322 
13323 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
13324 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
13325 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
13326 						} else {
13327 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
13328 							failure_retval=1;
13329 						}
13330 					} else {
13331 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
13332 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
13333 						} else {
13334 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
13335 						}
13336 					}
13337 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
13338 						efree(resolved_path);
13339 					}
13340 				}
13341 				break;
13342 			case ZEND_INCLUDE:
13343 			case ZEND_REQUIRE:
13344 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
13345 				break;
13346 			case ZEND_EVAL: {
13347 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
13348 
13349 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
13350 					efree(eval_desc);
13351 				}
13352 				break;
13353 			EMPTY_SWITCH_DEFAULT_CASE()
13354 		}
13355 	}
13356 	if (tmp_inc_filename) {
13357 		zval_ptr_dtor(&tmp_inc_filename);
13358 	}
13359 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13360 	if (UNEXPECTED(EG(exception) != NULL)) {
13361 		HANDLE_EXCEPTION();
13362 	} else if (EXPECTED(new_op_array != NULL)) {
13363 		EX(original_return_value) = EG(return_value_ptr_ptr);
13364 		EG(active_op_array) = new_op_array;
13365 		if (RETURN_VALUE_USED(opline)) {
13366 			EX_T(opline->result.var).var.ptr = NULL;
13367 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13368 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
13369 		} else {
13370 			EG(return_value_ptr_ptr) = NULL;
13371 		}
13372 
13373 		EX(function_state).function = (zend_function *) new_op_array;
13374 		EX(object) = NULL;
13375 
13376 		if (!EG(active_symbol_table)) {
13377 			zend_rebuild_symbol_table(TSRMLS_C);
13378 		}
13379 
13380 		if (EXPECTED(zend_execute_ex == execute_ex)) {
13381 			ZEND_VM_ENTER();
13382 		} else {
13383 			zend_execute(new_op_array TSRMLS_CC);
13384 		}
13385 
13386 		EX(function_state).function = (zend_function *) EX(op_array);
13387 
13388 		EG(opline_ptr) = &EX(opline);
13389 		EG(active_op_array) = EX(op_array);
13390 		EG(return_value_ptr_ptr) = EX(original_return_value);
13391 		destroy_op_array(new_op_array TSRMLS_CC);
13392 		efree(new_op_array);
13393 		if (UNEXPECTED(EG(exception) != NULL)) {
13394 			zend_throw_exception_internal(NULL TSRMLS_CC);
13395 			HANDLE_EXCEPTION();
13396 		}
13397 
13398 	} else if (RETURN_VALUE_USED(opline)) {
13399 		zval *retval;
13400 
13401 		ALLOC_ZVAL(retval);
13402 		ZVAL_BOOL(retval, failure_retval);
13403 		INIT_PZVAL(retval);
13404 		AI_SET_PTR(&EX_T(opline->result.var), retval);
13405 	}
13406 	ZEND_VM_NEXT_OPCODE();
13407 }
13408 
ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13409 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13410 {
13411 	USE_OPLINE
13412 	zend_free_op free_op1;
13413 	zval *array_ptr, **array_ptr_ptr;
13414 	HashTable *fe_ht;
13415 	zend_object_iterator *iter = NULL;
13416 	zend_class_entry *ce = NULL;
13417 	zend_bool is_empty = 0;
13418 
13419 	SAVE_OPLINE();
13420 
13421 	if ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
13422 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
13423 		array_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13424 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
13425 			MAKE_STD_ZVAL(array_ptr);
13426 			ZVAL_NULL(array_ptr);
13427 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
13428 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
13429 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
13430 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13431 			}
13432 
13433 			ce = Z_OBJCE_PP(array_ptr_ptr);
13434 			if (!ce || ce->get_iterator == NULL) {
13435 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
13436 				Z_ADDREF_PP(array_ptr_ptr);
13437 			}
13438 			array_ptr = *array_ptr_ptr;
13439 		} else {
13440 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
13441 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
13442 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
13443 					Z_SET_ISREF_PP(array_ptr_ptr);
13444 				}
13445 			}
13446 			array_ptr = *array_ptr_ptr;
13447 			Z_ADDREF_P(array_ptr);
13448 		}
13449 	} else {
13450 		array_ptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13451 		if (0) { /* IS_TMP_VAR */
13452 			zval *tmp;
13453 
13454 			ALLOC_ZVAL(tmp);
13455 			INIT_PZVAL_COPY(tmp, array_ptr);
13456 			array_ptr = tmp;
13457 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
13458 				ce = Z_OBJCE_P(array_ptr);
13459 				if (ce && ce->get_iterator) {
13460 					Z_DELREF_P(array_ptr);
13461 				}
13462 			}
13463 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
13464 			ce = Z_OBJCE_P(array_ptr);
13465 			if (!ce || !ce->get_iterator) {
13466 				Z_ADDREF_P(array_ptr);
13467 			}
13468 		} else if (IS_VAR == IS_CONST ||
13469 		           ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
13470 		            !Z_ISREF_P(array_ptr) &&
13471 		            Z_REFCOUNT_P(array_ptr) > 1)) {
13472 			zval *tmp;
13473 
13474 			ALLOC_ZVAL(tmp);
13475 			INIT_PZVAL_COPY(tmp, array_ptr);
13476 			zval_copy_ctor(tmp);
13477 			array_ptr = tmp;
13478 		} else {
13479 			Z_ADDREF_P(array_ptr);
13480 		}
13481 	}
13482 
13483 	if (ce && ce->get_iterator) {
13484 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
13485 
13486 		if (iter && EXPECTED(EG(exception) == NULL)) {
13487 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
13488 		} else {
13489 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13490 			if (!EG(exception)) {
13491 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
13492 			}
13493 			zend_throw_exception_internal(NULL TSRMLS_CC);
13494 			HANDLE_EXCEPTION();
13495 		}
13496 	}
13497 
13498 	EX_T(opline->result.var).fe.ptr = array_ptr;
13499 
13500 	if (iter) {
13501 		iter->index = 0;
13502 		if (iter->funcs->rewind) {
13503 			iter->funcs->rewind(iter TSRMLS_CC);
13504 			if (UNEXPECTED(EG(exception) != NULL)) {
13505 				zval_ptr_dtor(&array_ptr);
13506 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13507 				HANDLE_EXCEPTION();
13508 			}
13509 		}
13510 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
13511 		if (UNEXPECTED(EG(exception) != NULL)) {
13512 			zval_ptr_dtor(&array_ptr);
13513 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13514 			HANDLE_EXCEPTION();
13515 		}
13516 		iter->index = -1; /* will be set to 0 before using next handler */
13517 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
13518 		zend_hash_internal_pointer_reset(fe_ht);
13519 		if (ce) {
13520 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
13521 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
13522 				char *str_key;
13523 				uint str_key_len;
13524 				ulong int_key;
13525 				zend_uchar key_type;
13526 
13527 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
13528 				if (key_type != HASH_KEY_NON_EXISTENT &&
13529 					(key_type == HASH_KEY_IS_LONG ||
13530 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
13531 					break;
13532 				}
13533 				zend_hash_move_forward(fe_ht);
13534 			}
13535 		}
13536 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
13537 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
13538 	} else {
13539 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
13540 		is_empty = 1;
13541 	}
13542 
13543 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13544 	if (is_empty) {
13545 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13546 	} else {
13547 		CHECK_EXCEPTION();
13548 		ZEND_VM_NEXT_OPCODE();
13549 	}
13550 }
13551 
ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13552 static int ZEND_FASTCALL  ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13553 {
13554 	USE_OPLINE
13555 
13556 	zval *array = EX_T(opline->op1.var).fe.ptr;
13557 	zval **value;
13558 	HashTable *fe_ht;
13559 	zend_object_iterator *iter = NULL;
13560 
13561 	zval *key = NULL;
13562 	if (opline->extended_value & ZEND_FE_FETCH_WITH_KEY) {
13563 		key = &EX_T((opline+1)->result.var).tmp_var;
13564 	}
13565 
13566 	SAVE_OPLINE();
13567 
13568 	switch (zend_iterator_unwrap(array, &iter TSRMLS_CC)) {
13569 		default:
13570 		case ZEND_ITER_INVALID:
13571 			zend_error(E_WARNING, "Invalid argument supplied for foreach()");
13572 			ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13573 
13574 		case ZEND_ITER_PLAIN_OBJECT: {
13575 			zend_object *zobj = zend_objects_get_address(array TSRMLS_CC);
13576 			int key_type;
13577 			char *str_key;
13578 			zend_uint str_key_len;
13579 			zend_ulong int_key;
13580 
13581 			fe_ht = Z_OBJPROP_P(array);
13582 			zend_hash_set_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
13583 			do {
13584 				if (zend_hash_get_current_data(fe_ht, (void **) &value)==FAILURE) {
13585 					/* reached end of iteration */
13586 					ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13587 				}
13588 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
13589 
13590 				zend_hash_move_forward(fe_ht);
13591 			} while (key_type != HASH_KEY_IS_LONG &&
13592 			         zend_check_property_access(zobj, str_key, str_key_len - 1 TSRMLS_CC) != SUCCESS);
13593 
13594 			if (key) {
13595 				if (key_type == HASH_KEY_IS_LONG) {
13596 					ZVAL_LONG(key, int_key);
13597 				} else {
13598 					const char *class_name, *prop_name;
13599 					int prop_name_len;
13600 					zend_unmangle_property_name_ex(
13601 						str_key, str_key_len - 1, &class_name, &prop_name, &prop_name_len
13602 					);
13603 					ZVAL_STRINGL(key, prop_name, prop_name_len, 1);
13604 				}
13605 			}
13606 
13607 			zend_hash_get_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
13608 			break;
13609 		}
13610 
13611 		case ZEND_ITER_PLAIN_ARRAY:
13612 			fe_ht = Z_ARRVAL_P(array);
13613 			zend_hash_set_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
13614 			if (zend_hash_get_current_data(fe_ht, (void **) &value)==FAILURE) {
13615 				/* reached end of iteration */
13616 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13617 			}
13618 			if (key) {
13619 				zend_hash_get_current_key_zval(fe_ht, key);
13620 			}
13621 			zend_hash_move_forward(fe_ht);
13622 			zend_hash_get_pointer(fe_ht, &EX_T(opline->op1.var).fe.fe_pos);
13623 			break;
13624 
13625 		case ZEND_ITER_OBJECT:
13626 			/* !iter happens from exception */
13627 			if (iter && ++iter->index > 0) {
13628 				/* This could cause an endless loop if index becomes zero again.
13629 				 * In case that ever happens we need an additional flag. */
13630 				iter->funcs->move_forward(iter TSRMLS_CC);
13631 				if (UNEXPECTED(EG(exception) != NULL)) {
13632 					zval_ptr_dtor(&array);
13633 					HANDLE_EXCEPTION();
13634 				}
13635 			}
13636 			/* If index is zero we come from FE_RESET and checked valid() already. */
13637 			if (!iter || (iter->index > 0 && iter->funcs->valid(iter TSRMLS_CC) == FAILURE)) {
13638 				/* reached end of iteration */
13639 				if (UNEXPECTED(EG(exception) != NULL)) {
13640 					zval_ptr_dtor(&array);
13641 					HANDLE_EXCEPTION();
13642 				}
13643 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13644 			}
13645 			iter->funcs->get_current_data(iter, &value TSRMLS_CC);
13646 			if (UNEXPECTED(EG(exception) != NULL)) {
13647 				zval_ptr_dtor(&array);
13648 				HANDLE_EXCEPTION();
13649 			}
13650 			if (!value) {
13651 				/* failure in get_current_data */
13652 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
13653 			}
13654 			if (key) {
13655 				if (iter->funcs->get_current_key) {
13656 					iter->funcs->get_current_key(iter, key TSRMLS_CC);
13657 					if (UNEXPECTED(EG(exception) != NULL)) {
13658 						zval_ptr_dtor(&array);
13659 						HANDLE_EXCEPTION();
13660 					}
13661 				} else {
13662 					ZVAL_LONG(key, iter->index);
13663 				}
13664 			}
13665 			break;
13666 	}
13667 
13668 	if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
13669 		SEPARATE_ZVAL_IF_NOT_REF(value);
13670 		Z_SET_ISREF_PP(value);
13671 		EX_T(opline->result.var).var.ptr_ptr = value;
13672 		Z_ADDREF_PP(value);
13673 	} else {
13674 		PZVAL_LOCK(*value);
13675 		AI_SET_PTR(&EX_T(opline->result.var), *value);
13676 	}
13677 
13678 	CHECK_EXCEPTION();
13679 	ZEND_VM_INC_OPCODE();
13680 	ZEND_VM_NEXT_OPCODE();
13681 }
13682 
ZEND_EXIT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13683 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13684 {
13685 #if 0 || (IS_VAR != IS_UNUSED)
13686 	USE_OPLINE
13687 
13688 	SAVE_OPLINE();
13689 	if (IS_VAR != IS_UNUSED) {
13690 		zend_free_op free_op1;
13691 		zval *ptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13692 
13693 		if (Z_TYPE_P(ptr) == IS_LONG) {
13694 			EG(exit_status) = Z_LVAL_P(ptr);
13695 		} else {
13696 			zend_print_variable(ptr);
13697 		}
13698 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13699 	}
13700 #endif
13701 	zend_bailout();
13702 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
13703 }
13704 
ZEND_JMP_SET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13705 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13706 {
13707 	USE_OPLINE
13708 	zend_free_op free_op1;
13709 	zval *value;
13710 
13711 	SAVE_OPLINE();
13712 	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13713 
13714 	if (i_zend_is_true(value)) {
13715 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
13716 		if (!0) {
13717 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
13718 		}
13719 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13720 #if DEBUG_ZEND>=2
13721 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
13722 #endif
13723 		ZEND_VM_JMP(opline->op2.jmp_addr);
13724 	}
13725 
13726 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13727 	CHECK_EXCEPTION();
13728 	ZEND_VM_NEXT_OPCODE();
13729 }
13730 
ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13731 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13732 {
13733 	USE_OPLINE
13734 	zend_free_op free_op1;
13735 	zval *value, *ret;
13736 
13737 	SAVE_OPLINE();
13738 	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13739 
13740 	if (i_zend_is_true(value)) {
13741 		if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
13742 			Z_ADDREF_P(value);
13743 			EX_T(opline->result.var).var.ptr = value;
13744 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13745 		} else {
13746 			ALLOC_ZVAL(ret);
13747 			INIT_PZVAL_COPY(ret, value);
13748 			EX_T(opline->result.var).var.ptr = ret;
13749 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13750 			if (!0) {
13751 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
13752 			}
13753 		}
13754 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13755 #if DEBUG_ZEND>=2
13756 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
13757 #endif
13758 		ZEND_VM_JMP(opline->op2.jmp_addr);
13759 	}
13760 
13761 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13762 	CHECK_EXCEPTION();
13763 	ZEND_VM_NEXT_OPCODE();
13764 }
13765 
ZEND_QM_ASSIGN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13766 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13767 {
13768 	USE_OPLINE
13769 	zend_free_op free_op1;
13770 	zval *value;
13771 
13772 	SAVE_OPLINE();
13773 	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13774 
13775 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
13776 	if (!0) {
13777 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
13778 	}
13779 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13780 	CHECK_EXCEPTION();
13781 	ZEND_VM_NEXT_OPCODE();
13782 }
13783 
ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13784 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13785 {
13786 	USE_OPLINE
13787 	zend_free_op free_op1;
13788 	zval *value, *ret;
13789 
13790 	SAVE_OPLINE();
13791 	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13792 
13793 	if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
13794 		Z_ADDREF_P(value);
13795 		EX_T(opline->result.var).var.ptr = value;
13796 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13797 	} else {
13798 		ALLOC_ZVAL(ret);
13799 		INIT_PZVAL_COPY(ret, value);
13800 		EX_T(opline->result.var).var.ptr = ret;
13801 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
13802 		if (!0) {
13803 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
13804 		}
13805 	}
13806 
13807 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13808 	CHECK_EXCEPTION();
13809 	ZEND_VM_NEXT_OPCODE();
13810 }
13811 
ZEND_INSTANCEOF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13812 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13813 {
13814 	USE_OPLINE
13815 	zend_free_op free_op1;
13816 	zval *expr;
13817 	zend_bool result;
13818 
13819 	SAVE_OPLINE();
13820 	expr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
13821 
13822 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
13823 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
13824 	} else {
13825 		result = 0;
13826 	}
13827 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
13828 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13829 	CHECK_EXCEPTION();
13830 	ZEND_VM_NEXT_OPCODE();
13831 }
13832 
ZEND_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13833 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13834 {
13835 	USE_OPLINE
13836 	zend_free_op free_op1;
13837 
13838 	SAVE_OPLINE();
13839 	fast_add_function(&EX_T(opline->result.var).tmp_var,
13840 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13841 		opline->op2.zv TSRMLS_CC);
13842 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13843 
13844 	CHECK_EXCEPTION();
13845 	ZEND_VM_NEXT_OPCODE();
13846 }
13847 
ZEND_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13848 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13849 {
13850 	USE_OPLINE
13851 	zend_free_op free_op1;
13852 
13853 	SAVE_OPLINE();
13854 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
13855 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13856 		opline->op2.zv TSRMLS_CC);
13857 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13858 
13859 	CHECK_EXCEPTION();
13860 	ZEND_VM_NEXT_OPCODE();
13861 }
13862 
ZEND_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13863 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13864 {
13865 	USE_OPLINE
13866 	zend_free_op free_op1;
13867 
13868 	SAVE_OPLINE();
13869 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
13870 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13871 		opline->op2.zv TSRMLS_CC);
13872 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13873 
13874 	CHECK_EXCEPTION();
13875 	ZEND_VM_NEXT_OPCODE();
13876 }
13877 
ZEND_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13878 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13879 {
13880 	USE_OPLINE
13881 	zend_free_op free_op1;
13882 
13883 	SAVE_OPLINE();
13884 	fast_div_function(&EX_T(opline->result.var).tmp_var,
13885 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13886 		opline->op2.zv TSRMLS_CC);
13887 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13888 
13889 	CHECK_EXCEPTION();
13890 	ZEND_VM_NEXT_OPCODE();
13891 }
13892 
ZEND_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13893 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13894 {
13895 	USE_OPLINE
13896 	zend_free_op free_op1;
13897 
13898 	SAVE_OPLINE();
13899 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
13900 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13901 		opline->op2.zv TSRMLS_CC);
13902 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13903 
13904 	CHECK_EXCEPTION();
13905 	ZEND_VM_NEXT_OPCODE();
13906 }
13907 
ZEND_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13908 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13909 {
13910 	USE_OPLINE
13911 	zend_free_op free_op1;
13912 
13913 	SAVE_OPLINE();
13914 	shift_left_function(&EX_T(opline->result.var).tmp_var,
13915 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13916 		opline->op2.zv TSRMLS_CC);
13917 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13918 
13919 	CHECK_EXCEPTION();
13920 	ZEND_VM_NEXT_OPCODE();
13921 }
13922 
ZEND_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13923 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13924 {
13925 	USE_OPLINE
13926 	zend_free_op free_op1;
13927 
13928 	SAVE_OPLINE();
13929 	shift_right_function(&EX_T(opline->result.var).tmp_var,
13930 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13931 		opline->op2.zv TSRMLS_CC);
13932 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13933 
13934 	CHECK_EXCEPTION();
13935 	ZEND_VM_NEXT_OPCODE();
13936 }
13937 
ZEND_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13938 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13939 {
13940 	USE_OPLINE
13941 	zend_free_op free_op1;
13942 
13943 	SAVE_OPLINE();
13944 	concat_function(&EX_T(opline->result.var).tmp_var,
13945 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13946 		opline->op2.zv TSRMLS_CC);
13947 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13948 
13949 	CHECK_EXCEPTION();
13950 	ZEND_VM_NEXT_OPCODE();
13951 }
13952 
ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13953 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13954 {
13955 	USE_OPLINE
13956 	zend_free_op free_op1;
13957 
13958 	SAVE_OPLINE();
13959 	is_identical_function(&EX_T(opline->result.var).tmp_var,
13960 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13961 		opline->op2.zv TSRMLS_CC);
13962 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13963 
13964 	CHECK_EXCEPTION();
13965 	ZEND_VM_NEXT_OPCODE();
13966 }
13967 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13968 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13969 {
13970 	USE_OPLINE
13971 	zend_free_op free_op1;
13972 	zval *result = &EX_T(opline->result.var).tmp_var;
13973 
13974 	SAVE_OPLINE();
13975 	is_identical_function(result,
13976 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13977 		opline->op2.zv TSRMLS_CC);
13978 	Z_LVAL_P(result) = !Z_LVAL_P(result);
13979 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13980 
13981 	CHECK_EXCEPTION();
13982 	ZEND_VM_NEXT_OPCODE();
13983 }
13984 
ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)13985 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
13986 {
13987 	USE_OPLINE
13988 	zend_free_op free_op1;
13989 	zval *result = &EX_T(opline->result.var).tmp_var;
13990 
13991 	SAVE_OPLINE();
13992 	ZVAL_BOOL(result, fast_equal_function(result,
13993 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
13994 		opline->op2.zv TSRMLS_CC));
13995 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
13996 
13997 	CHECK_EXCEPTION();
13998 	ZEND_VM_NEXT_OPCODE();
13999 }
14000 
ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14001 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14002 {
14003 	USE_OPLINE
14004 	zend_free_op free_op1;
14005 	zval *result = &EX_T(opline->result.var).tmp_var;
14006 
14007 	SAVE_OPLINE();
14008 	ZVAL_BOOL(result, fast_not_equal_function(result,
14009 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14010 		opline->op2.zv TSRMLS_CC));
14011 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14012 
14013 	CHECK_EXCEPTION();
14014 	ZEND_VM_NEXT_OPCODE();
14015 }
14016 
ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14017 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14018 {
14019 	USE_OPLINE
14020 	zend_free_op free_op1;
14021 	zval *result = &EX_T(opline->result.var).tmp_var;
14022 
14023 	SAVE_OPLINE();
14024 	ZVAL_BOOL(result, fast_is_smaller_function(result,
14025 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14026 		opline->op2.zv TSRMLS_CC));
14027 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14028 
14029 	CHECK_EXCEPTION();
14030 	ZEND_VM_NEXT_OPCODE();
14031 }
14032 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14033 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14034 {
14035 	USE_OPLINE
14036 	zend_free_op free_op1;
14037 	zval *result = &EX_T(opline->result.var).tmp_var;
14038 
14039 	SAVE_OPLINE();
14040 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
14041 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14042 		opline->op2.zv TSRMLS_CC));
14043 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14044 
14045 	CHECK_EXCEPTION();
14046 	ZEND_VM_NEXT_OPCODE();
14047 }
14048 
ZEND_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14049 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14050 {
14051 	USE_OPLINE
14052 	zend_free_op free_op1;
14053 
14054 	SAVE_OPLINE();
14055 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
14056 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14057 		opline->op2.zv TSRMLS_CC);
14058 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14059 
14060 	CHECK_EXCEPTION();
14061 	ZEND_VM_NEXT_OPCODE();
14062 }
14063 
ZEND_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14064 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14065 {
14066 	USE_OPLINE
14067 	zend_free_op free_op1;
14068 
14069 	SAVE_OPLINE();
14070 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
14071 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14072 		opline->op2.zv TSRMLS_CC);
14073 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14074 
14075 	CHECK_EXCEPTION();
14076 	ZEND_VM_NEXT_OPCODE();
14077 }
14078 
ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14079 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14080 {
14081 	USE_OPLINE
14082 	zend_free_op free_op1;
14083 
14084 	SAVE_OPLINE();
14085 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
14086 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14087 		opline->op2.zv TSRMLS_CC);
14088 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14089 
14090 	CHECK_EXCEPTION();
14091 	ZEND_VM_NEXT_OPCODE();
14092 }
14093 
ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14094 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14095 {
14096 	USE_OPLINE
14097 	zend_free_op free_op1;
14098 
14099 	SAVE_OPLINE();
14100 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
14101 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
14102 		opline->op2.zv TSRMLS_CC);
14103 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14104 
14105 	CHECK_EXCEPTION();
14106 	ZEND_VM_NEXT_OPCODE();
14107 }
14108 
zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)14109 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
14110 {
14111 	USE_OPLINE
14112 	zend_free_op free_op1, free_op_data1;
14113 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14114 	zval *object;
14115 	zval *property = opline->op2.zv;
14116 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
14117 	int have_get_ptr = 0;
14118 
14119 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14120 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
14121 	}
14122 
14123 	make_real_object(object_ptr TSRMLS_CC);
14124 	object = *object_ptr;
14125 
14126 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14127 		zend_error(E_WARNING, "Attempt to assign property of non-object");
14128 
14129 		FREE_OP(free_op_data1);
14130 
14131 		if (RETURN_VALUE_USED(opline)) {
14132 			PZVAL_LOCK(&EG(uninitialized_zval));
14133 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
14134 			EX_T(opline->result.var).var.ptr_ptr = NULL;
14135 		}
14136 	} else {
14137 		/* here we are sure we are dealing with an object */
14138 		if (0) {
14139 			MAKE_REAL_ZVAL_PTR(property);
14140 		}
14141 
14142 		/* here property is a string */
14143 		if (opline->extended_value == ZEND_ASSIGN_OBJ
14144 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14145 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14146 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14147 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
14148 
14149 				have_get_ptr = 1;
14150 				binary_op(*zptr, *zptr, value TSRMLS_CC);
14151 				if (RETURN_VALUE_USED(opline)) {
14152 					PZVAL_LOCK(*zptr);
14153 					EX_T(opline->result.var).var.ptr = *zptr;
14154 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14155 				}
14156 			}
14157 		}
14158 
14159 		if (!have_get_ptr) {
14160 			zval *z = NULL;
14161 
14162 			Z_ADDREF_P(object);
14163 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
14164 				if (Z_OBJ_HT_P(object)->read_property) {
14165 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14166 				}
14167 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
14168 				if (Z_OBJ_HT_P(object)->read_dimension) {
14169 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
14170 				}
14171 			}
14172 			if (z) {
14173 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
14174 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
14175 
14176 					if (Z_REFCOUNT_P(z) == 0) {
14177 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
14178 						zval_dtor(z);
14179 						FREE_ZVAL(z);
14180 					}
14181 					z = value;
14182 				}
14183 				Z_ADDREF_P(z);
14184 				SEPARATE_ZVAL_IF_NOT_REF(&z);
14185 				binary_op(z, z, value TSRMLS_CC);
14186 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
14187 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14188 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
14189 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
14190 				}
14191 				if (RETURN_VALUE_USED(opline)) {
14192 					PZVAL_LOCK(z);
14193 					EX_T(opline->result.var).var.ptr = z;
14194 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14195 				}
14196 				zval_ptr_dtor(&z);
14197 			} else {
14198 				zend_error(E_WARNING, "Attempt to assign property of non-object");
14199 				if (RETURN_VALUE_USED(opline)) {
14200 					PZVAL_LOCK(&EG(uninitialized_zval));
14201 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
14202 					EX_T(opline->result.var).var.ptr_ptr = NULL;
14203 				}
14204 			}
14205 			zval_ptr_dtor(&object);
14206 		}
14207 
14208 		if (0) {
14209 			zval_ptr_dtor(&property);
14210 		} else {
14211 
14212 		}
14213 		FREE_OP(free_op_data1);
14214 	}
14215 
14216 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14217 	/* assign_obj has two opcodes! */
14218 	CHECK_EXCEPTION();
14219 	ZEND_VM_INC_OPCODE();
14220 	ZEND_VM_NEXT_OPCODE();
14221 }
14222 
zend_binary_assign_op_helper_SPEC_VAR_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)14223 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
14224 {
14225 	USE_OPLINE
14226 	zend_free_op free_op1, free_op_data2, free_op_data1;
14227 	zval **var_ptr;
14228 	zval *value;
14229 
14230 	SAVE_OPLINE();
14231 	switch (opline->extended_value) {
14232 		case ZEND_ASSIGN_OBJ:
14233 			return zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14234 			break;
14235 		case ZEND_ASSIGN_DIM: {
14236 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14237 
14238 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14239 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14240 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
14241 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
14242 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
14243 					}
14244 					return zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14245 				} else {
14246 					zval *dim = opline->op2.zv;
14247 
14248 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
14249 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
14250 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
14251 				}
14252 			}
14253 			break;
14254 		default:
14255 			value = opline->op2.zv;
14256 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14257 			/* do nothing */
14258 			break;
14259 	}
14260 
14261 	if (UNEXPECTED(var_ptr == NULL)) {
14262 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
14263 	}
14264 
14265 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
14266 		if (RETURN_VALUE_USED(opline)) {
14267 			PZVAL_LOCK(&EG(uninitialized_zval));
14268 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
14269 		}
14270 
14271 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14272 		CHECK_EXCEPTION();
14273 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
14274 			ZEND_VM_INC_OPCODE();
14275 		}
14276 		ZEND_VM_NEXT_OPCODE();
14277 	}
14278 
14279 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
14280 
14281 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
14282 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
14283 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
14284 		/* proxy object */
14285 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
14286 		Z_ADDREF_P(objval);
14287 		binary_op(objval, objval, value TSRMLS_CC);
14288 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
14289 		zval_ptr_dtor(&objval);
14290 	} else {
14291 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
14292 	}
14293 
14294 	if (RETURN_VALUE_USED(opline)) {
14295 		PZVAL_LOCK(*var_ptr);
14296 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
14297 	}
14298 
14299 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
14300 		FREE_OP(free_op_data1);
14301 		FREE_OP_VAR_PTR(free_op_data2);
14302 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14303 		CHECK_EXCEPTION();
14304 		ZEND_VM_INC_OPCODE();
14305 	} else {
14306 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14307 		CHECK_EXCEPTION();
14308 	}
14309 	ZEND_VM_NEXT_OPCODE();
14310 }
14311 
ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14312 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14313 {
14314 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14315 }
14316 
ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14317 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14318 {
14319 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14320 }
14321 
ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14322 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14323 {
14324 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14325 }
14326 
ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14327 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14328 {
14329 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14330 }
14331 
ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14332 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14333 {
14334 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14335 }
14336 
ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14337 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14338 {
14339 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14340 }
14341 
ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14342 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14343 {
14344 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14345 }
14346 
ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14347 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14348 {
14349 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14350 }
14351 
ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14352 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14353 {
14354 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14355 }
14356 
ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14357 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14358 {
14359 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14360 }
14361 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14362 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14363 {
14364 	return zend_binary_assign_op_helper_SPEC_VAR_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14365 }
14366 
zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)14367 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
14368 {
14369 	USE_OPLINE
14370 	zend_free_op free_op1;
14371 	zval **object_ptr;
14372 	zval *object;
14373 	zval *property;
14374 	zval **retval;
14375 	int have_get_ptr = 0;
14376 
14377 	SAVE_OPLINE();
14378 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14379 	property = opline->op2.zv;
14380 	retval = &EX_T(opline->result.var).var.ptr;
14381 
14382 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14383 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
14384 	}
14385 
14386 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
14387 	object = *object_ptr;
14388 
14389 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14390 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14391 
14392 		if (RETURN_VALUE_USED(opline)) {
14393 			PZVAL_LOCK(&EG(uninitialized_zval));
14394 			*retval = &EG(uninitialized_zval);
14395 		}
14396 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14397 		CHECK_EXCEPTION();
14398 		ZEND_VM_NEXT_OPCODE();
14399 	}
14400 
14401 	/* here we are sure we are dealing with an object */
14402 
14403 	if (0) {
14404 		MAKE_REAL_ZVAL_PTR(property);
14405 	}
14406 
14407 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14408 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14409 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14410 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
14411 
14412 			have_get_ptr = 1;
14413 			incdec_op(*zptr);
14414 			if (RETURN_VALUE_USED(opline)) {
14415 				*retval = *zptr;
14416 				PZVAL_LOCK(*retval);
14417 			}
14418 		}
14419 	}
14420 
14421 	if (!have_get_ptr) {
14422 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
14423 			zval *z;
14424 
14425 			Z_ADDREF_P(object);
14426 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14427 
14428 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
14429 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
14430 
14431 				if (Z_REFCOUNT_P(z) == 0) {
14432 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
14433 					zval_dtor(z);
14434 					FREE_ZVAL(z);
14435 				}
14436 				z = value;
14437 			}
14438 			Z_ADDREF_P(z);
14439 			SEPARATE_ZVAL_IF_NOT_REF(&z);
14440 			incdec_op(z);
14441 			*retval = z;
14442 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14443 			zval_ptr_dtor(&object);
14444 			SELECTIVE_PZVAL_LOCK(*retval, opline);
14445 			zval_ptr_dtor(&z);
14446 		} else {
14447 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14448 			if (RETURN_VALUE_USED(opline)) {
14449 				PZVAL_LOCK(&EG(uninitialized_zval));
14450 				*retval = &EG(uninitialized_zval);
14451 			}
14452 		}
14453 	}
14454 
14455 	if (0) {
14456 		zval_ptr_dtor(&property);
14457 	} else {
14458 
14459 	}
14460 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14461 	CHECK_EXCEPTION();
14462 	ZEND_VM_NEXT_OPCODE();
14463 }
14464 
ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14465 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14466 {
14467 	return zend_pre_incdec_property_helper_SPEC_VAR_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14468 }
14469 
ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14470 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14471 {
14472 	return zend_pre_incdec_property_helper_SPEC_VAR_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14473 }
14474 
zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)14475 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
14476 {
14477 	USE_OPLINE
14478 	zend_free_op free_op1;
14479 	zval **object_ptr;
14480 	zval *object;
14481 	zval *property;
14482 	zval *retval;
14483 	int have_get_ptr = 0;
14484 
14485 	SAVE_OPLINE();
14486 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14487 	property = opline->op2.zv;
14488 	retval = &EX_T(opline->result.var).tmp_var;
14489 
14490 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
14491 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
14492 	}
14493 
14494 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
14495 	object = *object_ptr;
14496 
14497 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
14498 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14499 
14500 		ZVAL_NULL(retval);
14501 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14502 		CHECK_EXCEPTION();
14503 		ZEND_VM_NEXT_OPCODE();
14504 	}
14505 
14506 	/* here we are sure we are dealing with an object */
14507 
14508 	if (0) {
14509 		MAKE_REAL_ZVAL_PTR(property);
14510 	}
14511 
14512 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
14513 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14514 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
14515 			have_get_ptr = 1;
14516 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
14517 
14518 			ZVAL_COPY_VALUE(retval, *zptr);
14519 			zendi_zval_copy_ctor(*retval);
14520 
14521 			incdec_op(*zptr);
14522 
14523 		}
14524 	}
14525 
14526 	if (!have_get_ptr) {
14527 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
14528 			zval *z, *z_copy;
14529 
14530 			Z_ADDREF_P(object);
14531 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14532 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
14533 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
14534 
14535 				if (Z_REFCOUNT_P(z) == 0) {
14536 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
14537 					zval_dtor(z);
14538 					FREE_ZVAL(z);
14539 				}
14540 				z = value;
14541 			}
14542 			ZVAL_COPY_VALUE(retval, z);
14543 			zendi_zval_copy_ctor(*retval);
14544 			ALLOC_ZVAL(z_copy);
14545 			INIT_PZVAL_COPY(z_copy, z);
14546 			zendi_zval_copy_ctor(*z_copy);
14547 			incdec_op(z_copy);
14548 			Z_ADDREF_P(z);
14549 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14550 			zval_ptr_dtor(&object);
14551 			zval_ptr_dtor(&z_copy);
14552 			zval_ptr_dtor(&z);
14553 		} else {
14554 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
14555 			ZVAL_NULL(retval);
14556 		}
14557 	}
14558 
14559 	if (0) {
14560 		zval_ptr_dtor(&property);
14561 	} else {
14562 
14563 	}
14564 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14565 	CHECK_EXCEPTION();
14566 	ZEND_VM_NEXT_OPCODE();
14567 }
14568 
ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14569 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14570 {
14571 	return zend_post_incdec_property_helper_SPEC_VAR_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14572 }
14573 
ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14574 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14575 {
14576 	return zend_post_incdec_property_helper_SPEC_VAR_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14577 }
14578 
zend_fetch_var_address_helper_SPEC_VAR_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)14579 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
14580 {
14581 	USE_OPLINE
14582 	zend_free_op free_op1;
14583 	zval *varname;
14584 	zval **retval;
14585 	zval tmp_varname;
14586 	HashTable *target_symbol_table;
14587 	ulong hash_value;
14588 
14589 	SAVE_OPLINE();
14590 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14591 
14592  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
14593 		ZVAL_COPY_VALUE(&tmp_varname, varname);
14594 		zval_copy_ctor(&tmp_varname);
14595 		Z_SET_REFCOUNT(tmp_varname, 1);
14596 		Z_UNSET_ISREF(tmp_varname);
14597 		convert_to_string(&tmp_varname);
14598 		varname = &tmp_varname;
14599 	}
14600 
14601 	if (IS_CONST != IS_UNUSED) {
14602 		zend_class_entry *ce;
14603 
14604 		if (IS_CONST == IS_CONST) {
14605 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
14606 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
14607 			} else {
14608 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
14609 				if (UNEXPECTED(ce == NULL)) {
14610 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
14611 						zval_dtor(&tmp_varname);
14612 					}
14613 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14614 					CHECK_EXCEPTION();
14615 					ZEND_VM_NEXT_OPCODE();
14616 				}
14617 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
14618 			}
14619 		} else {
14620 			ce = EX_T(opline->op2.var).class_entry;
14621 		}
14622 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
14623 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14624 	} else {
14625 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
14626 /*
14627 		if (!target_symbol_table) {
14628 			CHECK_EXCEPTION();
14629 			ZEND_VM_NEXT_OPCODE();
14630 		}
14631 */
14632 		if (IS_VAR == IS_CONST) {
14633 			hash_value = Z_HASH_P(varname);
14634 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
14635 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
14636 		} else {
14637 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
14638 		}
14639 
14640 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
14641 			switch (type) {
14642 				case BP_VAR_R:
14643 				case BP_VAR_UNSET:
14644 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
14645 					/* break missing intentionally */
14646 				case BP_VAR_IS:
14647 					retval = &EG(uninitialized_zval_ptr);
14648 					break;
14649 				case BP_VAR_RW:
14650 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
14651 					/* break missing intentionally */
14652 				case BP_VAR_W:
14653 					Z_ADDREF_P(&EG(uninitialized_zval));
14654 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
14655 					break;
14656 				EMPTY_SWITCH_DEFAULT_CASE()
14657 			}
14658 		}
14659 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
14660 			case ZEND_FETCH_GLOBAL:
14661 				if (IS_VAR != IS_TMP_VAR) {
14662 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14663 				}
14664 				break;
14665 			case ZEND_FETCH_LOCAL:
14666 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14667 				break;
14668 			case ZEND_FETCH_STATIC:
14669 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
14670 				break;
14671 			case ZEND_FETCH_GLOBAL_LOCK:
14672 				if (IS_VAR == IS_VAR && !free_op1.var) {
14673 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
14674 				}
14675 				break;
14676 		}
14677 	}
14678 
14679 
14680 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
14681 		zval_dtor(&tmp_varname);
14682 	}
14683 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
14684 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
14685 	}
14686 	PZVAL_LOCK(*retval);
14687 	switch (type) {
14688 		case BP_VAR_R:
14689 		case BP_VAR_IS:
14690 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
14691 			break;
14692 		case BP_VAR_UNSET: {
14693 			zend_free_op free_res;
14694 
14695 			PZVAL_UNLOCK(*retval, &free_res);
14696 			if (retval != &EG(uninitialized_zval_ptr)) {
14697 				SEPARATE_ZVAL_IF_NOT_REF(retval);
14698 			}
14699 			PZVAL_LOCK(*retval);
14700 			FREE_OP_VAR_PTR(free_res);
14701 		}
14702 		/* break missing intentionally */
14703 		default:
14704 			EX_T(opline->result.var).var.ptr_ptr = retval;
14705 			break;
14706 	}
14707 	CHECK_EXCEPTION();
14708 	ZEND_VM_NEXT_OPCODE();
14709 }
14710 
ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14711 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14712 {
14713 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14714 }
14715 
ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14716 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14717 {
14718 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14719 }
14720 
ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14721 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14722 {
14723 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14724 }
14725 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14726 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14727 {
14728 	USE_OPLINE
14729 
14730 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14731 }
14732 
ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14733 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14734 {
14735 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14736 }
14737 
ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14738 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14739 {
14740 	return zend_fetch_var_address_helper_SPEC_VAR_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14741 }
14742 
ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14743 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14744 {
14745 	USE_OPLINE
14746 	zend_free_op free_op1;
14747 	zval *container;
14748 
14749 	SAVE_OPLINE();
14750 
14751 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
14752 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
14753 	}
14754 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14755 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
14756 
14757 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14758 	CHECK_EXCEPTION();
14759 	ZEND_VM_NEXT_OPCODE();
14760 }
14761 
ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14762 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14763 {
14764 	USE_OPLINE
14765 	zend_free_op free_op1;
14766 	zval **container;
14767 
14768 	SAVE_OPLINE();
14769 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14770 
14771 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14772 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14773 	}
14774 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
14775 
14776 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
14777 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
14778 	}
14779 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14780 
14781 	/* We are going to assign the result by reference */
14782 	if (UNEXPECTED(opline->extended_value != 0)) {
14783 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
14784 
14785 		if (retval_ptr) {
14786 			Z_DELREF_PP(retval_ptr);
14787 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
14788 			Z_ADDREF_PP(retval_ptr);
14789 		}
14790 	}
14791 
14792 	CHECK_EXCEPTION();
14793 	ZEND_VM_NEXT_OPCODE();
14794 }
14795 
ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14796 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14797 {
14798 	USE_OPLINE
14799 	zend_free_op free_op1;
14800 	zval **container;
14801 
14802 	SAVE_OPLINE();
14803 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14804 
14805 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14806 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14807 	}
14808 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_RW TSRMLS_CC);
14809 
14810 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
14811 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
14812 	}
14813 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14814 	CHECK_EXCEPTION();
14815 	ZEND_VM_NEXT_OPCODE();
14816 }
14817 
ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14818 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14819 {
14820 	USE_OPLINE
14821 	zend_free_op free_op1;
14822 	zval *container;
14823 
14824 	SAVE_OPLINE();
14825 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14826 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_IS TSRMLS_CC);
14827 
14828 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14829 	CHECK_EXCEPTION();
14830 	ZEND_VM_NEXT_OPCODE();
14831 }
14832 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14833 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14834 {
14835 	USE_OPLINE
14836 	zend_free_op free_op1;
14837 
14838 	SAVE_OPLINE();
14839 
14840 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
14841 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14842 
14843 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14844 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14845 		}
14846 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
14847 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
14848 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
14849 		}
14850 
14851 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14852 	} else {
14853 		zval *container;
14854 
14855 		if (IS_CONST == IS_UNUSED) {
14856 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
14857 		}
14858 		container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14859 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
14860 
14861 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14862 	}
14863 	CHECK_EXCEPTION();
14864 	ZEND_VM_NEXT_OPCODE();
14865 }
14866 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14867 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14868 {
14869 	USE_OPLINE
14870 	zend_free_op free_op1;
14871 	zval **container;
14872 
14873 	SAVE_OPLINE();
14874 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14875 
14876 	if (IS_VAR == IS_CV) {
14877 		if (container != &EG(uninitialized_zval_ptr)) {
14878 			SEPARATE_ZVAL_IF_NOT_REF(container);
14879 		}
14880 	}
14881 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14882 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
14883 	}
14884 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_UNSET TSRMLS_CC);
14885 
14886 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
14887 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
14888 	}
14889 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14890 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
14891 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
14892 		ZEND_VM_NEXT_OPCODE();
14893 	} else {
14894 		zend_free_op free_res;
14895 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
14896 
14897 		PZVAL_UNLOCK(*retval_ptr, &free_res);
14898 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
14899 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
14900 		}
14901 		PZVAL_LOCK(*retval_ptr);
14902 		FREE_OP_VAR_PTR(free_res);
14903 		CHECK_EXCEPTION();
14904 		ZEND_VM_NEXT_OPCODE();
14905 	}
14906 }
14907 
zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS)14908 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS)
14909 {
14910 	USE_OPLINE
14911 	zend_free_op free_op1;
14912 	zval *container;
14913 
14914 	zval *offset;
14915 
14916 	SAVE_OPLINE();
14917 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14918 	offset  = opline->op2.zv;
14919 
14920 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
14921 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
14922 		zend_error(E_NOTICE, "Trying to get property of non-object");
14923 		PZVAL_LOCK(&EG(uninitialized_zval));
14924 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
14925 
14926 	} else {
14927 		zval *retval;
14928 
14929 		if (0) {
14930 			MAKE_REAL_ZVAL_PTR(offset);
14931 		}
14932 
14933 		/* here we are sure we are dealing with an object */
14934 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
14935 
14936 		PZVAL_LOCK(retval);
14937 		AI_SET_PTR(&EX_T(opline->result.var), retval);
14938 
14939 		if (0) {
14940 			zval_ptr_dtor(&offset);
14941 		} else {
14942 
14943 		}
14944 	}
14945 
14946 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14947 	CHECK_EXCEPTION();
14948 	ZEND_VM_NEXT_OPCODE();
14949 }
14950 
ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14951 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14952 {
14953 	return zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
14954 }
14955 
ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)14956 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
14957 {
14958 	USE_OPLINE
14959 	zend_free_op free_op1;
14960 	zval *property;
14961 	zval **container;
14962 
14963 	SAVE_OPLINE();
14964 	property = opline->op2.zv;
14965 
14966 	if (0) {
14967 		MAKE_REAL_ZVAL_PTR(property);
14968 	}
14969 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
14970 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
14971 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
14972 	}
14973 
14974 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
14975 	if (0) {
14976 		zval_ptr_dtor(&property);
14977 	} else {
14978 
14979 	}
14980 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
14981 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
14982 	}
14983 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
14984 
14985 	/* We are going to assign the result by reference */
14986 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
14987 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
14988 
14989 		Z_DELREF_PP(retval_ptr);
14990 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
14991 		Z_ADDREF_PP(retval_ptr);
14992 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
14993 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
14994 	}
14995 
14996 	CHECK_EXCEPTION();
14997 	ZEND_VM_NEXT_OPCODE();
14998 }
14999 
ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15000 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15001 {
15002 	USE_OPLINE
15003 	zend_free_op free_op1;
15004 	zval *property;
15005 	zval **container;
15006 
15007 	SAVE_OPLINE();
15008 	property = opline->op2.zv;
15009 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15010 
15011 	if (0) {
15012 		MAKE_REAL_ZVAL_PTR(property);
15013 	}
15014 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15015 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15016 	}
15017 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
15018 	if (0) {
15019 		zval_ptr_dtor(&property);
15020 	} else {
15021 
15022 	}
15023 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15024 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15025 	}
15026 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15027 	CHECK_EXCEPTION();
15028 	ZEND_VM_NEXT_OPCODE();
15029 }
15030 
ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15031 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15032 {
15033 	USE_OPLINE
15034 	zend_free_op free_op1;
15035 	zval *container;
15036 
15037 	zval *offset;
15038 
15039 	SAVE_OPLINE();
15040 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15041 	offset  = opline->op2.zv;
15042 
15043 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
15044 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
15045 		PZVAL_LOCK(&EG(uninitialized_zval));
15046 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15047 
15048 	} else {
15049 		zval *retval;
15050 
15051 		if (0) {
15052 			MAKE_REAL_ZVAL_PTR(offset);
15053 		}
15054 
15055 		/* here we are sure we are dealing with an object */
15056 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15057 
15058 		PZVAL_LOCK(retval);
15059 		AI_SET_PTR(&EX_T(opline->result.var), retval);
15060 
15061 		if (0) {
15062 			zval_ptr_dtor(&offset);
15063 		} else {
15064 
15065 		}
15066 	}
15067 
15068 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15069 	CHECK_EXCEPTION();
15070 	ZEND_VM_NEXT_OPCODE();
15071 }
15072 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15073 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15074 {
15075 	USE_OPLINE
15076 
15077 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
15078 		/* Behave like FETCH_OBJ_W */
15079 		zend_free_op free_op1;
15080 		zval *property;
15081 		zval **container;
15082 
15083 		SAVE_OPLINE();
15084 		property = opline->op2.zv;
15085 		container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15086 
15087 		if (0) {
15088 			MAKE_REAL_ZVAL_PTR(property);
15089 		}
15090 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15091 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15092 		}
15093 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
15094 		if (0) {
15095 			zval_ptr_dtor(&property);
15096 		} else {
15097 
15098 		}
15099 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15100 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15101 		}
15102 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15103 		CHECK_EXCEPTION();
15104 		ZEND_VM_NEXT_OPCODE();
15105 	} else {
15106 		return zend_fetch_property_address_read_helper_SPEC_VAR_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15107 	}
15108 }
15109 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15110 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15111 {
15112 	USE_OPLINE
15113 	zend_free_op free_op1, free_res;
15114 	zval **container;
15115 	zval *property;
15116 
15117 	SAVE_OPLINE();
15118 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15119 	property = opline->op2.zv;
15120 
15121 	if (IS_VAR == IS_CV) {
15122 		if (container != &EG(uninitialized_zval_ptr)) {
15123 			SEPARATE_ZVAL_IF_NOT_REF(container);
15124 		}
15125 	}
15126 	if (0) {
15127 		MAKE_REAL_ZVAL_PTR(property);
15128 	}
15129 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
15130 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
15131 	}
15132 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
15133 	if (0) {
15134 		zval_ptr_dtor(&property);
15135 	} else {
15136 
15137 	}
15138 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
15139 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
15140 	}
15141 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15142 
15143 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
15144 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
15145 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
15146 	}
15147 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
15148 	FREE_OP_VAR_PTR(free_res);
15149 	CHECK_EXCEPTION();
15150 	ZEND_VM_NEXT_OPCODE();
15151 }
15152 
ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15153 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15154 {
15155 	USE_OPLINE
15156 	zend_free_op free_op1;
15157 	zval **object_ptr;
15158 	zval *property_name;
15159 
15160 	SAVE_OPLINE();
15161 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15162 	property_name = opline->op2.zv;
15163 
15164 	if (0) {
15165 		MAKE_REAL_ZVAL_PTR(property_name);
15166 	}
15167 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
15168 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15169 	}
15170 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15171 	if (0) {
15172 		zval_ptr_dtor(&property_name);
15173 	} else {
15174 
15175 	}
15176 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15177 	/* assign_obj has two opcodes! */
15178 	CHECK_EXCEPTION();
15179 	ZEND_VM_INC_OPCODE();
15180 	ZEND_VM_NEXT_OPCODE();
15181 }
15182 
ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15183 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15184 {
15185 	USE_OPLINE
15186 	zend_free_op free_op1;
15187 	zval **object_ptr;
15188 
15189 	SAVE_OPLINE();
15190 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15191 
15192 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
15193 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
15194 	}
15195 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
15196 
15197 		zval *property_name = opline->op2.zv;
15198 
15199 		if (0) {
15200 			MAKE_REAL_ZVAL_PTR(property_name);
15201 		}
15202 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15203 		if (0) {
15204 			zval_ptr_dtor(&property_name);
15205 		} else {
15206 
15207 		}
15208 	} else {
15209 		zend_free_op free_op_data1, free_op_data2;
15210 		zval *value;
15211 		zval *dim = opline->op2.zv;
15212 		zval **variable_ptr_ptr;
15213 
15214 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CONST, BP_VAR_W TSRMLS_CC);
15215 
15216 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
15217 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
15218 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
15219 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
15220 				if (RETURN_VALUE_USED(opline)) {
15221 					zval *retval;
15222 
15223 					ALLOC_ZVAL(retval);
15224 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
15225 					INIT_PZVAL(retval);
15226 					AI_SET_PTR(&EX_T(opline->result.var), retval);
15227 				}
15228 			} else if (RETURN_VALUE_USED(opline)) {
15229 				PZVAL_LOCK(&EG(uninitialized_zval));
15230 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15231 			}
15232 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
15233 			if (IS_TMP_FREE(free_op_data1)) {
15234 				zval_dtor(value);
15235 			}
15236 			if (RETURN_VALUE_USED(opline)) {
15237 				PZVAL_LOCK(&EG(uninitialized_zval));
15238 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15239 			}
15240 		} else {
15241 			if ((opline+1)->op1_type == IS_TMP_VAR) {
15242 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15243 			} else if ((opline+1)->op1_type == IS_CONST) {
15244 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15245 			} else {
15246 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15247 			}
15248 			if (RETURN_VALUE_USED(opline)) {
15249 				PZVAL_LOCK(value);
15250 				AI_SET_PTR(&EX_T(opline->result.var), value);
15251 			}
15252 		}
15253 		FREE_OP_VAR_PTR(free_op_data2);
15254 	 	FREE_OP_IF_VAR(free_op_data1);
15255 	}
15256  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15257 	/* assign_dim has two opcodes! */
15258 	CHECK_EXCEPTION();
15259 	ZEND_VM_INC_OPCODE();
15260 	ZEND_VM_NEXT_OPCODE();
15261 }
15262 
ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15263 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15264 {
15265 	USE_OPLINE
15266 	zend_free_op free_op1;
15267 	zval *value;
15268 	zval **variable_ptr_ptr;
15269 
15270 	SAVE_OPLINE();
15271 	value = opline->op2.zv;
15272 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15273 
15274 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
15275 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CONST TSRMLS_CC)) {
15276 			if (RETURN_VALUE_USED(opline)) {
15277 				zval *retval;
15278 
15279 				ALLOC_ZVAL(retval);
15280 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
15281 				INIT_PZVAL(retval);
15282 				AI_SET_PTR(&EX_T(opline->result.var), retval);
15283 			}
15284 		} else if (RETURN_VALUE_USED(opline)) {
15285 			PZVAL_LOCK(&EG(uninitialized_zval));
15286 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15287 		}
15288 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
15289 		if (0) {
15290 			zval_dtor(value);
15291 		}
15292 		if (RETURN_VALUE_USED(opline)) {
15293 			PZVAL_LOCK(&EG(uninitialized_zval));
15294 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
15295 		}
15296 	} else {
15297 		if (IS_CONST == IS_TMP_VAR) {
15298 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15299 		} else if (IS_CONST == IS_CONST) {
15300 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15301 		} else {
15302 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
15303 		}
15304 		if (RETURN_VALUE_USED(opline)) {
15305 			PZVAL_LOCK(value);
15306 			AI_SET_PTR(&EX_T(opline->result.var), value);
15307 		}
15308 	}
15309 
15310 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
15311 		zval_ptr_dtor(&value);
15312 	}
15313 
15314 	/* zend_assign_to_variable() always takes care of op2, never free it! */
15315 
15316 	CHECK_EXCEPTION();
15317 	ZEND_VM_NEXT_OPCODE();
15318 }
15319 
ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15320 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15321 {
15322 	USE_OPLINE
15323 	zval *function_name;
15324 	char *function_name_strval;
15325 	int function_name_strlen;
15326 	zend_free_op free_op1;
15327 	call_slot *call = EX(call_slots) + opline->result.num;
15328 
15329 	SAVE_OPLINE();
15330 
15331 	function_name = opline->op2.zv;
15332 
15333 	if (IS_CONST != IS_CONST &&
15334 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
15335 		if (UNEXPECTED(EG(exception) != NULL)) {
15336 			HANDLE_EXCEPTION();
15337 		}
15338 		zend_error_noreturn(E_ERROR, "Method name must be a string");
15339 	}
15340 
15341 	function_name_strval = Z_STRVAL_P(function_name);
15342 	function_name_strlen = Z_STRLEN_P(function_name);
15343 
15344 	call->object = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15345 
15346 	if (EXPECTED(call->object != NULL) &&
15347 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
15348 		call->called_scope = Z_OBJCE_P(call->object);
15349 
15350 		if (IS_CONST != IS_CONST ||
15351 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
15352 		    zval *object = call->object;
15353 
15354 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
15355 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
15356 			}
15357 
15358 			/* First, locate the function. */
15359 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
15360 			if (UNEXPECTED(call->fbc == NULL)) {
15361 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
15362 			}
15363 			if (IS_CONST == IS_CONST &&
15364 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
15365 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
15366 			    EXPECTED(call->object == object)) {
15367 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
15368 			}
15369 		}
15370 	} else {
15371 		if (UNEXPECTED(EG(exception) != NULL)) {
15372 
15373 			HANDLE_EXCEPTION();
15374 		}
15375 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
15376 	}
15377 
15378 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
15379 		call->object = NULL;
15380 	} else {
15381 		if (!PZVAL_IS_REF(call->object)) {
15382 			Z_ADDREF_P(call->object); /* For $this pointer */
15383 		} else {
15384 			zval *this_ptr;
15385 			ALLOC_ZVAL(this_ptr);
15386 			INIT_PZVAL_COPY(this_ptr, call->object);
15387 			zval_copy_ctor(this_ptr);
15388 			call->object = this_ptr;
15389 		}
15390 	}
15391 	call->is_ctor_call = 0;
15392 	EX(call) = call;
15393 
15394 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15395 
15396 	CHECK_EXCEPTION();
15397 	ZEND_VM_NEXT_OPCODE();
15398 }
15399 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15400 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15401 {
15402 	USE_OPLINE
15403 	zval *function_name;
15404 	zend_class_entry *ce;
15405 	call_slot *call = EX(call_slots) + opline->result.num;
15406 
15407 	SAVE_OPLINE();
15408 
15409 	if (IS_VAR == IS_CONST) {
15410 		/* no function found. try a static method in class */
15411 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
15412 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
15413 		} else {
15414 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
15415 			if (UNEXPECTED(EG(exception) != NULL)) {
15416 				HANDLE_EXCEPTION();
15417 			}
15418 			if (UNEXPECTED(ce == NULL)) {
15419 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
15420 			}
15421 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
15422 		}
15423 		call->called_scope = ce;
15424 	} else {
15425 		ce = EX_T(opline->op1.var).class_entry;
15426 
15427 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
15428 			call->called_scope = EG(called_scope);
15429 		} else {
15430 			call->called_scope = ce;
15431 		}
15432 	}
15433 
15434 	if (IS_VAR == IS_CONST &&
15435 	    IS_CONST == IS_CONST &&
15436 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
15437 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
15438 	} else if (IS_VAR != IS_CONST &&
15439 	           IS_CONST == IS_CONST &&
15440 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
15441 		/* do nothing */
15442 	} else if (IS_CONST != IS_UNUSED) {
15443 		char *function_name_strval = NULL;
15444 		int function_name_strlen = 0;
15445 
15446 
15447 		if (IS_CONST == IS_CONST) {
15448 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
15449 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
15450 		} else {
15451 			function_name = opline->op2.zv;
15452 
15453 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
15454 				if (UNEXPECTED(EG(exception) != NULL)) {
15455 					HANDLE_EXCEPTION();
15456 				}
15457 				zend_error_noreturn(E_ERROR, "Function name must be a string");
15458 			} else {
15459 				function_name_strval = Z_STRVAL_P(function_name);
15460 				function_name_strlen = Z_STRLEN_P(function_name);
15461  			}
15462 		}
15463 
15464 		if (function_name_strval) {
15465 			if (ce->get_static_method) {
15466 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
15467 			} else {
15468 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
15469 			}
15470 			if (UNEXPECTED(call->fbc == NULL)) {
15471 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
15472 			}
15473 			if (IS_CONST == IS_CONST &&
15474 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
15475 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
15476 				if (IS_VAR == IS_CONST) {
15477 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
15478 				} else {
15479 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
15480 				}
15481 			}
15482 		}
15483 		if (IS_CONST != IS_CONST) {
15484 
15485 		}
15486 	} else {
15487 		if (UNEXPECTED(ce->constructor == NULL)) {
15488 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
15489 		}
15490 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
15491 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
15492 		}
15493 		call->fbc = ce->constructor;
15494 	}
15495 
15496 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
15497 		call->object = NULL;
15498 	} else {
15499 		if (EG(This) &&
15500 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
15501 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
15502 		    /* We are calling method of the other (incompatible) class,
15503 		       but passing $this. This is done for compatibility with php-4. */
15504 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
15505 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
15506 			} else {
15507 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
15508 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
15509 			}
15510 		}
15511 		if ((call->object = EG(This))) {
15512 			Z_ADDREF_P(call->object);
15513 			call->called_scope = Z_OBJCE_P(call->object);
15514 		}
15515 	}
15516 	call->is_ctor_call = 0;
15517 	EX(call) = call;
15518 
15519 	CHECK_EXCEPTION();
15520 	ZEND_VM_NEXT_OPCODE();
15521 }
15522 
ZEND_CASE_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15523 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15524 {
15525 	USE_OPLINE
15526 	zend_free_op free_op1;
15527 
15528 	SAVE_OPLINE();
15529 	if (IS_VAR==IS_VAR) {
15530 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
15531 	}
15532 	is_equal_function(&EX_T(opline->result.var).tmp_var,
15533 				 _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
15534 				 opline->op2.zv TSRMLS_CC);
15535 
15536 	CHECK_EXCEPTION();
15537 	ZEND_VM_NEXT_OPCODE();
15538 }
15539 
ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15540 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15541 {
15542 	USE_OPLINE
15543 
15544 	SAVE_OPLINE();
15545 	if (IS_VAR == IS_UNUSED) {
15546 		zend_constant *c;
15547 		zval *retval;
15548 
15549 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
15550 			c = CACHED_PTR(opline->op2.literal->cache_slot);
15551 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
15552 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
15553 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
15554 				if(!actual) {
15555 					actual = Z_STRVAL_P(opline->op2.zv);
15556 				} else {
15557 					actual++;
15558 				}
15559 				/* non-qualified constant - allow text substitution */
15560 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
15561 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
15562 				CHECK_EXCEPTION();
15563 				ZEND_VM_NEXT_OPCODE();
15564 			} else {
15565 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
15566 			}
15567 		} else {
15568 			CACHE_PTR(opline->op2.literal->cache_slot, c);
15569 		}
15570 		retval = &EX_T(opline->result.var).tmp_var;
15571 		ZVAL_COPY_VALUE(retval, &c->value);
15572 		zval_copy_ctor(retval);
15573 		CHECK_EXCEPTION();
15574 		ZEND_VM_NEXT_OPCODE();
15575 	} else {
15576 		/* class constant */
15577 		zend_class_entry *ce;
15578 		zval **value;
15579 
15580 		if (IS_VAR == IS_CONST) {
15581 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
15582 				value = CACHED_PTR(opline->op2.literal->cache_slot);
15583 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
15584 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
15585 				CHECK_EXCEPTION();
15586 				ZEND_VM_NEXT_OPCODE();
15587 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
15588 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
15589 			} else {
15590 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
15591 				if (UNEXPECTED(EG(exception) != NULL)) {
15592 					HANDLE_EXCEPTION();
15593 				}
15594 				if (UNEXPECTED(ce == NULL)) {
15595 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
15596 				}
15597 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
15598 			}
15599 		} else {
15600 			ce = EX_T(opline->op1.var).class_entry;
15601 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
15602 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
15603 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
15604 				CHECK_EXCEPTION();
15605 				ZEND_VM_NEXT_OPCODE();
15606 			}
15607 		}
15608 
15609 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
15610 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
15611 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
15612 				zend_class_entry *old_scope = EG(scope);
15613 
15614 				EG(scope) = ce;
15615 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
15616 				EG(scope) = old_scope;
15617 			}
15618 			if (IS_VAR == IS_CONST) {
15619 				CACHE_PTR(opline->op2.literal->cache_slot, value);
15620 			} else {
15621 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
15622 			}
15623 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
15624 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
15625 		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && strcmp(Z_STRVAL_P(opline->op2.zv), "class") == 0) {
15626 			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */
15627 			ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, ce->name, ce->name_length, 1);
15628 		} else {
15629 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
15630 		}
15631 
15632 		CHECK_EXCEPTION();
15633 		ZEND_VM_NEXT_OPCODE();
15634 	}
15635 }
15636 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15637 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15638 {
15639 	USE_OPLINE
15640 	zend_free_op free_op1;
15641 	zval *expr_ptr;
15642 
15643 	SAVE_OPLINE();
15644 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
15645 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15646 
15647 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
15648 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
15649 		}
15650 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
15651 		expr_ptr = *expr_ptr_ptr;
15652 		Z_ADDREF_P(expr_ptr);
15653 	} else {
15654 		expr_ptr=_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15655 		if (0) { /* temporary variable */
15656 			zval *new_expr;
15657 
15658 			ALLOC_ZVAL(new_expr);
15659 			INIT_PZVAL_COPY(new_expr, expr_ptr);
15660 			expr_ptr = new_expr;
15661 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
15662 			zval *new_expr;
15663 
15664 			ALLOC_ZVAL(new_expr);
15665 			INIT_PZVAL_COPY(new_expr, expr_ptr);
15666 			expr_ptr = new_expr;
15667 			zendi_zval_copy_ctor(*expr_ptr);
15668 		} else {
15669 			Z_ADDREF_P(expr_ptr);
15670 		}
15671 	}
15672 
15673 	if (IS_CONST != IS_UNUSED) {
15674 
15675 		zval *offset = opline->op2.zv;
15676 		ulong hval;
15677 
15678 		switch (Z_TYPE_P(offset)) {
15679 			case IS_DOUBLE:
15680 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
15681 				goto num_index;
15682 			case IS_LONG:
15683 			case IS_BOOL:
15684 				hval = Z_LVAL_P(offset);
15685 num_index:
15686 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
15687 				break;
15688 			case IS_STRING:
15689 				if (IS_CONST == IS_CONST) {
15690 					hval = Z_HASH_P(offset);
15691 				} else {
15692 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
15693 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
15694 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
15695 					} else {
15696 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
15697 					}
15698 				}
15699 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
15700 				break;
15701 			case IS_NULL:
15702 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
15703 				break;
15704 			default:
15705 				zend_error(E_WARNING, "Illegal offset type");
15706 				zval_ptr_dtor(&expr_ptr);
15707 				/* do nothing */
15708 				break;
15709 		}
15710 
15711 	} else {
15712 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
15713 	}
15714 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
15715 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15716 	} else {
15717 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15718 	}
15719 	CHECK_EXCEPTION();
15720 	ZEND_VM_NEXT_OPCODE();
15721 }
15722 
ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15723 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15724 {
15725 	USE_OPLINE
15726 
15727 	array_init(&EX_T(opline->result.var).tmp_var);
15728 	if (IS_VAR == IS_UNUSED) {
15729 		ZEND_VM_NEXT_OPCODE();
15730 #if 0 || IS_VAR != IS_UNUSED
15731 	} else {
15732 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
15733 #endif
15734 	}
15735 }
15736 
ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15737 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15738 {
15739 	USE_OPLINE
15740 	zval tmp, *varname;
15741 	HashTable *target_symbol_table;
15742 	zend_free_op free_op1;
15743 
15744 	SAVE_OPLINE();
15745 	if (IS_VAR == IS_CV &&
15746 	    IS_CONST == IS_UNUSED &&
15747 	    (opline->extended_value & ZEND_QUICK_SET)) {
15748 		if (EG(active_symbol_table)) {
15749 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
15750 
15751 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
15752 			EX_CV(opline->op1.var) = NULL;
15753 		} else if (EX_CV(opline->op1.var)) {
15754 			zval_ptr_dtor(EX_CV(opline->op1.var));
15755 			EX_CV(opline->op1.var) = NULL;
15756 		}
15757 		CHECK_EXCEPTION();
15758 		ZEND_VM_NEXT_OPCODE();
15759 	}
15760 
15761 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15762 
15763 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
15764 		ZVAL_COPY_VALUE(&tmp, varname);
15765 		zval_copy_ctor(&tmp);
15766 		convert_to_string(&tmp);
15767 		varname = &tmp;
15768 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
15769 		Z_ADDREF_P(varname);
15770 	}
15771 
15772 	if (IS_CONST != IS_UNUSED) {
15773 		zend_class_entry *ce;
15774 
15775 		if (IS_CONST == IS_CONST) {
15776 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
15777 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
15778 			} else {
15779 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
15780 				if (UNEXPECTED(EG(exception) != NULL)) {
15781 					if (IS_VAR != IS_CONST && varname == &tmp) {
15782 						zval_dtor(&tmp);
15783 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
15784 						zval_ptr_dtor(&varname);
15785 					}
15786 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15787 					HANDLE_EXCEPTION();
15788 				}
15789 				if (UNEXPECTED(ce == NULL)) {
15790 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
15791 				}
15792 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
15793 			}
15794 		} else {
15795 			ce = EX_T(opline->op2.var).class_entry;
15796 		}
15797 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
15798 	} else {
15799 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
15800 
15801 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
15802 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
15803 	}
15804 
15805 	if (IS_VAR != IS_CONST && varname == &tmp) {
15806 		zval_dtor(&tmp);
15807 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
15808 		zval_ptr_dtor(&varname);
15809 	}
15810 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15811 	CHECK_EXCEPTION();
15812 	ZEND_VM_NEXT_OPCODE();
15813 }
15814 
ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15815 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15816 {
15817 	USE_OPLINE
15818 	zend_free_op free_op1;
15819 	zval **container;
15820 	zval *offset;
15821 	ulong hval;
15822 
15823 	SAVE_OPLINE();
15824 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15825 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
15826 		SEPARATE_ZVAL_IF_NOT_REF(container);
15827 	}
15828 	offset = opline->op2.zv;
15829 
15830 	if (IS_VAR != IS_VAR || container) {
15831 		switch (Z_TYPE_PP(container)) {
15832 			case IS_ARRAY: {
15833 				HashTable *ht = Z_ARRVAL_PP(container);
15834 
15835 				switch (Z_TYPE_P(offset)) {
15836 					case IS_DOUBLE:
15837 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
15838 						zend_hash_index_del(ht, hval);
15839 						break;
15840 					case IS_RESOURCE:
15841 					case IS_BOOL:
15842 					case IS_LONG:
15843 						hval = Z_LVAL_P(offset);
15844 						zend_hash_index_del(ht, hval);
15845 						break;
15846 					case IS_STRING:
15847 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
15848 							Z_ADDREF_P(offset);
15849 						}
15850 						if (IS_CONST == IS_CONST) {
15851 							hval = Z_HASH_P(offset);
15852 						} else {
15853 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
15854 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
15855 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
15856 							} else {
15857 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
15858 							}
15859 						}
15860 						if (ht == &EG(symbol_table)) {
15861 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
15862 						} else {
15863 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
15864 						}
15865 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
15866 							zval_ptr_dtor(&offset);
15867 						}
15868 						break;
15869 num_index_dim:
15870 						zend_hash_index_del(ht, hval);
15871 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
15872 							zval_ptr_dtor(&offset);
15873 						}
15874 						break;
15875 					case IS_NULL:
15876 						zend_hash_del(ht, "", sizeof(""));
15877 						break;
15878 					default:
15879 						zend_error(E_WARNING, "Illegal offset type in unset");
15880 						break;
15881 				}
15882 
15883 				break;
15884 			}
15885 			case IS_OBJECT:
15886 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
15887 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
15888 				}
15889 				if (0) {
15890 					MAKE_REAL_ZVAL_PTR(offset);
15891 				}
15892 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
15893 				if (0) {
15894 					zval_ptr_dtor(&offset);
15895 				} else {
15896 
15897 				}
15898 				break;
15899 			case IS_STRING:
15900 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
15901 				ZEND_VM_CONTINUE(); /* bailed out before */
15902 			default:
15903 
15904 				break;
15905 		}
15906 	} else {
15907 
15908 	}
15909 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15910 
15911 	CHECK_EXCEPTION();
15912 	ZEND_VM_NEXT_OPCODE();
15913 }
15914 
ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15915 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15916 {
15917 	USE_OPLINE
15918 	zend_free_op free_op1;
15919 	zval **container;
15920 	zval *offset;
15921 
15922 	SAVE_OPLINE();
15923 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15924 	offset = opline->op2.zv;
15925 
15926 	if (IS_VAR != IS_VAR || container) {
15927 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
15928 			SEPARATE_ZVAL_IF_NOT_REF(container);
15929 		}
15930 		if (Z_TYPE_PP(container) == IS_OBJECT) {
15931 			if (0) {
15932 				MAKE_REAL_ZVAL_PTR(offset);
15933 			}
15934 			if (Z_OBJ_HT_P(*container)->unset_property) {
15935 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
15936 			} else {
15937 				zend_error(E_NOTICE, "Trying to unset property of non-object");
15938 			}
15939 			if (0) {
15940 				zval_ptr_dtor(&offset);
15941 			} else {
15942 
15943 			}
15944 		} else {
15945 
15946 		}
15947 	} else {
15948 
15949 	}
15950 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
15951 
15952 	CHECK_EXCEPTION();
15953 	ZEND_VM_NEXT_OPCODE();
15954 }
15955 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)15956 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
15957 {
15958 	USE_OPLINE
15959 	zval **value;
15960 	zend_bool isset = 1;
15961 
15962 	SAVE_OPLINE();
15963 	if (IS_VAR == IS_CV &&
15964 	    IS_CONST == IS_UNUSED &&
15965 	    (opline->extended_value & ZEND_QUICK_SET)) {
15966 		if (EX_CV(opline->op1.var)) {
15967 			value = EX_CV(opline->op1.var);
15968 		} else if (EG(active_symbol_table)) {
15969 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
15970 
15971 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
15972 				isset = 0;
15973 			}
15974 		} else {
15975 			isset = 0;
15976 		}
15977 	} else {
15978 		HashTable *target_symbol_table;
15979 		zend_free_op free_op1;
15980 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
15981 
15982 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
15983 			ZVAL_COPY_VALUE(&tmp, varname);
15984 			zval_copy_ctor(&tmp);
15985 			convert_to_string(&tmp);
15986 			varname = &tmp;
15987 		}
15988 
15989 		if (IS_CONST != IS_UNUSED) {
15990 			zend_class_entry *ce;
15991 
15992 			if (IS_CONST == IS_CONST) {
15993 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
15994 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
15995 				} else {
15996 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
15997 					if (UNEXPECTED(ce == NULL)) {
15998 						CHECK_EXCEPTION();
15999 						ZEND_VM_NEXT_OPCODE();
16000 					}
16001 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
16002 				}
16003 			} else {
16004 				ce = EX_T(opline->op2.var).class_entry;
16005 			}
16006 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
16007 			if (!value) {
16008 				isset = 0;
16009 			}
16010 		} else {
16011 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
16012 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
16013 				isset = 0;
16014 			}
16015 		}
16016 
16017 		if (IS_VAR != IS_CONST && varname == &tmp) {
16018 			zval_dtor(&tmp);
16019 		}
16020 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16021 	}
16022 
16023 	if (opline->extended_value & ZEND_ISSET) {
16024 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
16025 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
16026 		} else {
16027 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
16028 		}
16029 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
16030 		if (!isset || !i_zend_is_true(*value)) {
16031 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
16032 		} else {
16033 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
16034 		}
16035 	}
16036 
16037 	CHECK_EXCEPTION();
16038 	ZEND_VM_NEXT_OPCODE();
16039 }
16040 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)16041 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
16042 {
16043 	USE_OPLINE
16044 	zend_free_op free_op1;
16045 	zval *container;
16046 	zval **value = NULL;
16047 	int result = 0;
16048 	ulong hval;
16049 	zval *offset;
16050 
16051 	SAVE_OPLINE();
16052 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16053 
16054 	offset = opline->op2.zv;
16055 
16056 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
16057 		HashTable *ht;
16058 		int isset = 0;
16059 
16060 		ht = Z_ARRVAL_P(container);
16061 
16062 		switch (Z_TYPE_P(offset)) {
16063 			case IS_DOUBLE:
16064 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
16065 				goto num_index_prop;
16066 			case IS_RESOURCE:
16067 			case IS_BOOL:
16068 			case IS_LONG:
16069 				hval = Z_LVAL_P(offset);
16070 num_index_prop:
16071 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
16072 					isset = 1;
16073 				}
16074 				break;
16075 			case IS_STRING:
16076 				if (IS_CONST == IS_CONST) {
16077 					hval = Z_HASH_P(offset);
16078 				} else {
16079 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
16080 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
16081 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
16082 					} else {
16083 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
16084 					}
16085 				}
16086 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
16087 					isset = 1;
16088 				}
16089 				break;
16090 			case IS_NULL:
16091 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
16092 					isset = 1;
16093 				}
16094 				break;
16095 			default:
16096 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
16097 				break;
16098 		}
16099 
16100 		if (opline->extended_value & ZEND_ISSET) {
16101 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
16102 				result = 0;
16103 			} else {
16104 				result = isset;
16105 			}
16106 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
16107 			if (!isset || !i_zend_is_true(*value)) {
16108 				result = 0;
16109 			} else {
16110 				result = 1;
16111 			}
16112 		}
16113 
16114 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
16115 		if (0) {
16116 			MAKE_REAL_ZVAL_PTR(offset);
16117 		}
16118 		if (prop_dim) {
16119 			if (Z_OBJ_HT_P(container)->has_property) {
16120 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16121 			} else {
16122 				zend_error(E_NOTICE, "Trying to check property of non-object");
16123 				result = 0;
16124 			}
16125 		} else {
16126 			if (Z_OBJ_HT_P(container)->has_dimension) {
16127 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
16128 			} else {
16129 				zend_error(E_NOTICE, "Trying to check element of non-array");
16130 				result = 0;
16131 			}
16132 		}
16133 		if (0) {
16134 			zval_ptr_dtor(&offset);
16135 		} else {
16136 
16137 		}
16138 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
16139 		zval tmp;
16140 
16141 		if (Z_TYPE_P(offset) != IS_LONG) {
16142 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
16143 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
16144 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
16145 				ZVAL_COPY_VALUE(&tmp, offset);
16146 				zval_copy_ctor(&tmp);
16147 				convert_to_long(&tmp);
16148 				offset = &tmp;
16149 			} else {
16150 				/* can not be converted to proper offset, return "not set" */
16151 				result = 0;
16152 			}
16153 		}
16154 		if (Z_TYPE_P(offset) == IS_LONG) {
16155 			if (opline->extended_value & ZEND_ISSET) {
16156 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
16157 					result = 1;
16158 				}
16159 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
16160 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
16161 					result = 1;
16162 				}
16163 			}
16164 		}
16165 
16166 	} else {
16167 
16168 	}
16169 
16170 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
16171 	if (opline->extended_value & ZEND_ISSET) {
16172 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
16173 	} else {
16174 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
16175 	}
16176 
16177 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16178 
16179 	CHECK_EXCEPTION();
16180 	ZEND_VM_NEXT_OPCODE();
16181 }
16182 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16183 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16184 {
16185 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16186 }
16187 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16188 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16189 {
16190 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16191 }
16192 
ZEND_YIELD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16193 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16194 {
16195 	USE_OPLINE
16196 
16197 	/* The generator object is stored in return_value_ptr_ptr */
16198 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
16199 
16200 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
16201 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
16202 	}
16203 
16204 	/* Destroy the previously yielded value */
16205 	if (generator->value) {
16206 		zval_ptr_dtor(&generator->value);
16207 	}
16208 
16209 	/* Destroy the previously yielded key */
16210 	if (generator->key) {
16211 		zval_ptr_dtor(&generator->key);
16212 	}
16213 
16214 	/* Set the new yielded value */
16215 	if (IS_VAR != IS_UNUSED) {
16216 		zend_free_op free_op1;
16217 
16218 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
16219 			/* Constants and temporary variables aren't yieldable by reference,
16220 			 * but we still allow them with a notice. */
16221 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
16222 				zval *value, *copy;
16223 
16224 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
16225 
16226 				value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16227 				ALLOC_ZVAL(copy);
16228 				INIT_PZVAL_COPY(copy, value);
16229 
16230 				/* Temporary variables don't need ctor copying */
16231 				if (!0) {
16232 					zval_copy_ctor(copy);
16233 				}
16234 
16235 				generator->value = copy;
16236 			} else {
16237 				zval **value_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16238 
16239 				if (IS_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
16240 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
16241 				}
16242 
16243 				/* If a function call result is yielded and the function did
16244 				 * not return by reference we throw a notice. */
16245 				if (IS_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
16246 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
16247 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
16248 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
16249 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
16250 
16251 					Z_ADDREF_PP(value_ptr);
16252 					generator->value = *value_ptr;
16253 				} else {
16254 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
16255 					Z_ADDREF_PP(value_ptr);
16256 					generator->value = *value_ptr;
16257 				}
16258 
16259 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16260 			}
16261 		} else {
16262 			zval *value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16263 
16264 			/* Consts, temporary variables and references need copying */
16265 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
16266 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
16267 			) {
16268 				zval *copy;
16269 
16270 				ALLOC_ZVAL(copy);
16271 				INIT_PZVAL_COPY(copy, value);
16272 
16273 				/* Temporary variables don't need ctor copying */
16274 				if (!0) {
16275 					zval_copy_ctor(copy);
16276 				}
16277 
16278 				generator->value = copy;
16279 			} else {
16280 				Z_ADDREF_P(value);
16281 				generator->value = value;
16282 			}
16283 
16284 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16285 		}
16286 	} else {
16287 		/* If no value was specified yield null */
16288 		Z_ADDREF(EG(uninitialized_zval));
16289 		generator->value = &EG(uninitialized_zval);
16290 	}
16291 
16292 	/* Set the new yielded key */
16293 	if (IS_CONST != IS_UNUSED) {
16294 
16295 		zval *key = opline->op2.zv;
16296 
16297 		/* Consts, temporary variables and references need copying */
16298 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
16299 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
16300 		) {
16301 			zval *copy;
16302 
16303 			ALLOC_ZVAL(copy);
16304 			INIT_PZVAL_COPY(copy, key);
16305 
16306 			/* Temporary variables don't need ctor copying */
16307 			if (!0) {
16308 				zval_copy_ctor(copy);
16309 			}
16310 
16311 			generator->key = copy;
16312 		} else {
16313 			Z_ADDREF_P(key);
16314 			generator->key = key;
16315 		}
16316 
16317 		if (Z_TYPE_P(generator->key) == IS_LONG
16318 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
16319 		) {
16320 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
16321 		}
16322 
16323 	} else {
16324 		/* If no key was specified we use auto-increment keys */
16325 		generator->largest_used_integer_key++;
16326 
16327 		ALLOC_INIT_ZVAL(generator->key);
16328 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
16329 	}
16330 
16331 	if (RETURN_VALUE_USED(opline)) {
16332 		/* If the return value of yield is used set the send
16333 		 * target and initialize it to NULL */
16334 		generator->send_target = &EX_T(opline->result.var).var.ptr;
16335 		Z_ADDREF(EG(uninitialized_zval));
16336 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
16337 	} else {
16338 		generator->send_target = NULL;
16339 	}
16340 
16341 	/* We increment to the next op, so we are at the correct position when the
16342 	 * generator is resumed. */
16343 	ZEND_VM_INC_OPCODE();
16344 
16345 	/* The GOTO VM uses a local opline variable. We need to set the opline
16346 	 * variable in execute_data so we don't resume at an old position. */
16347 	SAVE_OPLINE();
16348 
16349 	ZEND_VM_RETURN();
16350 }
16351 
ZEND_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16352 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16353 {
16354 	USE_OPLINE
16355 	zend_free_op free_op1, free_op2;
16356 
16357 	SAVE_OPLINE();
16358 	fast_add_function(&EX_T(opline->result.var).tmp_var,
16359 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16360 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16361 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16362 	zval_dtor(free_op2.var);
16363 	CHECK_EXCEPTION();
16364 	ZEND_VM_NEXT_OPCODE();
16365 }
16366 
ZEND_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16367 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16368 {
16369 	USE_OPLINE
16370 	zend_free_op free_op1, free_op2;
16371 
16372 	SAVE_OPLINE();
16373 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
16374 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16375 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16376 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16377 	zval_dtor(free_op2.var);
16378 	CHECK_EXCEPTION();
16379 	ZEND_VM_NEXT_OPCODE();
16380 }
16381 
ZEND_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16382 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16383 {
16384 	USE_OPLINE
16385 	zend_free_op free_op1, free_op2;
16386 
16387 	SAVE_OPLINE();
16388 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
16389 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16390 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16391 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16392 	zval_dtor(free_op2.var);
16393 	CHECK_EXCEPTION();
16394 	ZEND_VM_NEXT_OPCODE();
16395 }
16396 
ZEND_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16397 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16398 {
16399 	USE_OPLINE
16400 	zend_free_op free_op1, free_op2;
16401 
16402 	SAVE_OPLINE();
16403 	fast_div_function(&EX_T(opline->result.var).tmp_var,
16404 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16405 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16406 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16407 	zval_dtor(free_op2.var);
16408 	CHECK_EXCEPTION();
16409 	ZEND_VM_NEXT_OPCODE();
16410 }
16411 
ZEND_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16412 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16413 {
16414 	USE_OPLINE
16415 	zend_free_op free_op1, free_op2;
16416 
16417 	SAVE_OPLINE();
16418 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
16419 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16420 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16421 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16422 	zval_dtor(free_op2.var);
16423 	CHECK_EXCEPTION();
16424 	ZEND_VM_NEXT_OPCODE();
16425 }
16426 
ZEND_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16427 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16428 {
16429 	USE_OPLINE
16430 	zend_free_op free_op1, free_op2;
16431 
16432 	SAVE_OPLINE();
16433 	shift_left_function(&EX_T(opline->result.var).tmp_var,
16434 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16435 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16436 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16437 	zval_dtor(free_op2.var);
16438 	CHECK_EXCEPTION();
16439 	ZEND_VM_NEXT_OPCODE();
16440 }
16441 
ZEND_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16442 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16443 {
16444 	USE_OPLINE
16445 	zend_free_op free_op1, free_op2;
16446 
16447 	SAVE_OPLINE();
16448 	shift_right_function(&EX_T(opline->result.var).tmp_var,
16449 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16450 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16451 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16452 	zval_dtor(free_op2.var);
16453 	CHECK_EXCEPTION();
16454 	ZEND_VM_NEXT_OPCODE();
16455 }
16456 
ZEND_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16457 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16458 {
16459 	USE_OPLINE
16460 	zend_free_op free_op1, free_op2;
16461 
16462 	SAVE_OPLINE();
16463 	concat_function(&EX_T(opline->result.var).tmp_var,
16464 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16465 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16466 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16467 	zval_dtor(free_op2.var);
16468 	CHECK_EXCEPTION();
16469 	ZEND_VM_NEXT_OPCODE();
16470 }
16471 
ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16472 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16473 {
16474 	USE_OPLINE
16475 	zend_free_op free_op1, free_op2;
16476 
16477 	SAVE_OPLINE();
16478 	is_identical_function(&EX_T(opline->result.var).tmp_var,
16479 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16480 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16481 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16482 	zval_dtor(free_op2.var);
16483 	CHECK_EXCEPTION();
16484 	ZEND_VM_NEXT_OPCODE();
16485 }
16486 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16487 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16488 {
16489 	USE_OPLINE
16490 	zend_free_op free_op1, free_op2;
16491 	zval *result = &EX_T(opline->result.var).tmp_var;
16492 
16493 	SAVE_OPLINE();
16494 	is_identical_function(result,
16495 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16496 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16497 	Z_LVAL_P(result) = !Z_LVAL_P(result);
16498 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16499 	zval_dtor(free_op2.var);
16500 	CHECK_EXCEPTION();
16501 	ZEND_VM_NEXT_OPCODE();
16502 }
16503 
ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16504 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16505 {
16506 	USE_OPLINE
16507 	zend_free_op free_op1, free_op2;
16508 	zval *result = &EX_T(opline->result.var).tmp_var;
16509 
16510 	SAVE_OPLINE();
16511 	ZVAL_BOOL(result, fast_equal_function(result,
16512 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16513 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
16514 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16515 	zval_dtor(free_op2.var);
16516 	CHECK_EXCEPTION();
16517 	ZEND_VM_NEXT_OPCODE();
16518 }
16519 
ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16520 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16521 {
16522 	USE_OPLINE
16523 	zend_free_op free_op1, free_op2;
16524 	zval *result = &EX_T(opline->result.var).tmp_var;
16525 
16526 	SAVE_OPLINE();
16527 	ZVAL_BOOL(result, fast_not_equal_function(result,
16528 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16529 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
16530 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16531 	zval_dtor(free_op2.var);
16532 	CHECK_EXCEPTION();
16533 	ZEND_VM_NEXT_OPCODE();
16534 }
16535 
ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16536 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16537 {
16538 	USE_OPLINE
16539 	zend_free_op free_op1, free_op2;
16540 	zval *result = &EX_T(opline->result.var).tmp_var;
16541 
16542 	SAVE_OPLINE();
16543 	ZVAL_BOOL(result, fast_is_smaller_function(result,
16544 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16545 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
16546 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16547 	zval_dtor(free_op2.var);
16548 	CHECK_EXCEPTION();
16549 	ZEND_VM_NEXT_OPCODE();
16550 }
16551 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16552 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16553 {
16554 	USE_OPLINE
16555 	zend_free_op free_op1, free_op2;
16556 	zval *result = &EX_T(opline->result.var).tmp_var;
16557 
16558 	SAVE_OPLINE();
16559 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
16560 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16561 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
16562 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16563 	zval_dtor(free_op2.var);
16564 	CHECK_EXCEPTION();
16565 	ZEND_VM_NEXT_OPCODE();
16566 }
16567 
ZEND_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16568 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16569 {
16570 	USE_OPLINE
16571 	zend_free_op free_op1, free_op2;
16572 
16573 	SAVE_OPLINE();
16574 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
16575 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16576 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16577 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16578 	zval_dtor(free_op2.var);
16579 	CHECK_EXCEPTION();
16580 	ZEND_VM_NEXT_OPCODE();
16581 }
16582 
ZEND_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16583 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16584 {
16585 	USE_OPLINE
16586 	zend_free_op free_op1, free_op2;
16587 
16588 	SAVE_OPLINE();
16589 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
16590 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16591 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16592 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16593 	zval_dtor(free_op2.var);
16594 	CHECK_EXCEPTION();
16595 	ZEND_VM_NEXT_OPCODE();
16596 }
16597 
ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16598 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16599 {
16600 	USE_OPLINE
16601 	zend_free_op free_op1, free_op2;
16602 
16603 	SAVE_OPLINE();
16604 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
16605 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16606 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16607 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16608 	zval_dtor(free_op2.var);
16609 	CHECK_EXCEPTION();
16610 	ZEND_VM_NEXT_OPCODE();
16611 }
16612 
ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16613 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16614 {
16615 	USE_OPLINE
16616 	zend_free_op free_op1, free_op2;
16617 
16618 	SAVE_OPLINE();
16619 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
16620 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
16621 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
16622 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16623 	zval_dtor(free_op2.var);
16624 	CHECK_EXCEPTION();
16625 	ZEND_VM_NEXT_OPCODE();
16626 }
16627 
zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)16628 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
16629 {
16630 	USE_OPLINE
16631 	zend_free_op free_op1, free_op2, free_op_data1;
16632 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16633 	zval *object;
16634 	zval *property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
16635 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
16636 	int have_get_ptr = 0;
16637 
16638 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
16639 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
16640 	}
16641 
16642 	make_real_object(object_ptr TSRMLS_CC);
16643 	object = *object_ptr;
16644 
16645 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
16646 		zend_error(E_WARNING, "Attempt to assign property of non-object");
16647 		zval_dtor(free_op2.var);
16648 		FREE_OP(free_op_data1);
16649 
16650 		if (RETURN_VALUE_USED(opline)) {
16651 			PZVAL_LOCK(&EG(uninitialized_zval));
16652 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
16653 			EX_T(opline->result.var).var.ptr_ptr = NULL;
16654 		}
16655 	} else {
16656 		/* here we are sure we are dealing with an object */
16657 		if (1) {
16658 			MAKE_REAL_ZVAL_PTR(property);
16659 		}
16660 
16661 		/* here property is a string */
16662 		if (opline->extended_value == ZEND_ASSIGN_OBJ
16663 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
16664 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16665 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
16666 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
16667 
16668 				have_get_ptr = 1;
16669 				binary_op(*zptr, *zptr, value TSRMLS_CC);
16670 				if (RETURN_VALUE_USED(opline)) {
16671 					PZVAL_LOCK(*zptr);
16672 					EX_T(opline->result.var).var.ptr = *zptr;
16673 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16674 				}
16675 			}
16676 		}
16677 
16678 		if (!have_get_ptr) {
16679 			zval *z = NULL;
16680 
16681 			Z_ADDREF_P(object);
16682 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
16683 				if (Z_OBJ_HT_P(object)->read_property) {
16684 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16685 				}
16686 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
16687 				if (Z_OBJ_HT_P(object)->read_dimension) {
16688 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
16689 				}
16690 			}
16691 			if (z) {
16692 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
16693 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
16694 
16695 					if (Z_REFCOUNT_P(z) == 0) {
16696 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
16697 						zval_dtor(z);
16698 						FREE_ZVAL(z);
16699 					}
16700 					z = value;
16701 				}
16702 				Z_ADDREF_P(z);
16703 				SEPARATE_ZVAL_IF_NOT_REF(&z);
16704 				binary_op(z, z, value TSRMLS_CC);
16705 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
16706 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16707 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
16708 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
16709 				}
16710 				if (RETURN_VALUE_USED(opline)) {
16711 					PZVAL_LOCK(z);
16712 					EX_T(opline->result.var).var.ptr = z;
16713 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16714 				}
16715 				zval_ptr_dtor(&z);
16716 			} else {
16717 				zend_error(E_WARNING, "Attempt to assign property of non-object");
16718 				if (RETURN_VALUE_USED(opline)) {
16719 					PZVAL_LOCK(&EG(uninitialized_zval));
16720 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
16721 					EX_T(opline->result.var).var.ptr_ptr = NULL;
16722 				}
16723 			}
16724 			zval_ptr_dtor(&object);
16725 		}
16726 
16727 		if (1) {
16728 			zval_ptr_dtor(&property);
16729 		} else {
16730 			zval_dtor(free_op2.var);
16731 		}
16732 		FREE_OP(free_op_data1);
16733 	}
16734 
16735 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16736 	/* assign_obj has two opcodes! */
16737 	CHECK_EXCEPTION();
16738 	ZEND_VM_INC_OPCODE();
16739 	ZEND_VM_NEXT_OPCODE();
16740 }
16741 
zend_binary_assign_op_helper_SPEC_VAR_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)16742 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
16743 {
16744 	USE_OPLINE
16745 	zend_free_op free_op1, free_op2, free_op_data2, free_op_data1;
16746 	zval **var_ptr;
16747 	zval *value;
16748 
16749 	SAVE_OPLINE();
16750 	switch (opline->extended_value) {
16751 		case ZEND_ASSIGN_OBJ:
16752 			return zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16753 			break;
16754 		case ZEND_ASSIGN_DIM: {
16755 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16756 
16757 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
16758 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
16759 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
16760 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
16761 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
16762 					}
16763 					return zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16764 				} else {
16765 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
16766 
16767 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
16768 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
16769 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
16770 				}
16771 			}
16772 			break;
16773 		default:
16774 			value = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
16775 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16776 			/* do nothing */
16777 			break;
16778 	}
16779 
16780 	if (UNEXPECTED(var_ptr == NULL)) {
16781 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
16782 	}
16783 
16784 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
16785 		if (RETURN_VALUE_USED(opline)) {
16786 			PZVAL_LOCK(&EG(uninitialized_zval));
16787 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
16788 		}
16789 		zval_dtor(free_op2.var);
16790 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16791 		CHECK_EXCEPTION();
16792 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
16793 			ZEND_VM_INC_OPCODE();
16794 		}
16795 		ZEND_VM_NEXT_OPCODE();
16796 	}
16797 
16798 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
16799 
16800 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
16801 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
16802 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
16803 		/* proxy object */
16804 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
16805 		Z_ADDREF_P(objval);
16806 		binary_op(objval, objval, value TSRMLS_CC);
16807 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
16808 		zval_ptr_dtor(&objval);
16809 	} else {
16810 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
16811 	}
16812 
16813 	if (RETURN_VALUE_USED(opline)) {
16814 		PZVAL_LOCK(*var_ptr);
16815 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
16816 	}
16817 	zval_dtor(free_op2.var);
16818 
16819 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
16820 		FREE_OP(free_op_data1);
16821 		FREE_OP_VAR_PTR(free_op_data2);
16822 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16823 		CHECK_EXCEPTION();
16824 		ZEND_VM_INC_OPCODE();
16825 	} else {
16826 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16827 		CHECK_EXCEPTION();
16828 	}
16829 	ZEND_VM_NEXT_OPCODE();
16830 }
16831 
ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16832 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16833 {
16834 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16835 }
16836 
ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16837 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16838 {
16839 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16840 }
16841 
ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16842 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16843 {
16844 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16845 }
16846 
ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16847 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16848 {
16849 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16850 }
16851 
ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16852 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16853 {
16854 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16855 }
16856 
ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16857 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16858 {
16859 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16860 }
16861 
ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16862 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16863 {
16864 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16865 }
16866 
ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16867 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16868 {
16869 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16870 }
16871 
ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16872 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16873 {
16874 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16875 }
16876 
ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16877 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16878 {
16879 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16880 }
16881 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16882 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16883 {
16884 	return zend_binary_assign_op_helper_SPEC_VAR_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16885 }
16886 
zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)16887 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
16888 {
16889 	USE_OPLINE
16890 	zend_free_op free_op1, free_op2;
16891 	zval **object_ptr;
16892 	zval *object;
16893 	zval *property;
16894 	zval **retval;
16895 	int have_get_ptr = 0;
16896 
16897 	SAVE_OPLINE();
16898 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
16899 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
16900 	retval = &EX_T(opline->result.var).var.ptr;
16901 
16902 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
16903 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
16904 	}
16905 
16906 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
16907 	object = *object_ptr;
16908 
16909 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
16910 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16911 		zval_dtor(free_op2.var);
16912 		if (RETURN_VALUE_USED(opline)) {
16913 			PZVAL_LOCK(&EG(uninitialized_zval));
16914 			*retval = &EG(uninitialized_zval);
16915 		}
16916 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16917 		CHECK_EXCEPTION();
16918 		ZEND_VM_NEXT_OPCODE();
16919 	}
16920 
16921 	/* here we are sure we are dealing with an object */
16922 
16923 	if (1) {
16924 		MAKE_REAL_ZVAL_PTR(property);
16925 	}
16926 
16927 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
16928 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16929 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
16930 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
16931 
16932 			have_get_ptr = 1;
16933 			incdec_op(*zptr);
16934 			if (RETURN_VALUE_USED(opline)) {
16935 				*retval = *zptr;
16936 				PZVAL_LOCK(*retval);
16937 			}
16938 		}
16939 	}
16940 
16941 	if (!have_get_ptr) {
16942 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
16943 			zval *z;
16944 
16945 			Z_ADDREF_P(object);
16946 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16947 
16948 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
16949 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
16950 
16951 				if (Z_REFCOUNT_P(z) == 0) {
16952 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
16953 					zval_dtor(z);
16954 					FREE_ZVAL(z);
16955 				}
16956 				z = value;
16957 			}
16958 			Z_ADDREF_P(z);
16959 			SEPARATE_ZVAL_IF_NOT_REF(&z);
16960 			incdec_op(z);
16961 			*retval = z;
16962 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
16963 			zval_ptr_dtor(&object);
16964 			SELECTIVE_PZVAL_LOCK(*retval, opline);
16965 			zval_ptr_dtor(&z);
16966 		} else {
16967 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
16968 			if (RETURN_VALUE_USED(opline)) {
16969 				PZVAL_LOCK(&EG(uninitialized_zval));
16970 				*retval = &EG(uninitialized_zval);
16971 			}
16972 		}
16973 	}
16974 
16975 	if (1) {
16976 		zval_ptr_dtor(&property);
16977 	} else {
16978 		zval_dtor(free_op2.var);
16979 	}
16980 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
16981 	CHECK_EXCEPTION();
16982 	ZEND_VM_NEXT_OPCODE();
16983 }
16984 
ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16985 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16986 {
16987 	return zend_pre_incdec_property_helper_SPEC_VAR_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16988 }
16989 
ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)16990 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
16991 {
16992 	return zend_pre_incdec_property_helper_SPEC_VAR_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
16993 }
16994 
zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)16995 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
16996 {
16997 	USE_OPLINE
16998 	zend_free_op free_op1, free_op2;
16999 	zval **object_ptr;
17000 	zval *object;
17001 	zval *property;
17002 	zval *retval;
17003 	int have_get_ptr = 0;
17004 
17005 	SAVE_OPLINE();
17006 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17007 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17008 	retval = &EX_T(opline->result.var).tmp_var;
17009 
17010 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
17011 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
17012 	}
17013 
17014 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
17015 	object = *object_ptr;
17016 
17017 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
17018 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
17019 		zval_dtor(free_op2.var);
17020 		ZVAL_NULL(retval);
17021 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17022 		CHECK_EXCEPTION();
17023 		ZEND_VM_NEXT_OPCODE();
17024 	}
17025 
17026 	/* here we are sure we are dealing with an object */
17027 
17028 	if (1) {
17029 		MAKE_REAL_ZVAL_PTR(property);
17030 	}
17031 
17032 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
17033 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17034 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
17035 			have_get_ptr = 1;
17036 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
17037 
17038 			ZVAL_COPY_VALUE(retval, *zptr);
17039 			zendi_zval_copy_ctor(*retval);
17040 
17041 			incdec_op(*zptr);
17042 
17043 		}
17044 	}
17045 
17046 	if (!have_get_ptr) {
17047 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
17048 			zval *z, *z_copy;
17049 
17050 			Z_ADDREF_P(object);
17051 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17052 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
17053 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
17054 
17055 				if (Z_REFCOUNT_P(z) == 0) {
17056 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
17057 					zval_dtor(z);
17058 					FREE_ZVAL(z);
17059 				}
17060 				z = value;
17061 			}
17062 			ZVAL_COPY_VALUE(retval, z);
17063 			zendi_zval_copy_ctor(*retval);
17064 			ALLOC_ZVAL(z_copy);
17065 			INIT_PZVAL_COPY(z_copy, z);
17066 			zendi_zval_copy_ctor(*z_copy);
17067 			incdec_op(z_copy);
17068 			Z_ADDREF_P(z);
17069 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17070 			zval_ptr_dtor(&object);
17071 			zval_ptr_dtor(&z_copy);
17072 			zval_ptr_dtor(&z);
17073 		} else {
17074 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
17075 			ZVAL_NULL(retval);
17076 		}
17077 	}
17078 
17079 	if (1) {
17080 		zval_ptr_dtor(&property);
17081 	} else {
17082 		zval_dtor(free_op2.var);
17083 	}
17084 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17085 	CHECK_EXCEPTION();
17086 	ZEND_VM_NEXT_OPCODE();
17087 }
17088 
ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17089 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17090 {
17091 	return zend_post_incdec_property_helper_SPEC_VAR_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17092 }
17093 
ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17094 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17095 {
17096 	return zend_post_incdec_property_helper_SPEC_VAR_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17097 }
17098 
ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17099 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17100 {
17101 	USE_OPLINE
17102 	zend_free_op free_op1, free_op2;
17103 	zval *container;
17104 
17105 	SAVE_OPLINE();
17106 
17107 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
17108 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
17109 	}
17110 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17111 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
17112 	zval_dtor(free_op2.var);
17113 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17114 	CHECK_EXCEPTION();
17115 	ZEND_VM_NEXT_OPCODE();
17116 }
17117 
ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17118 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17119 {
17120 	USE_OPLINE
17121 	zend_free_op free_op1, free_op2;
17122 	zval **container;
17123 
17124 	SAVE_OPLINE();
17125 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17126 
17127 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17128 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17129 	}
17130 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
17131 	zval_dtor(free_op2.var);
17132 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17133 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17134 	}
17135 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17136 
17137 	/* We are going to assign the result by reference */
17138 	if (UNEXPECTED(opline->extended_value != 0)) {
17139 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17140 
17141 		if (retval_ptr) {
17142 			Z_DELREF_PP(retval_ptr);
17143 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
17144 			Z_ADDREF_PP(retval_ptr);
17145 		}
17146 	}
17147 
17148 	CHECK_EXCEPTION();
17149 	ZEND_VM_NEXT_OPCODE();
17150 }
17151 
ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17152 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17153 {
17154 	USE_OPLINE
17155 	zend_free_op free_op1, free_op2;
17156 	zval **container;
17157 
17158 	SAVE_OPLINE();
17159 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17160 
17161 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17162 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17163 	}
17164 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
17165 	zval_dtor(free_op2.var);
17166 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17167 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17168 	}
17169 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17170 	CHECK_EXCEPTION();
17171 	ZEND_VM_NEXT_OPCODE();
17172 }
17173 
ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17174 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17175 {
17176 	USE_OPLINE
17177 	zend_free_op free_op1, free_op2;
17178 	zval *container;
17179 
17180 	SAVE_OPLINE();
17181 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17182 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_IS TSRMLS_CC);
17183 	zval_dtor(free_op2.var);
17184 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17185 	CHECK_EXCEPTION();
17186 	ZEND_VM_NEXT_OPCODE();
17187 }
17188 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17189 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17190 {
17191 	USE_OPLINE
17192 	zend_free_op free_op1, free_op2;
17193 
17194 	SAVE_OPLINE();
17195 
17196 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
17197 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17198 
17199 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17200 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17201 		}
17202 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
17203 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17204 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17205 		}
17206 		zval_dtor(free_op2.var);
17207 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17208 	} else {
17209 		zval *container;
17210 
17211 		if (IS_TMP_VAR == IS_UNUSED) {
17212 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
17213 		}
17214 		container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17215 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
17216 		zval_dtor(free_op2.var);
17217 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17218 	}
17219 	CHECK_EXCEPTION();
17220 	ZEND_VM_NEXT_OPCODE();
17221 }
17222 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17223 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17224 {
17225 	USE_OPLINE
17226 	zend_free_op free_op1, free_op2;
17227 	zval **container;
17228 
17229 	SAVE_OPLINE();
17230 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17231 
17232 	if (IS_VAR == IS_CV) {
17233 		if (container != &EG(uninitialized_zval_ptr)) {
17234 			SEPARATE_ZVAL_IF_NOT_REF(container);
17235 		}
17236 	}
17237 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17238 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17239 	}
17240 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_UNSET TSRMLS_CC);
17241 	zval_dtor(free_op2.var);
17242 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17243 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17244 	}
17245 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17246 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
17247 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
17248 		ZEND_VM_NEXT_OPCODE();
17249 	} else {
17250 		zend_free_op free_res;
17251 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17252 
17253 		PZVAL_UNLOCK(*retval_ptr, &free_res);
17254 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
17255 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
17256 		}
17257 		PZVAL_LOCK(*retval_ptr);
17258 		FREE_OP_VAR_PTR(free_res);
17259 		CHECK_EXCEPTION();
17260 		ZEND_VM_NEXT_OPCODE();
17261 	}
17262 }
17263 
zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS)17264 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS)
17265 {
17266 	USE_OPLINE
17267 	zend_free_op free_op1;
17268 	zval *container;
17269 	zend_free_op free_op2;
17270 	zval *offset;
17271 
17272 	SAVE_OPLINE();
17273 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17274 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17275 
17276 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
17277 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
17278 		zend_error(E_NOTICE, "Trying to get property of non-object");
17279 		PZVAL_LOCK(&EG(uninitialized_zval));
17280 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17281 		zval_dtor(free_op2.var);
17282 	} else {
17283 		zval *retval;
17284 
17285 		if (1) {
17286 			MAKE_REAL_ZVAL_PTR(offset);
17287 		}
17288 
17289 		/* here we are sure we are dealing with an object */
17290 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17291 
17292 		PZVAL_LOCK(retval);
17293 		AI_SET_PTR(&EX_T(opline->result.var), retval);
17294 
17295 		if (1) {
17296 			zval_ptr_dtor(&offset);
17297 		} else {
17298 			zval_dtor(free_op2.var);
17299 		}
17300 	}
17301 
17302 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17303 	CHECK_EXCEPTION();
17304 	ZEND_VM_NEXT_OPCODE();
17305 }
17306 
ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17307 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17308 {
17309 	return zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17310 }
17311 
ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17312 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17313 {
17314 	USE_OPLINE
17315 	zend_free_op free_op1, free_op2;
17316 	zval *property;
17317 	zval **container;
17318 
17319 	SAVE_OPLINE();
17320 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17321 
17322 	if (1) {
17323 		MAKE_REAL_ZVAL_PTR(property);
17324 	}
17325 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17326 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17327 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17328 	}
17329 
17330 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
17331 	if (1) {
17332 		zval_ptr_dtor(&property);
17333 	} else {
17334 		zval_dtor(free_op2.var);
17335 	}
17336 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17337 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17338 	}
17339 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17340 
17341 	/* We are going to assign the result by reference */
17342 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
17343 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
17344 
17345 		Z_DELREF_PP(retval_ptr);
17346 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
17347 		Z_ADDREF_PP(retval_ptr);
17348 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
17349 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
17350 	}
17351 
17352 	CHECK_EXCEPTION();
17353 	ZEND_VM_NEXT_OPCODE();
17354 }
17355 
ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17356 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17357 {
17358 	USE_OPLINE
17359 	zend_free_op free_op1, free_op2;
17360 	zval *property;
17361 	zval **container;
17362 
17363 	SAVE_OPLINE();
17364 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17365 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17366 
17367 	if (1) {
17368 		MAKE_REAL_ZVAL_PTR(property);
17369 	}
17370 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17371 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17372 	}
17373 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
17374 	if (1) {
17375 		zval_ptr_dtor(&property);
17376 	} else {
17377 		zval_dtor(free_op2.var);
17378 	}
17379 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17380 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17381 	}
17382 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17383 	CHECK_EXCEPTION();
17384 	ZEND_VM_NEXT_OPCODE();
17385 }
17386 
ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17387 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17388 {
17389 	USE_OPLINE
17390 	zend_free_op free_op1;
17391 	zval *container;
17392 	zend_free_op free_op2;
17393 	zval *offset;
17394 
17395 	SAVE_OPLINE();
17396 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17397 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17398 
17399 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
17400 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
17401 		PZVAL_LOCK(&EG(uninitialized_zval));
17402 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17403 		zval_dtor(free_op2.var);
17404 	} else {
17405 		zval *retval;
17406 
17407 		if (1) {
17408 			MAKE_REAL_ZVAL_PTR(offset);
17409 		}
17410 
17411 		/* here we are sure we are dealing with an object */
17412 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17413 
17414 		PZVAL_LOCK(retval);
17415 		AI_SET_PTR(&EX_T(opline->result.var), retval);
17416 
17417 		if (1) {
17418 			zval_ptr_dtor(&offset);
17419 		} else {
17420 			zval_dtor(free_op2.var);
17421 		}
17422 	}
17423 
17424 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17425 	CHECK_EXCEPTION();
17426 	ZEND_VM_NEXT_OPCODE();
17427 }
17428 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17429 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17430 {
17431 	USE_OPLINE
17432 
17433 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
17434 		/* Behave like FETCH_OBJ_W */
17435 		zend_free_op free_op1, free_op2;
17436 		zval *property;
17437 		zval **container;
17438 
17439 		SAVE_OPLINE();
17440 		property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17441 		container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17442 
17443 		if (1) {
17444 			MAKE_REAL_ZVAL_PTR(property);
17445 		}
17446 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17447 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17448 		}
17449 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
17450 		if (1) {
17451 			zval_ptr_dtor(&property);
17452 		} else {
17453 			zval_dtor(free_op2.var);
17454 		}
17455 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17456 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17457 		}
17458 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17459 		CHECK_EXCEPTION();
17460 		ZEND_VM_NEXT_OPCODE();
17461 	} else {
17462 		return zend_fetch_property_address_read_helper_SPEC_VAR_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17463 	}
17464 }
17465 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17466 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17467 {
17468 	USE_OPLINE
17469 	zend_free_op free_op1, free_op2, free_res;
17470 	zval **container;
17471 	zval *property;
17472 
17473 	SAVE_OPLINE();
17474 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17475 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17476 
17477 	if (IS_VAR == IS_CV) {
17478 		if (container != &EG(uninitialized_zval_ptr)) {
17479 			SEPARATE_ZVAL_IF_NOT_REF(container);
17480 		}
17481 	}
17482 	if (1) {
17483 		MAKE_REAL_ZVAL_PTR(property);
17484 	}
17485 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
17486 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
17487 	}
17488 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
17489 	if (1) {
17490 		zval_ptr_dtor(&property);
17491 	} else {
17492 		zval_dtor(free_op2.var);
17493 	}
17494 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
17495 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
17496 	}
17497 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17498 
17499 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
17500 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
17501 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
17502 	}
17503 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
17504 	FREE_OP_VAR_PTR(free_res);
17505 	CHECK_EXCEPTION();
17506 	ZEND_VM_NEXT_OPCODE();
17507 }
17508 
ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17509 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17510 {
17511 	USE_OPLINE
17512 	zend_free_op free_op1, free_op2;
17513 	zval **object_ptr;
17514 	zval *property_name;
17515 
17516 	SAVE_OPLINE();
17517 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17518 	property_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17519 
17520 	if (1) {
17521 		MAKE_REAL_ZVAL_PTR(property_name);
17522 	}
17523 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
17524 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17525 	}
17526 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17527 	if (1) {
17528 		zval_ptr_dtor(&property_name);
17529 	} else {
17530 		zval_dtor(free_op2.var);
17531 	}
17532 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17533 	/* assign_obj has two opcodes! */
17534 	CHECK_EXCEPTION();
17535 	ZEND_VM_INC_OPCODE();
17536 	ZEND_VM_NEXT_OPCODE();
17537 }
17538 
ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17539 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17540 {
17541 	USE_OPLINE
17542 	zend_free_op free_op1;
17543 	zval **object_ptr;
17544 
17545 	SAVE_OPLINE();
17546 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17547 
17548 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
17549 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
17550 	}
17551 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
17552 		zend_free_op free_op2;
17553 		zval *property_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17554 
17555 		if (1) {
17556 			MAKE_REAL_ZVAL_PTR(property_name);
17557 		}
17558 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
17559 		if (1) {
17560 			zval_ptr_dtor(&property_name);
17561 		} else {
17562 			zval_dtor(free_op2.var);
17563 		}
17564 	} else {
17565 		zend_free_op free_op2, free_op_data1, free_op_data2;
17566 		zval *value;
17567 		zval *dim = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17568 		zval **variable_ptr_ptr;
17569 
17570 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
17571 		zval_dtor(free_op2.var);
17572 
17573 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
17574 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
17575 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
17576 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
17577 				if (RETURN_VALUE_USED(opline)) {
17578 					zval *retval;
17579 
17580 					ALLOC_ZVAL(retval);
17581 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
17582 					INIT_PZVAL(retval);
17583 					AI_SET_PTR(&EX_T(opline->result.var), retval);
17584 				}
17585 			} else if (RETURN_VALUE_USED(opline)) {
17586 				PZVAL_LOCK(&EG(uninitialized_zval));
17587 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17588 			}
17589 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
17590 			if (IS_TMP_FREE(free_op_data1)) {
17591 				zval_dtor(value);
17592 			}
17593 			if (RETURN_VALUE_USED(opline)) {
17594 				PZVAL_LOCK(&EG(uninitialized_zval));
17595 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17596 			}
17597 		} else {
17598 			if ((opline+1)->op1_type == IS_TMP_VAR) {
17599 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17600 			} else if ((opline+1)->op1_type == IS_CONST) {
17601 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17602 			} else {
17603 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17604 			}
17605 			if (RETURN_VALUE_USED(opline)) {
17606 				PZVAL_LOCK(value);
17607 				AI_SET_PTR(&EX_T(opline->result.var), value);
17608 			}
17609 		}
17610 		FREE_OP_VAR_PTR(free_op_data2);
17611 	 	FREE_OP_IF_VAR(free_op_data1);
17612 	}
17613  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17614 	/* assign_dim has two opcodes! */
17615 	CHECK_EXCEPTION();
17616 	ZEND_VM_INC_OPCODE();
17617 	ZEND_VM_NEXT_OPCODE();
17618 }
17619 
ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17620 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17621 {
17622 	USE_OPLINE
17623 	zend_free_op free_op1, free_op2;
17624 	zval *value;
17625 	zval **variable_ptr_ptr;
17626 
17627 	SAVE_OPLINE();
17628 	value = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17629 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17630 
17631 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
17632 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_TMP_VAR TSRMLS_CC)) {
17633 			if (RETURN_VALUE_USED(opline)) {
17634 				zval *retval;
17635 
17636 				ALLOC_ZVAL(retval);
17637 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
17638 				INIT_PZVAL(retval);
17639 				AI_SET_PTR(&EX_T(opline->result.var), retval);
17640 			}
17641 		} else if (RETURN_VALUE_USED(opline)) {
17642 			PZVAL_LOCK(&EG(uninitialized_zval));
17643 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17644 		}
17645 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
17646 		if (1) {
17647 			zval_dtor(value);
17648 		}
17649 		if (RETURN_VALUE_USED(opline)) {
17650 			PZVAL_LOCK(&EG(uninitialized_zval));
17651 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
17652 		}
17653 	} else {
17654 		if (IS_TMP_VAR == IS_TMP_VAR) {
17655 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17656 		} else if (IS_TMP_VAR == IS_CONST) {
17657 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17658 		} else {
17659 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
17660 		}
17661 		if (RETURN_VALUE_USED(opline)) {
17662 			PZVAL_LOCK(value);
17663 			AI_SET_PTR(&EX_T(opline->result.var), value);
17664 		}
17665 	}
17666 
17667 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
17668 		zval_ptr_dtor(&value);
17669 	}
17670 
17671 	/* zend_assign_to_variable() always takes care of op2, never free it! */
17672 
17673 	CHECK_EXCEPTION();
17674 	ZEND_VM_NEXT_OPCODE();
17675 }
17676 
ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17677 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17678 {
17679 	USE_OPLINE
17680 	zval *function_name;
17681 	char *function_name_strval;
17682 	int function_name_strlen;
17683 	zend_free_op free_op1, free_op2;
17684 	call_slot *call = EX(call_slots) + opline->result.num;
17685 
17686 	SAVE_OPLINE();
17687 
17688 	function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17689 
17690 	if (IS_TMP_VAR != IS_CONST &&
17691 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
17692 		if (UNEXPECTED(EG(exception) != NULL)) {
17693 			HANDLE_EXCEPTION();
17694 		}
17695 		zend_error_noreturn(E_ERROR, "Method name must be a string");
17696 	}
17697 
17698 	function_name_strval = Z_STRVAL_P(function_name);
17699 	function_name_strlen = Z_STRLEN_P(function_name);
17700 
17701 	call->object = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17702 
17703 	if (EXPECTED(call->object != NULL) &&
17704 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
17705 		call->called_scope = Z_OBJCE_P(call->object);
17706 
17707 		if (IS_TMP_VAR != IS_CONST ||
17708 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
17709 		    zval *object = call->object;
17710 
17711 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
17712 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
17713 			}
17714 
17715 			/* First, locate the function. */
17716 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
17717 			if (UNEXPECTED(call->fbc == NULL)) {
17718 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
17719 			}
17720 			if (IS_TMP_VAR == IS_CONST &&
17721 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
17722 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
17723 			    EXPECTED(call->object == object)) {
17724 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
17725 			}
17726 		}
17727 	} else {
17728 		if (UNEXPECTED(EG(exception) != NULL)) {
17729 			zval_dtor(free_op2.var);
17730 			HANDLE_EXCEPTION();
17731 		}
17732 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
17733 	}
17734 
17735 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
17736 		call->object = NULL;
17737 	} else {
17738 		if (!PZVAL_IS_REF(call->object)) {
17739 			Z_ADDREF_P(call->object); /* For $this pointer */
17740 		} else {
17741 			zval *this_ptr;
17742 			ALLOC_ZVAL(this_ptr);
17743 			INIT_PZVAL_COPY(this_ptr, call->object);
17744 			zval_copy_ctor(this_ptr);
17745 			call->object = this_ptr;
17746 		}
17747 	}
17748 	call->is_ctor_call = 0;
17749 	EX(call) = call;
17750 
17751 	zval_dtor(free_op2.var);
17752 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17753 
17754 	CHECK_EXCEPTION();
17755 	ZEND_VM_NEXT_OPCODE();
17756 }
17757 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17758 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17759 {
17760 	USE_OPLINE
17761 	zval *function_name;
17762 	zend_class_entry *ce;
17763 	call_slot *call = EX(call_slots) + opline->result.num;
17764 
17765 	SAVE_OPLINE();
17766 
17767 	if (IS_VAR == IS_CONST) {
17768 		/* no function found. try a static method in class */
17769 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
17770 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
17771 		} else {
17772 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
17773 			if (UNEXPECTED(EG(exception) != NULL)) {
17774 				HANDLE_EXCEPTION();
17775 			}
17776 			if (UNEXPECTED(ce == NULL)) {
17777 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
17778 			}
17779 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
17780 		}
17781 		call->called_scope = ce;
17782 	} else {
17783 		ce = EX_T(opline->op1.var).class_entry;
17784 
17785 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
17786 			call->called_scope = EG(called_scope);
17787 		} else {
17788 			call->called_scope = ce;
17789 		}
17790 	}
17791 
17792 	if (IS_VAR == IS_CONST &&
17793 	    IS_TMP_VAR == IS_CONST &&
17794 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
17795 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
17796 	} else if (IS_VAR != IS_CONST &&
17797 	           IS_TMP_VAR == IS_CONST &&
17798 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
17799 		/* do nothing */
17800 	} else if (IS_TMP_VAR != IS_UNUSED) {
17801 		char *function_name_strval = NULL;
17802 		int function_name_strlen = 0;
17803 		zend_free_op free_op2;
17804 
17805 		if (IS_TMP_VAR == IS_CONST) {
17806 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
17807 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
17808 		} else {
17809 			function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17810 
17811 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
17812 				if (UNEXPECTED(EG(exception) != NULL)) {
17813 					HANDLE_EXCEPTION();
17814 				}
17815 				zend_error_noreturn(E_ERROR, "Function name must be a string");
17816 			} else {
17817 				function_name_strval = Z_STRVAL_P(function_name);
17818 				function_name_strlen = Z_STRLEN_P(function_name);
17819  			}
17820 		}
17821 
17822 		if (function_name_strval) {
17823 			if (ce->get_static_method) {
17824 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
17825 			} else {
17826 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
17827 			}
17828 			if (UNEXPECTED(call->fbc == NULL)) {
17829 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
17830 			}
17831 			if (IS_TMP_VAR == IS_CONST &&
17832 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
17833 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
17834 				if (IS_VAR == IS_CONST) {
17835 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
17836 				} else {
17837 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
17838 				}
17839 			}
17840 		}
17841 		if (IS_TMP_VAR != IS_CONST) {
17842 			zval_dtor(free_op2.var);
17843 		}
17844 	} else {
17845 		if (UNEXPECTED(ce->constructor == NULL)) {
17846 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
17847 		}
17848 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
17849 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
17850 		}
17851 		call->fbc = ce->constructor;
17852 	}
17853 
17854 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
17855 		call->object = NULL;
17856 	} else {
17857 		if (EG(This) &&
17858 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
17859 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
17860 		    /* We are calling method of the other (incompatible) class,
17861 		       but passing $this. This is done for compatibility with php-4. */
17862 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
17863 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
17864 			} else {
17865 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
17866 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
17867 			}
17868 		}
17869 		if ((call->object = EG(This))) {
17870 			Z_ADDREF_P(call->object);
17871 			call->called_scope = Z_OBJCE_P(call->object);
17872 		}
17873 	}
17874 	call->is_ctor_call = 0;
17875 	EX(call) = call;
17876 
17877 	CHECK_EXCEPTION();
17878 	ZEND_VM_NEXT_OPCODE();
17879 }
17880 
ZEND_CASE_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17881 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17882 {
17883 	USE_OPLINE
17884 	zend_free_op free_op1, free_op2;
17885 
17886 	SAVE_OPLINE();
17887 	if (IS_VAR==IS_VAR) {
17888 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
17889 	}
17890 	is_equal_function(&EX_T(opline->result.var).tmp_var,
17891 				 _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
17892 				 _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
17893 
17894 	zval_dtor(free_op2.var);
17895 	CHECK_EXCEPTION();
17896 	ZEND_VM_NEXT_OPCODE();
17897 }
17898 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17899 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17900 {
17901 	USE_OPLINE
17902 	zend_free_op free_op1;
17903 	zval *expr_ptr;
17904 
17905 	SAVE_OPLINE();
17906 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
17907 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17908 
17909 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
17910 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
17911 		}
17912 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
17913 		expr_ptr = *expr_ptr_ptr;
17914 		Z_ADDREF_P(expr_ptr);
17915 	} else {
17916 		expr_ptr=_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
17917 		if (0) { /* temporary variable */
17918 			zval *new_expr;
17919 
17920 			ALLOC_ZVAL(new_expr);
17921 			INIT_PZVAL_COPY(new_expr, expr_ptr);
17922 			expr_ptr = new_expr;
17923 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
17924 			zval *new_expr;
17925 
17926 			ALLOC_ZVAL(new_expr);
17927 			INIT_PZVAL_COPY(new_expr, expr_ptr);
17928 			expr_ptr = new_expr;
17929 			zendi_zval_copy_ctor(*expr_ptr);
17930 		} else {
17931 			Z_ADDREF_P(expr_ptr);
17932 		}
17933 	}
17934 
17935 	if (IS_TMP_VAR != IS_UNUSED) {
17936 		zend_free_op free_op2;
17937 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
17938 		ulong hval;
17939 
17940 		switch (Z_TYPE_P(offset)) {
17941 			case IS_DOUBLE:
17942 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
17943 				goto num_index;
17944 			case IS_LONG:
17945 			case IS_BOOL:
17946 				hval = Z_LVAL_P(offset);
17947 num_index:
17948 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
17949 				break;
17950 			case IS_STRING:
17951 				if (IS_TMP_VAR == IS_CONST) {
17952 					hval = Z_HASH_P(offset);
17953 				} else {
17954 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
17955 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
17956 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
17957 					} else {
17958 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
17959 					}
17960 				}
17961 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
17962 				break;
17963 			case IS_NULL:
17964 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
17965 				break;
17966 			default:
17967 				zend_error(E_WARNING, "Illegal offset type");
17968 				zval_ptr_dtor(&expr_ptr);
17969 				/* do nothing */
17970 				break;
17971 		}
17972 		zval_dtor(free_op2.var);
17973 	} else {
17974 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
17975 	}
17976 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
17977 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17978 	} else {
17979 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
17980 	}
17981 	CHECK_EXCEPTION();
17982 	ZEND_VM_NEXT_OPCODE();
17983 }
17984 
ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17985 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
17986 {
17987 	USE_OPLINE
17988 
17989 	array_init(&EX_T(opline->result.var).tmp_var);
17990 	if (IS_VAR == IS_UNUSED) {
17991 		ZEND_VM_NEXT_OPCODE();
17992 #if 0 || IS_VAR != IS_UNUSED
17993 	} else {
17994 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
17995 #endif
17996 	}
17997 }
17998 
ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)17999 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18000 {
18001 	USE_OPLINE
18002 	zend_free_op free_op1, free_op2;
18003 	zval **container;
18004 	zval *offset;
18005 	ulong hval;
18006 
18007 	SAVE_OPLINE();
18008 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18009 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
18010 		SEPARATE_ZVAL_IF_NOT_REF(container);
18011 	}
18012 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18013 
18014 	if (IS_VAR != IS_VAR || container) {
18015 		switch (Z_TYPE_PP(container)) {
18016 			case IS_ARRAY: {
18017 				HashTable *ht = Z_ARRVAL_PP(container);
18018 
18019 				switch (Z_TYPE_P(offset)) {
18020 					case IS_DOUBLE:
18021 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
18022 						zend_hash_index_del(ht, hval);
18023 						break;
18024 					case IS_RESOURCE:
18025 					case IS_BOOL:
18026 					case IS_LONG:
18027 						hval = Z_LVAL_P(offset);
18028 						zend_hash_index_del(ht, hval);
18029 						break;
18030 					case IS_STRING:
18031 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
18032 							Z_ADDREF_P(offset);
18033 						}
18034 						if (IS_TMP_VAR == IS_CONST) {
18035 							hval = Z_HASH_P(offset);
18036 						} else {
18037 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
18038 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
18039 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
18040 							} else {
18041 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
18042 							}
18043 						}
18044 						if (ht == &EG(symbol_table)) {
18045 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
18046 						} else {
18047 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
18048 						}
18049 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
18050 							zval_ptr_dtor(&offset);
18051 						}
18052 						break;
18053 num_index_dim:
18054 						zend_hash_index_del(ht, hval);
18055 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
18056 							zval_ptr_dtor(&offset);
18057 						}
18058 						break;
18059 					case IS_NULL:
18060 						zend_hash_del(ht, "", sizeof(""));
18061 						break;
18062 					default:
18063 						zend_error(E_WARNING, "Illegal offset type in unset");
18064 						break;
18065 				}
18066 				zval_dtor(free_op2.var);
18067 				break;
18068 			}
18069 			case IS_OBJECT:
18070 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
18071 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
18072 				}
18073 				if (1) {
18074 					MAKE_REAL_ZVAL_PTR(offset);
18075 				}
18076 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
18077 				if (1) {
18078 					zval_ptr_dtor(&offset);
18079 				} else {
18080 					zval_dtor(free_op2.var);
18081 				}
18082 				break;
18083 			case IS_STRING:
18084 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
18085 				ZEND_VM_CONTINUE(); /* bailed out before */
18086 			default:
18087 				zval_dtor(free_op2.var);
18088 				break;
18089 		}
18090 	} else {
18091 		zval_dtor(free_op2.var);
18092 	}
18093 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18094 
18095 	CHECK_EXCEPTION();
18096 	ZEND_VM_NEXT_OPCODE();
18097 }
18098 
ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18099 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18100 {
18101 	USE_OPLINE
18102 	zend_free_op free_op1, free_op2;
18103 	zval **container;
18104 	zval *offset;
18105 
18106 	SAVE_OPLINE();
18107 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18108 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18109 
18110 	if (IS_VAR != IS_VAR || container) {
18111 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
18112 			SEPARATE_ZVAL_IF_NOT_REF(container);
18113 		}
18114 		if (Z_TYPE_PP(container) == IS_OBJECT) {
18115 			if (1) {
18116 				MAKE_REAL_ZVAL_PTR(offset);
18117 			}
18118 			if (Z_OBJ_HT_P(*container)->unset_property) {
18119 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18120 			} else {
18121 				zend_error(E_NOTICE, "Trying to unset property of non-object");
18122 			}
18123 			if (1) {
18124 				zval_ptr_dtor(&offset);
18125 			} else {
18126 				zval_dtor(free_op2.var);
18127 			}
18128 		} else {
18129 			zval_dtor(free_op2.var);
18130 		}
18131 	} else {
18132 		zval_dtor(free_op2.var);
18133 	}
18134 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18135 
18136 	CHECK_EXCEPTION();
18137 	ZEND_VM_NEXT_OPCODE();
18138 }
18139 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)18140 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
18141 {
18142 	USE_OPLINE
18143 	zend_free_op free_op1, free_op2;
18144 	zval *container;
18145 	zval **value = NULL;
18146 	int result = 0;
18147 	ulong hval;
18148 	zval *offset;
18149 
18150 	SAVE_OPLINE();
18151 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18152 
18153 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18154 
18155 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
18156 		HashTable *ht;
18157 		int isset = 0;
18158 
18159 		ht = Z_ARRVAL_P(container);
18160 
18161 		switch (Z_TYPE_P(offset)) {
18162 			case IS_DOUBLE:
18163 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
18164 				goto num_index_prop;
18165 			case IS_RESOURCE:
18166 			case IS_BOOL:
18167 			case IS_LONG:
18168 				hval = Z_LVAL_P(offset);
18169 num_index_prop:
18170 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
18171 					isset = 1;
18172 				}
18173 				break;
18174 			case IS_STRING:
18175 				if (IS_TMP_VAR == IS_CONST) {
18176 					hval = Z_HASH_P(offset);
18177 				} else {
18178 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
18179 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
18180 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
18181 					} else {
18182 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
18183 					}
18184 				}
18185 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
18186 					isset = 1;
18187 				}
18188 				break;
18189 			case IS_NULL:
18190 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
18191 					isset = 1;
18192 				}
18193 				break;
18194 			default:
18195 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
18196 				break;
18197 		}
18198 
18199 		if (opline->extended_value & ZEND_ISSET) {
18200 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
18201 				result = 0;
18202 			} else {
18203 				result = isset;
18204 			}
18205 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
18206 			if (!isset || !i_zend_is_true(*value)) {
18207 				result = 0;
18208 			} else {
18209 				result = 1;
18210 			}
18211 		}
18212 		zval_dtor(free_op2.var);
18213 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
18214 		if (1) {
18215 			MAKE_REAL_ZVAL_PTR(offset);
18216 		}
18217 		if (prop_dim) {
18218 			if (Z_OBJ_HT_P(container)->has_property) {
18219 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18220 			} else {
18221 				zend_error(E_NOTICE, "Trying to check property of non-object");
18222 				result = 0;
18223 			}
18224 		} else {
18225 			if (Z_OBJ_HT_P(container)->has_dimension) {
18226 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
18227 			} else {
18228 				zend_error(E_NOTICE, "Trying to check element of non-array");
18229 				result = 0;
18230 			}
18231 		}
18232 		if (1) {
18233 			zval_ptr_dtor(&offset);
18234 		} else {
18235 			zval_dtor(free_op2.var);
18236 		}
18237 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
18238 		zval tmp;
18239 
18240 		if (Z_TYPE_P(offset) != IS_LONG) {
18241 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
18242 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
18243 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
18244 				ZVAL_COPY_VALUE(&tmp, offset);
18245 				zval_copy_ctor(&tmp);
18246 				convert_to_long(&tmp);
18247 				offset = &tmp;
18248 			} else {
18249 				/* can not be converted to proper offset, return "not set" */
18250 				result = 0;
18251 			}
18252 		}
18253 		if (Z_TYPE_P(offset) == IS_LONG) {
18254 			if (opline->extended_value & ZEND_ISSET) {
18255 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
18256 					result = 1;
18257 				}
18258 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
18259 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
18260 					result = 1;
18261 				}
18262 			}
18263 		}
18264 		zval_dtor(free_op2.var);
18265 	} else {
18266 		zval_dtor(free_op2.var);
18267 	}
18268 
18269 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
18270 	if (opline->extended_value & ZEND_ISSET) {
18271 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
18272 	} else {
18273 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
18274 	}
18275 
18276 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18277 
18278 	CHECK_EXCEPTION();
18279 	ZEND_VM_NEXT_OPCODE();
18280 }
18281 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18282 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18283 {
18284 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18285 }
18286 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18287 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18288 {
18289 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18290 }
18291 
ZEND_YIELD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18292 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18293 {
18294 	USE_OPLINE
18295 
18296 	/* The generator object is stored in return_value_ptr_ptr */
18297 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
18298 
18299 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
18300 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
18301 	}
18302 
18303 	/* Destroy the previously yielded value */
18304 	if (generator->value) {
18305 		zval_ptr_dtor(&generator->value);
18306 	}
18307 
18308 	/* Destroy the previously yielded key */
18309 	if (generator->key) {
18310 		zval_ptr_dtor(&generator->key);
18311 	}
18312 
18313 	/* Set the new yielded value */
18314 	if (IS_VAR != IS_UNUSED) {
18315 		zend_free_op free_op1;
18316 
18317 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
18318 			/* Constants and temporary variables aren't yieldable by reference,
18319 			 * but we still allow them with a notice. */
18320 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
18321 				zval *value, *copy;
18322 
18323 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
18324 
18325 				value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18326 				ALLOC_ZVAL(copy);
18327 				INIT_PZVAL_COPY(copy, value);
18328 
18329 				/* Temporary variables don't need ctor copying */
18330 				if (!0) {
18331 					zval_copy_ctor(copy);
18332 				}
18333 
18334 				generator->value = copy;
18335 			} else {
18336 				zval **value_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18337 
18338 				if (IS_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
18339 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
18340 				}
18341 
18342 				/* If a function call result is yielded and the function did
18343 				 * not return by reference we throw a notice. */
18344 				if (IS_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
18345 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
18346 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
18347 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
18348 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
18349 
18350 					Z_ADDREF_PP(value_ptr);
18351 					generator->value = *value_ptr;
18352 				} else {
18353 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
18354 					Z_ADDREF_PP(value_ptr);
18355 					generator->value = *value_ptr;
18356 				}
18357 
18358 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18359 			}
18360 		} else {
18361 			zval *value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18362 
18363 			/* Consts, temporary variables and references need copying */
18364 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
18365 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
18366 			) {
18367 				zval *copy;
18368 
18369 				ALLOC_ZVAL(copy);
18370 				INIT_PZVAL_COPY(copy, value);
18371 
18372 				/* Temporary variables don't need ctor copying */
18373 				if (!0) {
18374 					zval_copy_ctor(copy);
18375 				}
18376 
18377 				generator->value = copy;
18378 			} else {
18379 				Z_ADDREF_P(value);
18380 				generator->value = value;
18381 			}
18382 
18383 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18384 		}
18385 	} else {
18386 		/* If no value was specified yield null */
18387 		Z_ADDREF(EG(uninitialized_zval));
18388 		generator->value = &EG(uninitialized_zval);
18389 	}
18390 
18391 	/* Set the new yielded key */
18392 	if (IS_TMP_VAR != IS_UNUSED) {
18393 		zend_free_op free_op2;
18394 		zval *key = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18395 
18396 		/* Consts, temporary variables and references need copying */
18397 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
18398 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
18399 		) {
18400 			zval *copy;
18401 
18402 			ALLOC_ZVAL(copy);
18403 			INIT_PZVAL_COPY(copy, key);
18404 
18405 			/* Temporary variables don't need ctor copying */
18406 			if (!1) {
18407 				zval_copy_ctor(copy);
18408 			}
18409 
18410 			generator->key = copy;
18411 		} else {
18412 			Z_ADDREF_P(key);
18413 			generator->key = key;
18414 		}
18415 
18416 		if (Z_TYPE_P(generator->key) == IS_LONG
18417 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
18418 		) {
18419 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
18420 		}
18421 
18422 	} else {
18423 		/* If no key was specified we use auto-increment keys */
18424 		generator->largest_used_integer_key++;
18425 
18426 		ALLOC_INIT_ZVAL(generator->key);
18427 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
18428 	}
18429 
18430 	if (RETURN_VALUE_USED(opline)) {
18431 		/* If the return value of yield is used set the send
18432 		 * target and initialize it to NULL */
18433 		generator->send_target = &EX_T(opline->result.var).var.ptr;
18434 		Z_ADDREF(EG(uninitialized_zval));
18435 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
18436 	} else {
18437 		generator->send_target = NULL;
18438 	}
18439 
18440 	/* We increment to the next op, so we are at the correct position when the
18441 	 * generator is resumed. */
18442 	ZEND_VM_INC_OPCODE();
18443 
18444 	/* The GOTO VM uses a local opline variable. We need to set the opline
18445 	 * variable in execute_data so we don't resume at an old position. */
18446 	SAVE_OPLINE();
18447 
18448 	ZEND_VM_RETURN();
18449 }
18450 
ZEND_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18451 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18452 {
18453 	USE_OPLINE
18454 	zend_free_op free_op1, free_op2;
18455 
18456 	SAVE_OPLINE();
18457 	fast_add_function(&EX_T(opline->result.var).tmp_var,
18458 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18459 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18460 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18461 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18462 	CHECK_EXCEPTION();
18463 	ZEND_VM_NEXT_OPCODE();
18464 }
18465 
ZEND_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18466 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18467 {
18468 	USE_OPLINE
18469 	zend_free_op free_op1, free_op2;
18470 
18471 	SAVE_OPLINE();
18472 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
18473 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18474 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18475 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18476 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18477 	CHECK_EXCEPTION();
18478 	ZEND_VM_NEXT_OPCODE();
18479 }
18480 
ZEND_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18481 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18482 {
18483 	USE_OPLINE
18484 	zend_free_op free_op1, free_op2;
18485 
18486 	SAVE_OPLINE();
18487 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
18488 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18489 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18490 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18491 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18492 	CHECK_EXCEPTION();
18493 	ZEND_VM_NEXT_OPCODE();
18494 }
18495 
ZEND_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18496 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18497 {
18498 	USE_OPLINE
18499 	zend_free_op free_op1, free_op2;
18500 
18501 	SAVE_OPLINE();
18502 	fast_div_function(&EX_T(opline->result.var).tmp_var,
18503 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18504 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18505 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18506 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18507 	CHECK_EXCEPTION();
18508 	ZEND_VM_NEXT_OPCODE();
18509 }
18510 
ZEND_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18511 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18512 {
18513 	USE_OPLINE
18514 	zend_free_op free_op1, free_op2;
18515 
18516 	SAVE_OPLINE();
18517 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
18518 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18519 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18520 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18521 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18522 	CHECK_EXCEPTION();
18523 	ZEND_VM_NEXT_OPCODE();
18524 }
18525 
ZEND_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18526 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18527 {
18528 	USE_OPLINE
18529 	zend_free_op free_op1, free_op2;
18530 
18531 	SAVE_OPLINE();
18532 	shift_left_function(&EX_T(opline->result.var).tmp_var,
18533 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18534 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18535 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18536 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18537 	CHECK_EXCEPTION();
18538 	ZEND_VM_NEXT_OPCODE();
18539 }
18540 
ZEND_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18541 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18542 {
18543 	USE_OPLINE
18544 	zend_free_op free_op1, free_op2;
18545 
18546 	SAVE_OPLINE();
18547 	shift_right_function(&EX_T(opline->result.var).tmp_var,
18548 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18549 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18550 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18551 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18552 	CHECK_EXCEPTION();
18553 	ZEND_VM_NEXT_OPCODE();
18554 }
18555 
ZEND_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18556 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18557 {
18558 	USE_OPLINE
18559 	zend_free_op free_op1, free_op2;
18560 
18561 	SAVE_OPLINE();
18562 	concat_function(&EX_T(opline->result.var).tmp_var,
18563 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18564 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18565 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18566 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18567 	CHECK_EXCEPTION();
18568 	ZEND_VM_NEXT_OPCODE();
18569 }
18570 
ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18571 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18572 {
18573 	USE_OPLINE
18574 	zend_free_op free_op1, free_op2;
18575 
18576 	SAVE_OPLINE();
18577 	is_identical_function(&EX_T(opline->result.var).tmp_var,
18578 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18579 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18580 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18581 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18582 	CHECK_EXCEPTION();
18583 	ZEND_VM_NEXT_OPCODE();
18584 }
18585 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18586 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18587 {
18588 	USE_OPLINE
18589 	zend_free_op free_op1, free_op2;
18590 	zval *result = &EX_T(opline->result.var).tmp_var;
18591 
18592 	SAVE_OPLINE();
18593 	is_identical_function(result,
18594 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18595 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18596 	Z_LVAL_P(result) = !Z_LVAL_P(result);
18597 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18598 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18599 	CHECK_EXCEPTION();
18600 	ZEND_VM_NEXT_OPCODE();
18601 }
18602 
ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18603 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18604 {
18605 	USE_OPLINE
18606 	zend_free_op free_op1, free_op2;
18607 	zval *result = &EX_T(opline->result.var).tmp_var;
18608 
18609 	SAVE_OPLINE();
18610 	ZVAL_BOOL(result, fast_equal_function(result,
18611 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18612 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
18613 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18614 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18615 	CHECK_EXCEPTION();
18616 	ZEND_VM_NEXT_OPCODE();
18617 }
18618 
ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18619 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18620 {
18621 	USE_OPLINE
18622 	zend_free_op free_op1, free_op2;
18623 	zval *result = &EX_T(opline->result.var).tmp_var;
18624 
18625 	SAVE_OPLINE();
18626 	ZVAL_BOOL(result, fast_not_equal_function(result,
18627 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18628 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
18629 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18630 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18631 	CHECK_EXCEPTION();
18632 	ZEND_VM_NEXT_OPCODE();
18633 }
18634 
ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18635 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18636 {
18637 	USE_OPLINE
18638 	zend_free_op free_op1, free_op2;
18639 	zval *result = &EX_T(opline->result.var).tmp_var;
18640 
18641 	SAVE_OPLINE();
18642 	ZVAL_BOOL(result, fast_is_smaller_function(result,
18643 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18644 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
18645 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18646 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18647 	CHECK_EXCEPTION();
18648 	ZEND_VM_NEXT_OPCODE();
18649 }
18650 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18651 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18652 {
18653 	USE_OPLINE
18654 	zend_free_op free_op1, free_op2;
18655 	zval *result = &EX_T(opline->result.var).tmp_var;
18656 
18657 	SAVE_OPLINE();
18658 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
18659 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18660 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
18661 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18662 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18663 	CHECK_EXCEPTION();
18664 	ZEND_VM_NEXT_OPCODE();
18665 }
18666 
ZEND_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18667 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18668 {
18669 	USE_OPLINE
18670 	zend_free_op free_op1, free_op2;
18671 
18672 	SAVE_OPLINE();
18673 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
18674 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18675 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18676 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18677 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18678 	CHECK_EXCEPTION();
18679 	ZEND_VM_NEXT_OPCODE();
18680 }
18681 
ZEND_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18682 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18683 {
18684 	USE_OPLINE
18685 	zend_free_op free_op1, free_op2;
18686 
18687 	SAVE_OPLINE();
18688 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
18689 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18690 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18691 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18692 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18693 	CHECK_EXCEPTION();
18694 	ZEND_VM_NEXT_OPCODE();
18695 }
18696 
ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18697 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18698 {
18699 	USE_OPLINE
18700 	zend_free_op free_op1, free_op2;
18701 
18702 	SAVE_OPLINE();
18703 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
18704 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18705 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18706 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18707 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18708 	CHECK_EXCEPTION();
18709 	ZEND_VM_NEXT_OPCODE();
18710 }
18711 
ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18712 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18713 {
18714 	USE_OPLINE
18715 	zend_free_op free_op1, free_op2;
18716 
18717 	SAVE_OPLINE();
18718 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
18719 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
18720 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
18721 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18722 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18723 	CHECK_EXCEPTION();
18724 	ZEND_VM_NEXT_OPCODE();
18725 }
18726 
zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)18727 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
18728 {
18729 	USE_OPLINE
18730 	zend_free_op free_op1, free_op2, free_op_data1;
18731 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18732 	zval *object;
18733 	zval *property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18734 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
18735 	int have_get_ptr = 0;
18736 
18737 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
18738 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
18739 	}
18740 
18741 	make_real_object(object_ptr TSRMLS_CC);
18742 	object = *object_ptr;
18743 
18744 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
18745 		zend_error(E_WARNING, "Attempt to assign property of non-object");
18746 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18747 		FREE_OP(free_op_data1);
18748 
18749 		if (RETURN_VALUE_USED(opline)) {
18750 			PZVAL_LOCK(&EG(uninitialized_zval));
18751 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
18752 			EX_T(opline->result.var).var.ptr_ptr = NULL;
18753 		}
18754 	} else {
18755 		/* here we are sure we are dealing with an object */
18756 		if (0) {
18757 			MAKE_REAL_ZVAL_PTR(property);
18758 		}
18759 
18760 		/* here property is a string */
18761 		if (opline->extended_value == ZEND_ASSIGN_OBJ
18762 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
18763 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18764 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
18765 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
18766 
18767 				have_get_ptr = 1;
18768 				binary_op(*zptr, *zptr, value TSRMLS_CC);
18769 				if (RETURN_VALUE_USED(opline)) {
18770 					PZVAL_LOCK(*zptr);
18771 					EX_T(opline->result.var).var.ptr = *zptr;
18772 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18773 				}
18774 			}
18775 		}
18776 
18777 		if (!have_get_ptr) {
18778 			zval *z = NULL;
18779 
18780 			Z_ADDREF_P(object);
18781 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
18782 				if (Z_OBJ_HT_P(object)->read_property) {
18783 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18784 				}
18785 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
18786 				if (Z_OBJ_HT_P(object)->read_dimension) {
18787 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
18788 				}
18789 			}
18790 			if (z) {
18791 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
18792 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
18793 
18794 					if (Z_REFCOUNT_P(z) == 0) {
18795 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
18796 						zval_dtor(z);
18797 						FREE_ZVAL(z);
18798 					}
18799 					z = value;
18800 				}
18801 				Z_ADDREF_P(z);
18802 				SEPARATE_ZVAL_IF_NOT_REF(&z);
18803 				binary_op(z, z, value TSRMLS_CC);
18804 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
18805 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
18806 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
18807 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
18808 				}
18809 				if (RETURN_VALUE_USED(opline)) {
18810 					PZVAL_LOCK(z);
18811 					EX_T(opline->result.var).var.ptr = z;
18812 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18813 				}
18814 				zval_ptr_dtor(&z);
18815 			} else {
18816 				zend_error(E_WARNING, "Attempt to assign property of non-object");
18817 				if (RETURN_VALUE_USED(opline)) {
18818 					PZVAL_LOCK(&EG(uninitialized_zval));
18819 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
18820 					EX_T(opline->result.var).var.ptr_ptr = NULL;
18821 				}
18822 			}
18823 			zval_ptr_dtor(&object);
18824 		}
18825 
18826 		if (0) {
18827 			zval_ptr_dtor(&property);
18828 		} else {
18829 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18830 		}
18831 		FREE_OP(free_op_data1);
18832 	}
18833 
18834 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18835 	/* assign_obj has two opcodes! */
18836 	CHECK_EXCEPTION();
18837 	ZEND_VM_INC_OPCODE();
18838 	ZEND_VM_NEXT_OPCODE();
18839 }
18840 
zend_binary_assign_op_helper_SPEC_VAR_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)18841 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
18842 {
18843 	USE_OPLINE
18844 	zend_free_op free_op1, free_op2, free_op_data2, free_op_data1;
18845 	zval **var_ptr;
18846 	zval *value;
18847 
18848 	SAVE_OPLINE();
18849 	switch (opline->extended_value) {
18850 		case ZEND_ASSIGN_OBJ:
18851 			return zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18852 			break;
18853 		case ZEND_ASSIGN_DIM: {
18854 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18855 
18856 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
18857 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
18858 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
18859 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
18860 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
18861 					}
18862 					return zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18863 				} else {
18864 					zval *dim = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18865 
18866 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
18867 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
18868 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
18869 				}
18870 			}
18871 			break;
18872 		default:
18873 			value = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18874 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18875 			/* do nothing */
18876 			break;
18877 	}
18878 
18879 	if (UNEXPECTED(var_ptr == NULL)) {
18880 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
18881 	}
18882 
18883 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
18884 		if (RETURN_VALUE_USED(opline)) {
18885 			PZVAL_LOCK(&EG(uninitialized_zval));
18886 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
18887 		}
18888 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18889 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18890 		CHECK_EXCEPTION();
18891 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
18892 			ZEND_VM_INC_OPCODE();
18893 		}
18894 		ZEND_VM_NEXT_OPCODE();
18895 	}
18896 
18897 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
18898 
18899 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
18900 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
18901 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
18902 		/* proxy object */
18903 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
18904 		Z_ADDREF_P(objval);
18905 		binary_op(objval, objval, value TSRMLS_CC);
18906 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
18907 		zval_ptr_dtor(&objval);
18908 	} else {
18909 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
18910 	}
18911 
18912 	if (RETURN_VALUE_USED(opline)) {
18913 		PZVAL_LOCK(*var_ptr);
18914 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
18915 	}
18916 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
18917 
18918 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
18919 		FREE_OP(free_op_data1);
18920 		FREE_OP_VAR_PTR(free_op_data2);
18921 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18922 		CHECK_EXCEPTION();
18923 		ZEND_VM_INC_OPCODE();
18924 	} else {
18925 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
18926 		CHECK_EXCEPTION();
18927 	}
18928 	ZEND_VM_NEXT_OPCODE();
18929 }
18930 
ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18931 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18932 {
18933 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18934 }
18935 
ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18936 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18937 {
18938 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18939 }
18940 
ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18941 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18942 {
18943 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18944 }
18945 
ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18946 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18947 {
18948 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18949 }
18950 
ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18951 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18952 {
18953 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18954 }
18955 
ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18956 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18957 {
18958 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18959 }
18960 
ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18961 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18962 {
18963 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18964 }
18965 
ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18966 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18967 {
18968 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18969 }
18970 
ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18971 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18972 {
18973 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18974 }
18975 
ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18976 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18977 {
18978 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18979 }
18980 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)18981 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
18982 {
18983 	return zend_binary_assign_op_helper_SPEC_VAR_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
18984 }
18985 
zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)18986 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
18987 {
18988 	USE_OPLINE
18989 	zend_free_op free_op1, free_op2;
18990 	zval **object_ptr;
18991 	zval *object;
18992 	zval *property;
18993 	zval **retval;
18994 	int have_get_ptr = 0;
18995 
18996 	SAVE_OPLINE();
18997 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
18998 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
18999 	retval = &EX_T(opline->result.var).var.ptr;
19000 
19001 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19002 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
19003 	}
19004 
19005 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
19006 	object = *object_ptr;
19007 
19008 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
19009 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
19010 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19011 		if (RETURN_VALUE_USED(opline)) {
19012 			PZVAL_LOCK(&EG(uninitialized_zval));
19013 			*retval = &EG(uninitialized_zval);
19014 		}
19015 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19016 		CHECK_EXCEPTION();
19017 		ZEND_VM_NEXT_OPCODE();
19018 	}
19019 
19020 	/* here we are sure we are dealing with an object */
19021 
19022 	if (0) {
19023 		MAKE_REAL_ZVAL_PTR(property);
19024 	}
19025 
19026 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
19027 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19028 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
19029 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
19030 
19031 			have_get_ptr = 1;
19032 			incdec_op(*zptr);
19033 			if (RETURN_VALUE_USED(opline)) {
19034 				*retval = *zptr;
19035 				PZVAL_LOCK(*retval);
19036 			}
19037 		}
19038 	}
19039 
19040 	if (!have_get_ptr) {
19041 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
19042 			zval *z;
19043 
19044 			Z_ADDREF_P(object);
19045 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19046 
19047 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
19048 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
19049 
19050 				if (Z_REFCOUNT_P(z) == 0) {
19051 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
19052 					zval_dtor(z);
19053 					FREE_ZVAL(z);
19054 				}
19055 				z = value;
19056 			}
19057 			Z_ADDREF_P(z);
19058 			SEPARATE_ZVAL_IF_NOT_REF(&z);
19059 			incdec_op(z);
19060 			*retval = z;
19061 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19062 			zval_ptr_dtor(&object);
19063 			SELECTIVE_PZVAL_LOCK(*retval, opline);
19064 			zval_ptr_dtor(&z);
19065 		} else {
19066 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
19067 			if (RETURN_VALUE_USED(opline)) {
19068 				PZVAL_LOCK(&EG(uninitialized_zval));
19069 				*retval = &EG(uninitialized_zval);
19070 			}
19071 		}
19072 	}
19073 
19074 	if (0) {
19075 		zval_ptr_dtor(&property);
19076 	} else {
19077 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19078 	}
19079 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19080 	CHECK_EXCEPTION();
19081 	ZEND_VM_NEXT_OPCODE();
19082 }
19083 
ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19084 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19085 {
19086 	return zend_pre_incdec_property_helper_SPEC_VAR_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19087 }
19088 
ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19089 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19090 {
19091 	return zend_pre_incdec_property_helper_SPEC_VAR_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19092 }
19093 
zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)19094 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
19095 {
19096 	USE_OPLINE
19097 	zend_free_op free_op1, free_op2;
19098 	zval **object_ptr;
19099 	zval *object;
19100 	zval *property;
19101 	zval *retval;
19102 	int have_get_ptr = 0;
19103 
19104 	SAVE_OPLINE();
19105 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19106 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19107 	retval = &EX_T(opline->result.var).tmp_var;
19108 
19109 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19110 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
19111 	}
19112 
19113 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
19114 	object = *object_ptr;
19115 
19116 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
19117 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
19118 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19119 		ZVAL_NULL(retval);
19120 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19121 		CHECK_EXCEPTION();
19122 		ZEND_VM_NEXT_OPCODE();
19123 	}
19124 
19125 	/* here we are sure we are dealing with an object */
19126 
19127 	if (0) {
19128 		MAKE_REAL_ZVAL_PTR(property);
19129 	}
19130 
19131 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
19132 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19133 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
19134 			have_get_ptr = 1;
19135 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
19136 
19137 			ZVAL_COPY_VALUE(retval, *zptr);
19138 			zendi_zval_copy_ctor(*retval);
19139 
19140 			incdec_op(*zptr);
19141 
19142 		}
19143 	}
19144 
19145 	if (!have_get_ptr) {
19146 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
19147 			zval *z, *z_copy;
19148 
19149 			Z_ADDREF_P(object);
19150 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19151 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
19152 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
19153 
19154 				if (Z_REFCOUNT_P(z) == 0) {
19155 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
19156 					zval_dtor(z);
19157 					FREE_ZVAL(z);
19158 				}
19159 				z = value;
19160 			}
19161 			ZVAL_COPY_VALUE(retval, z);
19162 			zendi_zval_copy_ctor(*retval);
19163 			ALLOC_ZVAL(z_copy);
19164 			INIT_PZVAL_COPY(z_copy, z);
19165 			zendi_zval_copy_ctor(*z_copy);
19166 			incdec_op(z_copy);
19167 			Z_ADDREF_P(z);
19168 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19169 			zval_ptr_dtor(&object);
19170 			zval_ptr_dtor(&z_copy);
19171 			zval_ptr_dtor(&z);
19172 		} else {
19173 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
19174 			ZVAL_NULL(retval);
19175 		}
19176 	}
19177 
19178 	if (0) {
19179 		zval_ptr_dtor(&property);
19180 	} else {
19181 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19182 	}
19183 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19184 	CHECK_EXCEPTION();
19185 	ZEND_VM_NEXT_OPCODE();
19186 }
19187 
ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19188 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19189 {
19190 	return zend_post_incdec_property_helper_SPEC_VAR_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19191 }
19192 
ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19193 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19194 {
19195 	return zend_post_incdec_property_helper_SPEC_VAR_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19196 }
19197 
zend_fetch_var_address_helper_SPEC_VAR_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)19198 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
19199 {
19200 	USE_OPLINE
19201 	zend_free_op free_op1;
19202 	zval *varname;
19203 	zval **retval;
19204 	zval tmp_varname;
19205 	HashTable *target_symbol_table;
19206 	ulong hash_value;
19207 
19208 	SAVE_OPLINE();
19209 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19210 
19211  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
19212 		ZVAL_COPY_VALUE(&tmp_varname, varname);
19213 		zval_copy_ctor(&tmp_varname);
19214 		Z_SET_REFCOUNT(tmp_varname, 1);
19215 		Z_UNSET_ISREF(tmp_varname);
19216 		convert_to_string(&tmp_varname);
19217 		varname = &tmp_varname;
19218 	}
19219 
19220 	if (IS_VAR != IS_UNUSED) {
19221 		zend_class_entry *ce;
19222 
19223 		if (IS_VAR == IS_CONST) {
19224 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
19225 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
19226 			} else {
19227 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
19228 				if (UNEXPECTED(ce == NULL)) {
19229 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
19230 						zval_dtor(&tmp_varname);
19231 					}
19232 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19233 					CHECK_EXCEPTION();
19234 					ZEND_VM_NEXT_OPCODE();
19235 				}
19236 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
19237 			}
19238 		} else {
19239 			ce = EX_T(opline->op2.var).class_entry;
19240 		}
19241 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
19242 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19243 	} else {
19244 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
19245 /*
19246 		if (!target_symbol_table) {
19247 			CHECK_EXCEPTION();
19248 			ZEND_VM_NEXT_OPCODE();
19249 		}
19250 */
19251 		if (IS_VAR == IS_CONST) {
19252 			hash_value = Z_HASH_P(varname);
19253 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
19254 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
19255 		} else {
19256 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
19257 		}
19258 
19259 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
19260 			switch (type) {
19261 				case BP_VAR_R:
19262 				case BP_VAR_UNSET:
19263 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
19264 					/* break missing intentionally */
19265 				case BP_VAR_IS:
19266 					retval = &EG(uninitialized_zval_ptr);
19267 					break;
19268 				case BP_VAR_RW:
19269 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
19270 					/* break missing intentionally */
19271 				case BP_VAR_W:
19272 					Z_ADDREF_P(&EG(uninitialized_zval));
19273 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
19274 					break;
19275 				EMPTY_SWITCH_DEFAULT_CASE()
19276 			}
19277 		}
19278 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
19279 			case ZEND_FETCH_GLOBAL:
19280 				if (IS_VAR != IS_TMP_VAR) {
19281 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19282 				}
19283 				break;
19284 			case ZEND_FETCH_LOCAL:
19285 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19286 				break;
19287 			case ZEND_FETCH_STATIC:
19288 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
19289 				break;
19290 			case ZEND_FETCH_GLOBAL_LOCK:
19291 				if (IS_VAR == IS_VAR && !free_op1.var) {
19292 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
19293 				}
19294 				break;
19295 		}
19296 	}
19297 
19298 
19299 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
19300 		zval_dtor(&tmp_varname);
19301 	}
19302 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
19303 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
19304 	}
19305 	PZVAL_LOCK(*retval);
19306 	switch (type) {
19307 		case BP_VAR_R:
19308 		case BP_VAR_IS:
19309 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
19310 			break;
19311 		case BP_VAR_UNSET: {
19312 			zend_free_op free_res;
19313 
19314 			PZVAL_UNLOCK(*retval, &free_res);
19315 			if (retval != &EG(uninitialized_zval_ptr)) {
19316 				SEPARATE_ZVAL_IF_NOT_REF(retval);
19317 			}
19318 			PZVAL_LOCK(*retval);
19319 			FREE_OP_VAR_PTR(free_res);
19320 		}
19321 		/* break missing intentionally */
19322 		default:
19323 			EX_T(opline->result.var).var.ptr_ptr = retval;
19324 			break;
19325 	}
19326 	CHECK_EXCEPTION();
19327 	ZEND_VM_NEXT_OPCODE();
19328 }
19329 
ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19330 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19331 {
19332 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19333 }
19334 
ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19335 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19336 {
19337 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19338 }
19339 
ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19340 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19341 {
19342 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19343 }
19344 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19345 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19346 {
19347 	USE_OPLINE
19348 
19349 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19350 }
19351 
ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19352 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19353 {
19354 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19355 }
19356 
ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19357 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19358 {
19359 	return zend_fetch_var_address_helper_SPEC_VAR_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19360 }
19361 
ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19362 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19363 {
19364 	USE_OPLINE
19365 	zend_free_op free_op1, free_op2;
19366 	zval *container;
19367 
19368 	SAVE_OPLINE();
19369 
19370 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
19371 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
19372 	}
19373 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19374 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
19375 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19376 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19377 	CHECK_EXCEPTION();
19378 	ZEND_VM_NEXT_OPCODE();
19379 }
19380 
ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19381 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19382 {
19383 	USE_OPLINE
19384 	zend_free_op free_op1, free_op2;
19385 	zval **container;
19386 
19387 	SAVE_OPLINE();
19388 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19389 
19390 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19391 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19392 	}
19393 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
19394 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19395 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19396 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19397 	}
19398 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19399 
19400 	/* We are going to assign the result by reference */
19401 	if (UNEXPECTED(opline->extended_value != 0)) {
19402 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
19403 
19404 		if (retval_ptr) {
19405 			Z_DELREF_PP(retval_ptr);
19406 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
19407 			Z_ADDREF_PP(retval_ptr);
19408 		}
19409 	}
19410 
19411 	CHECK_EXCEPTION();
19412 	ZEND_VM_NEXT_OPCODE();
19413 }
19414 
ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19415 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19416 {
19417 	USE_OPLINE
19418 	zend_free_op free_op1, free_op2;
19419 	zval **container;
19420 
19421 	SAVE_OPLINE();
19422 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19423 
19424 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19425 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19426 	}
19427 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_RW TSRMLS_CC);
19428 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19429 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19430 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19431 	}
19432 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19433 	CHECK_EXCEPTION();
19434 	ZEND_VM_NEXT_OPCODE();
19435 }
19436 
ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19437 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19438 {
19439 	USE_OPLINE
19440 	zend_free_op free_op1, free_op2;
19441 	zval *container;
19442 
19443 	SAVE_OPLINE();
19444 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19445 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_IS TSRMLS_CC);
19446 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19447 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19448 	CHECK_EXCEPTION();
19449 	ZEND_VM_NEXT_OPCODE();
19450 }
19451 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19452 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19453 {
19454 	USE_OPLINE
19455 	zend_free_op free_op1, free_op2;
19456 
19457 	SAVE_OPLINE();
19458 
19459 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
19460 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19461 
19462 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19463 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19464 		}
19465 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
19466 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19467 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19468 		}
19469 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19470 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19471 	} else {
19472 		zval *container;
19473 
19474 		if (IS_VAR == IS_UNUSED) {
19475 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
19476 		}
19477 		container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19478 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
19479 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19480 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19481 	}
19482 	CHECK_EXCEPTION();
19483 	ZEND_VM_NEXT_OPCODE();
19484 }
19485 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19486 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19487 {
19488 	USE_OPLINE
19489 	zend_free_op free_op1, free_op2;
19490 	zval **container;
19491 
19492 	SAVE_OPLINE();
19493 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19494 
19495 	if (IS_VAR == IS_CV) {
19496 		if (container != &EG(uninitialized_zval_ptr)) {
19497 			SEPARATE_ZVAL_IF_NOT_REF(container);
19498 		}
19499 	}
19500 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19501 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19502 	}
19503 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_UNSET TSRMLS_CC);
19504 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19505 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19506 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19507 	}
19508 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19509 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
19510 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
19511 		ZEND_VM_NEXT_OPCODE();
19512 	} else {
19513 		zend_free_op free_res;
19514 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
19515 
19516 		PZVAL_UNLOCK(*retval_ptr, &free_res);
19517 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
19518 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
19519 		}
19520 		PZVAL_LOCK(*retval_ptr);
19521 		FREE_OP_VAR_PTR(free_res);
19522 		CHECK_EXCEPTION();
19523 		ZEND_VM_NEXT_OPCODE();
19524 	}
19525 }
19526 
zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS)19527 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS)
19528 {
19529 	USE_OPLINE
19530 	zend_free_op free_op1;
19531 	zval *container;
19532 	zend_free_op free_op2;
19533 	zval *offset;
19534 
19535 	SAVE_OPLINE();
19536 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19537 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19538 
19539 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
19540 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
19541 		zend_error(E_NOTICE, "Trying to get property of non-object");
19542 		PZVAL_LOCK(&EG(uninitialized_zval));
19543 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19544 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19545 	} else {
19546 		zval *retval;
19547 
19548 		if (0) {
19549 			MAKE_REAL_ZVAL_PTR(offset);
19550 		}
19551 
19552 		/* here we are sure we are dealing with an object */
19553 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19554 
19555 		PZVAL_LOCK(retval);
19556 		AI_SET_PTR(&EX_T(opline->result.var), retval);
19557 
19558 		if (0) {
19559 			zval_ptr_dtor(&offset);
19560 		} else {
19561 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19562 		}
19563 	}
19564 
19565 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19566 	CHECK_EXCEPTION();
19567 	ZEND_VM_NEXT_OPCODE();
19568 }
19569 
ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19570 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19571 {
19572 	return zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19573 }
19574 
ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19575 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19576 {
19577 	USE_OPLINE
19578 	zend_free_op free_op1, free_op2;
19579 	zval *property;
19580 	zval **container;
19581 
19582 	SAVE_OPLINE();
19583 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19584 
19585 	if (0) {
19586 		MAKE_REAL_ZVAL_PTR(property);
19587 	}
19588 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19589 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19590 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
19591 	}
19592 
19593 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
19594 	if (0) {
19595 		zval_ptr_dtor(&property);
19596 	} else {
19597 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19598 	}
19599 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19600 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19601 	}
19602 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19603 
19604 	/* We are going to assign the result by reference */
19605 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
19606 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
19607 
19608 		Z_DELREF_PP(retval_ptr);
19609 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
19610 		Z_ADDREF_PP(retval_ptr);
19611 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
19612 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
19613 	}
19614 
19615 	CHECK_EXCEPTION();
19616 	ZEND_VM_NEXT_OPCODE();
19617 }
19618 
ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19619 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19620 {
19621 	USE_OPLINE
19622 	zend_free_op free_op1, free_op2;
19623 	zval *property;
19624 	zval **container;
19625 
19626 	SAVE_OPLINE();
19627 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19628 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19629 
19630 	if (0) {
19631 		MAKE_REAL_ZVAL_PTR(property);
19632 	}
19633 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19634 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
19635 	}
19636 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
19637 	if (0) {
19638 		zval_ptr_dtor(&property);
19639 	} else {
19640 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19641 	}
19642 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19643 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19644 	}
19645 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19646 	CHECK_EXCEPTION();
19647 	ZEND_VM_NEXT_OPCODE();
19648 }
19649 
ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19650 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19651 {
19652 	USE_OPLINE
19653 	zend_free_op free_op1;
19654 	zval *container;
19655 	zend_free_op free_op2;
19656 	zval *offset;
19657 
19658 	SAVE_OPLINE();
19659 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19660 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19661 
19662 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
19663 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
19664 		PZVAL_LOCK(&EG(uninitialized_zval));
19665 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19666 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19667 	} else {
19668 		zval *retval;
19669 
19670 		if (0) {
19671 			MAKE_REAL_ZVAL_PTR(offset);
19672 		}
19673 
19674 		/* here we are sure we are dealing with an object */
19675 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19676 
19677 		PZVAL_LOCK(retval);
19678 		AI_SET_PTR(&EX_T(opline->result.var), retval);
19679 
19680 		if (0) {
19681 			zval_ptr_dtor(&offset);
19682 		} else {
19683 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19684 		}
19685 	}
19686 
19687 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19688 	CHECK_EXCEPTION();
19689 	ZEND_VM_NEXT_OPCODE();
19690 }
19691 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19692 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19693 {
19694 	USE_OPLINE
19695 
19696 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
19697 		/* Behave like FETCH_OBJ_W */
19698 		zend_free_op free_op1, free_op2;
19699 		zval *property;
19700 		zval **container;
19701 
19702 		SAVE_OPLINE();
19703 		property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19704 		container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19705 
19706 		if (0) {
19707 			MAKE_REAL_ZVAL_PTR(property);
19708 		}
19709 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19710 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
19711 		}
19712 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
19713 		if (0) {
19714 			zval_ptr_dtor(&property);
19715 		} else {
19716 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19717 		}
19718 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19719 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19720 		}
19721 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19722 		CHECK_EXCEPTION();
19723 		ZEND_VM_NEXT_OPCODE();
19724 	} else {
19725 		return zend_fetch_property_address_read_helper_SPEC_VAR_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19726 	}
19727 }
19728 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19729 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19730 {
19731 	USE_OPLINE
19732 	zend_free_op free_op1, free_op2, free_res;
19733 	zval **container;
19734 	zval *property;
19735 
19736 	SAVE_OPLINE();
19737 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19738 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19739 
19740 	if (IS_VAR == IS_CV) {
19741 		if (container != &EG(uninitialized_zval_ptr)) {
19742 			SEPARATE_ZVAL_IF_NOT_REF(container);
19743 		}
19744 	}
19745 	if (0) {
19746 		MAKE_REAL_ZVAL_PTR(property);
19747 	}
19748 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
19749 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
19750 	}
19751 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
19752 	if (0) {
19753 		zval_ptr_dtor(&property);
19754 	} else {
19755 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19756 	}
19757 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
19758 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
19759 	}
19760 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19761 
19762 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
19763 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
19764 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
19765 	}
19766 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
19767 	FREE_OP_VAR_PTR(free_res);
19768 	CHECK_EXCEPTION();
19769 	ZEND_VM_NEXT_OPCODE();
19770 }
19771 
ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19772 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19773 {
19774 	USE_OPLINE
19775 	zend_free_op free_op1, free_op2;
19776 	zval **object_ptr;
19777 	zval *property_name;
19778 
19779 	SAVE_OPLINE();
19780 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19781 	property_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19782 
19783 	if (0) {
19784 		MAKE_REAL_ZVAL_PTR(property_name);
19785 	}
19786 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19787 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19788 	}
19789 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19790 	if (0) {
19791 		zval_ptr_dtor(&property_name);
19792 	} else {
19793 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19794 	}
19795 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19796 	/* assign_obj has two opcodes! */
19797 	CHECK_EXCEPTION();
19798 	ZEND_VM_INC_OPCODE();
19799 	ZEND_VM_NEXT_OPCODE();
19800 }
19801 
ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19802 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19803 {
19804 	USE_OPLINE
19805 	zend_free_op free_op1;
19806 	zval **object_ptr;
19807 
19808 	SAVE_OPLINE();
19809 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19810 
19811 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
19812 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
19813 	}
19814 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
19815 		zend_free_op free_op2;
19816 		zval *property_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19817 
19818 		if (0) {
19819 			MAKE_REAL_ZVAL_PTR(property_name);
19820 		}
19821 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
19822 		if (0) {
19823 			zval_ptr_dtor(&property_name);
19824 		} else {
19825 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19826 		}
19827 	} else {
19828 		zend_free_op free_op2, free_op_data1, free_op_data2;
19829 		zval *value;
19830 		zval *dim = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19831 		zval **variable_ptr_ptr;
19832 
19833 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_VAR, BP_VAR_W TSRMLS_CC);
19834 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19835 
19836 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
19837 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
19838 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
19839 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
19840 				if (RETURN_VALUE_USED(opline)) {
19841 					zval *retval;
19842 
19843 					ALLOC_ZVAL(retval);
19844 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
19845 					INIT_PZVAL(retval);
19846 					AI_SET_PTR(&EX_T(opline->result.var), retval);
19847 				}
19848 			} else if (RETURN_VALUE_USED(opline)) {
19849 				PZVAL_LOCK(&EG(uninitialized_zval));
19850 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19851 			}
19852 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
19853 			if (IS_TMP_FREE(free_op_data1)) {
19854 				zval_dtor(value);
19855 			}
19856 			if (RETURN_VALUE_USED(opline)) {
19857 				PZVAL_LOCK(&EG(uninitialized_zval));
19858 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19859 			}
19860 		} else {
19861 			if ((opline+1)->op1_type == IS_TMP_VAR) {
19862 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19863 			} else if ((opline+1)->op1_type == IS_CONST) {
19864 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19865 			} else {
19866 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19867 			}
19868 			if (RETURN_VALUE_USED(opline)) {
19869 				PZVAL_LOCK(value);
19870 				AI_SET_PTR(&EX_T(opline->result.var), value);
19871 			}
19872 		}
19873 		FREE_OP_VAR_PTR(free_op_data2);
19874 	 	FREE_OP_IF_VAR(free_op_data1);
19875 	}
19876  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19877 	/* assign_dim has two opcodes! */
19878 	CHECK_EXCEPTION();
19879 	ZEND_VM_INC_OPCODE();
19880 	ZEND_VM_NEXT_OPCODE();
19881 }
19882 
ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19883 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19884 {
19885 	USE_OPLINE
19886 	zend_free_op free_op1, free_op2;
19887 	zval *value;
19888 	zval **variable_ptr_ptr;
19889 
19890 	SAVE_OPLINE();
19891 	value = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19892 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19893 
19894 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
19895 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_VAR TSRMLS_CC)) {
19896 			if (RETURN_VALUE_USED(opline)) {
19897 				zval *retval;
19898 
19899 				ALLOC_ZVAL(retval);
19900 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
19901 				INIT_PZVAL(retval);
19902 				AI_SET_PTR(&EX_T(opline->result.var), retval);
19903 			}
19904 		} else if (RETURN_VALUE_USED(opline)) {
19905 			PZVAL_LOCK(&EG(uninitialized_zval));
19906 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19907 		}
19908 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
19909 		if (0) {
19910 			zval_dtor(value);
19911 		}
19912 		if (RETURN_VALUE_USED(opline)) {
19913 			PZVAL_LOCK(&EG(uninitialized_zval));
19914 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
19915 		}
19916 	} else {
19917 		if (IS_VAR == IS_TMP_VAR) {
19918 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19919 		} else if (IS_VAR == IS_CONST) {
19920 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19921 		} else {
19922 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
19923 		}
19924 		if (RETURN_VALUE_USED(opline)) {
19925 			PZVAL_LOCK(value);
19926 			AI_SET_PTR(&EX_T(opline->result.var), value);
19927 		}
19928 	}
19929 
19930 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
19931 		zval_ptr_dtor(&value);
19932 	}
19933 
19934 	/* zend_assign_to_variable() always takes care of op2, never free it! */
19935  	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19936 
19937 	CHECK_EXCEPTION();
19938 	ZEND_VM_NEXT_OPCODE();
19939 }
19940 
ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19941 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19942 {
19943 	USE_OPLINE
19944 	zend_free_op free_op1, free_op2;
19945 	zval **variable_ptr_ptr;
19946 	zval **value_ptr_ptr;
19947 
19948 	SAVE_OPLINE();
19949 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
19950 
19951 	if (IS_VAR == IS_VAR &&
19952 	    value_ptr_ptr &&
19953 	    !Z_ISREF_PP(value_ptr_ptr) &&
19954 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
19955 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
19956 		if (free_op2.var == NULL) {
19957 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
19958 		}
19959 		zend_error(E_STRICT, "Only variables should be assigned by reference");
19960 		if (UNEXPECTED(EG(exception) != NULL)) {
19961 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19962 			HANDLE_EXCEPTION();
19963 		}
19964 		return ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
19965 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
19966 		PZVAL_LOCK(*value_ptr_ptr);
19967 	}
19968 	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
19969 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
19970 	}
19971 
19972 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
19973 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
19974 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
19975 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
19976 	}
19977 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
19978 
19979 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
19980 		Z_DELREF_PP(variable_ptr_ptr);
19981 	}
19982 
19983 	if (RETURN_VALUE_USED(opline)) {
19984 		PZVAL_LOCK(*variable_ptr_ptr);
19985 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
19986 	}
19987 
19988 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
19989 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
19990 
19991 	CHECK_EXCEPTION();
19992 	ZEND_VM_NEXT_OPCODE();
19993 }
19994 
ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)19995 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
19996 {
19997 	USE_OPLINE
19998 	zval *function_name;
19999 	char *function_name_strval;
20000 	int function_name_strlen;
20001 	zend_free_op free_op1, free_op2;
20002 	call_slot *call = EX(call_slots) + opline->result.num;
20003 
20004 	SAVE_OPLINE();
20005 
20006 	function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20007 
20008 	if (IS_VAR != IS_CONST &&
20009 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
20010 		if (UNEXPECTED(EG(exception) != NULL)) {
20011 			HANDLE_EXCEPTION();
20012 		}
20013 		zend_error_noreturn(E_ERROR, "Method name must be a string");
20014 	}
20015 
20016 	function_name_strval = Z_STRVAL_P(function_name);
20017 	function_name_strlen = Z_STRLEN_P(function_name);
20018 
20019 	call->object = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20020 
20021 	if (EXPECTED(call->object != NULL) &&
20022 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
20023 		call->called_scope = Z_OBJCE_P(call->object);
20024 
20025 		if (IS_VAR != IS_CONST ||
20026 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
20027 		    zval *object = call->object;
20028 
20029 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
20030 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
20031 			}
20032 
20033 			/* First, locate the function. */
20034 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
20035 			if (UNEXPECTED(call->fbc == NULL)) {
20036 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
20037 			}
20038 			if (IS_VAR == IS_CONST &&
20039 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
20040 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
20041 			    EXPECTED(call->object == object)) {
20042 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
20043 			}
20044 		}
20045 	} else {
20046 		if (UNEXPECTED(EG(exception) != NULL)) {
20047 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20048 			HANDLE_EXCEPTION();
20049 		}
20050 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
20051 	}
20052 
20053 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
20054 		call->object = NULL;
20055 	} else {
20056 		if (!PZVAL_IS_REF(call->object)) {
20057 			Z_ADDREF_P(call->object); /* For $this pointer */
20058 		} else {
20059 			zval *this_ptr;
20060 			ALLOC_ZVAL(this_ptr);
20061 			INIT_PZVAL_COPY(this_ptr, call->object);
20062 			zval_copy_ctor(this_ptr);
20063 			call->object = this_ptr;
20064 		}
20065 	}
20066 	call->is_ctor_call = 0;
20067 	EX(call) = call;
20068 
20069 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20070 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20071 
20072 	CHECK_EXCEPTION();
20073 	ZEND_VM_NEXT_OPCODE();
20074 }
20075 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20076 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20077 {
20078 	USE_OPLINE
20079 	zval *function_name;
20080 	zend_class_entry *ce;
20081 	call_slot *call = EX(call_slots) + opline->result.num;
20082 
20083 	SAVE_OPLINE();
20084 
20085 	if (IS_VAR == IS_CONST) {
20086 		/* no function found. try a static method in class */
20087 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
20088 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
20089 		} else {
20090 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
20091 			if (UNEXPECTED(EG(exception) != NULL)) {
20092 				HANDLE_EXCEPTION();
20093 			}
20094 			if (UNEXPECTED(ce == NULL)) {
20095 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
20096 			}
20097 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
20098 		}
20099 		call->called_scope = ce;
20100 	} else {
20101 		ce = EX_T(opline->op1.var).class_entry;
20102 
20103 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
20104 			call->called_scope = EG(called_scope);
20105 		} else {
20106 			call->called_scope = ce;
20107 		}
20108 	}
20109 
20110 	if (IS_VAR == IS_CONST &&
20111 	    IS_VAR == IS_CONST &&
20112 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
20113 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
20114 	} else if (IS_VAR != IS_CONST &&
20115 	           IS_VAR == IS_CONST &&
20116 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
20117 		/* do nothing */
20118 	} else if (IS_VAR != IS_UNUSED) {
20119 		char *function_name_strval = NULL;
20120 		int function_name_strlen = 0;
20121 		zend_free_op free_op2;
20122 
20123 		if (IS_VAR == IS_CONST) {
20124 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
20125 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
20126 		} else {
20127 			function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20128 
20129 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
20130 				if (UNEXPECTED(EG(exception) != NULL)) {
20131 					HANDLE_EXCEPTION();
20132 				}
20133 				zend_error_noreturn(E_ERROR, "Function name must be a string");
20134 			} else {
20135 				function_name_strval = Z_STRVAL_P(function_name);
20136 				function_name_strlen = Z_STRLEN_P(function_name);
20137  			}
20138 		}
20139 
20140 		if (function_name_strval) {
20141 			if (ce->get_static_method) {
20142 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
20143 			} else {
20144 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
20145 			}
20146 			if (UNEXPECTED(call->fbc == NULL)) {
20147 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
20148 			}
20149 			if (IS_VAR == IS_CONST &&
20150 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
20151 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
20152 				if (IS_VAR == IS_CONST) {
20153 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
20154 				} else {
20155 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
20156 				}
20157 			}
20158 		}
20159 		if (IS_VAR != IS_CONST) {
20160 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20161 		}
20162 	} else {
20163 		if (UNEXPECTED(ce->constructor == NULL)) {
20164 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
20165 		}
20166 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
20167 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
20168 		}
20169 		call->fbc = ce->constructor;
20170 	}
20171 
20172 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
20173 		call->object = NULL;
20174 	} else {
20175 		if (EG(This) &&
20176 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
20177 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
20178 		    /* We are calling method of the other (incompatible) class,
20179 		       but passing $this. This is done for compatibility with php-4. */
20180 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
20181 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
20182 			} else {
20183 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
20184 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
20185 			}
20186 		}
20187 		if ((call->object = EG(This))) {
20188 			Z_ADDREF_P(call->object);
20189 			call->called_scope = Z_OBJCE_P(call->object);
20190 		}
20191 	}
20192 	call->is_ctor_call = 0;
20193 	EX(call) = call;
20194 
20195 	CHECK_EXCEPTION();
20196 	ZEND_VM_NEXT_OPCODE();
20197 }
20198 
ZEND_CASE_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20199 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20200 {
20201 	USE_OPLINE
20202 	zend_free_op free_op1, free_op2;
20203 
20204 	SAVE_OPLINE();
20205 	if (IS_VAR==IS_VAR) {
20206 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
20207 	}
20208 	is_equal_function(&EX_T(opline->result.var).tmp_var,
20209 				 _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
20210 				 _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
20211 
20212 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20213 	CHECK_EXCEPTION();
20214 	ZEND_VM_NEXT_OPCODE();
20215 }
20216 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20217 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20218 {
20219 	USE_OPLINE
20220 	zend_free_op free_op1;
20221 	zval *expr_ptr;
20222 
20223 	SAVE_OPLINE();
20224 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
20225 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20226 
20227 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
20228 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
20229 		}
20230 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
20231 		expr_ptr = *expr_ptr_ptr;
20232 		Z_ADDREF_P(expr_ptr);
20233 	} else {
20234 		expr_ptr=_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20235 		if (0) { /* temporary variable */
20236 			zval *new_expr;
20237 
20238 			ALLOC_ZVAL(new_expr);
20239 			INIT_PZVAL_COPY(new_expr, expr_ptr);
20240 			expr_ptr = new_expr;
20241 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
20242 			zval *new_expr;
20243 
20244 			ALLOC_ZVAL(new_expr);
20245 			INIT_PZVAL_COPY(new_expr, expr_ptr);
20246 			expr_ptr = new_expr;
20247 			zendi_zval_copy_ctor(*expr_ptr);
20248 		} else {
20249 			Z_ADDREF_P(expr_ptr);
20250 		}
20251 	}
20252 
20253 	if (IS_VAR != IS_UNUSED) {
20254 		zend_free_op free_op2;
20255 		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20256 		ulong hval;
20257 
20258 		switch (Z_TYPE_P(offset)) {
20259 			case IS_DOUBLE:
20260 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
20261 				goto num_index;
20262 			case IS_LONG:
20263 			case IS_BOOL:
20264 				hval = Z_LVAL_P(offset);
20265 num_index:
20266 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
20267 				break;
20268 			case IS_STRING:
20269 				if (IS_VAR == IS_CONST) {
20270 					hval = Z_HASH_P(offset);
20271 				} else {
20272 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
20273 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
20274 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
20275 					} else {
20276 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
20277 					}
20278 				}
20279 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
20280 				break;
20281 			case IS_NULL:
20282 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
20283 				break;
20284 			default:
20285 				zend_error(E_WARNING, "Illegal offset type");
20286 				zval_ptr_dtor(&expr_ptr);
20287 				/* do nothing */
20288 				break;
20289 		}
20290 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20291 	} else {
20292 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
20293 	}
20294 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
20295 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20296 	} else {
20297 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20298 	}
20299 	CHECK_EXCEPTION();
20300 	ZEND_VM_NEXT_OPCODE();
20301 }
20302 
ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20303 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20304 {
20305 	USE_OPLINE
20306 
20307 	array_init(&EX_T(opline->result.var).tmp_var);
20308 	if (IS_VAR == IS_UNUSED) {
20309 		ZEND_VM_NEXT_OPCODE();
20310 #if 0 || IS_VAR != IS_UNUSED
20311 	} else {
20312 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20313 #endif
20314 	}
20315 }
20316 
ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20317 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20318 {
20319 	USE_OPLINE
20320 	zval tmp, *varname;
20321 	HashTable *target_symbol_table;
20322 	zend_free_op free_op1;
20323 
20324 	SAVE_OPLINE();
20325 	if (IS_VAR == IS_CV &&
20326 	    IS_VAR == IS_UNUSED &&
20327 	    (opline->extended_value & ZEND_QUICK_SET)) {
20328 		if (EG(active_symbol_table)) {
20329 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
20330 
20331 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
20332 			EX_CV(opline->op1.var) = NULL;
20333 		} else if (EX_CV(opline->op1.var)) {
20334 			zval_ptr_dtor(EX_CV(opline->op1.var));
20335 			EX_CV(opline->op1.var) = NULL;
20336 		}
20337 		CHECK_EXCEPTION();
20338 		ZEND_VM_NEXT_OPCODE();
20339 	}
20340 
20341 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20342 
20343 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
20344 		ZVAL_COPY_VALUE(&tmp, varname);
20345 		zval_copy_ctor(&tmp);
20346 		convert_to_string(&tmp);
20347 		varname = &tmp;
20348 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
20349 		Z_ADDREF_P(varname);
20350 	}
20351 
20352 	if (IS_VAR != IS_UNUSED) {
20353 		zend_class_entry *ce;
20354 
20355 		if (IS_VAR == IS_CONST) {
20356 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
20357 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
20358 			} else {
20359 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
20360 				if (UNEXPECTED(EG(exception) != NULL)) {
20361 					if (IS_VAR != IS_CONST && varname == &tmp) {
20362 						zval_dtor(&tmp);
20363 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
20364 						zval_ptr_dtor(&varname);
20365 					}
20366 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20367 					HANDLE_EXCEPTION();
20368 				}
20369 				if (UNEXPECTED(ce == NULL)) {
20370 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
20371 				}
20372 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
20373 			}
20374 		} else {
20375 			ce = EX_T(opline->op2.var).class_entry;
20376 		}
20377 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
20378 	} else {
20379 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
20380 
20381 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
20382 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
20383 	}
20384 
20385 	if (IS_VAR != IS_CONST && varname == &tmp) {
20386 		zval_dtor(&tmp);
20387 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
20388 		zval_ptr_dtor(&varname);
20389 	}
20390 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20391 	CHECK_EXCEPTION();
20392 	ZEND_VM_NEXT_OPCODE();
20393 }
20394 
ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20395 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20396 {
20397 	USE_OPLINE
20398 	zend_free_op free_op1, free_op2;
20399 	zval **container;
20400 	zval *offset;
20401 	ulong hval;
20402 
20403 	SAVE_OPLINE();
20404 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20405 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
20406 		SEPARATE_ZVAL_IF_NOT_REF(container);
20407 	}
20408 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20409 
20410 	if (IS_VAR != IS_VAR || container) {
20411 		switch (Z_TYPE_PP(container)) {
20412 			case IS_ARRAY: {
20413 				HashTable *ht = Z_ARRVAL_PP(container);
20414 
20415 				switch (Z_TYPE_P(offset)) {
20416 					case IS_DOUBLE:
20417 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
20418 						zend_hash_index_del(ht, hval);
20419 						break;
20420 					case IS_RESOURCE:
20421 					case IS_BOOL:
20422 					case IS_LONG:
20423 						hval = Z_LVAL_P(offset);
20424 						zend_hash_index_del(ht, hval);
20425 						break;
20426 					case IS_STRING:
20427 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
20428 							Z_ADDREF_P(offset);
20429 						}
20430 						if (IS_VAR == IS_CONST) {
20431 							hval = Z_HASH_P(offset);
20432 						} else {
20433 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
20434 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
20435 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
20436 							} else {
20437 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
20438 							}
20439 						}
20440 						if (ht == &EG(symbol_table)) {
20441 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
20442 						} else {
20443 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
20444 						}
20445 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
20446 							zval_ptr_dtor(&offset);
20447 						}
20448 						break;
20449 num_index_dim:
20450 						zend_hash_index_del(ht, hval);
20451 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
20452 							zval_ptr_dtor(&offset);
20453 						}
20454 						break;
20455 					case IS_NULL:
20456 						zend_hash_del(ht, "", sizeof(""));
20457 						break;
20458 					default:
20459 						zend_error(E_WARNING, "Illegal offset type in unset");
20460 						break;
20461 				}
20462 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20463 				break;
20464 			}
20465 			case IS_OBJECT:
20466 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
20467 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
20468 				}
20469 				if (0) {
20470 					MAKE_REAL_ZVAL_PTR(offset);
20471 				}
20472 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
20473 				if (0) {
20474 					zval_ptr_dtor(&offset);
20475 				} else {
20476 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20477 				}
20478 				break;
20479 			case IS_STRING:
20480 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
20481 				ZEND_VM_CONTINUE(); /* bailed out before */
20482 			default:
20483 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20484 				break;
20485 		}
20486 	} else {
20487 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20488 	}
20489 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20490 
20491 	CHECK_EXCEPTION();
20492 	ZEND_VM_NEXT_OPCODE();
20493 }
20494 
ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20495 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20496 {
20497 	USE_OPLINE
20498 	zend_free_op free_op1, free_op2;
20499 	zval **container;
20500 	zval *offset;
20501 
20502 	SAVE_OPLINE();
20503 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20504 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20505 
20506 	if (IS_VAR != IS_VAR || container) {
20507 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
20508 			SEPARATE_ZVAL_IF_NOT_REF(container);
20509 		}
20510 		if (Z_TYPE_PP(container) == IS_OBJECT) {
20511 			if (0) {
20512 				MAKE_REAL_ZVAL_PTR(offset);
20513 			}
20514 			if (Z_OBJ_HT_P(*container)->unset_property) {
20515 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20516 			} else {
20517 				zend_error(E_NOTICE, "Trying to unset property of non-object");
20518 			}
20519 			if (0) {
20520 				zval_ptr_dtor(&offset);
20521 			} else {
20522 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20523 			}
20524 		} else {
20525 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20526 		}
20527 	} else {
20528 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20529 	}
20530 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20531 
20532 	CHECK_EXCEPTION();
20533 	ZEND_VM_NEXT_OPCODE();
20534 }
20535 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20536 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20537 {
20538 	USE_OPLINE
20539 	zval **value;
20540 	zend_bool isset = 1;
20541 
20542 	SAVE_OPLINE();
20543 	if (IS_VAR == IS_CV &&
20544 	    IS_VAR == IS_UNUSED &&
20545 	    (opline->extended_value & ZEND_QUICK_SET)) {
20546 		if (EX_CV(opline->op1.var)) {
20547 			value = EX_CV(opline->op1.var);
20548 		} else if (EG(active_symbol_table)) {
20549 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
20550 
20551 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
20552 				isset = 0;
20553 			}
20554 		} else {
20555 			isset = 0;
20556 		}
20557 	} else {
20558 		HashTable *target_symbol_table;
20559 		zend_free_op free_op1;
20560 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20561 
20562 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
20563 			ZVAL_COPY_VALUE(&tmp, varname);
20564 			zval_copy_ctor(&tmp);
20565 			convert_to_string(&tmp);
20566 			varname = &tmp;
20567 		}
20568 
20569 		if (IS_VAR != IS_UNUSED) {
20570 			zend_class_entry *ce;
20571 
20572 			if (IS_VAR == IS_CONST) {
20573 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
20574 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
20575 				} else {
20576 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
20577 					if (UNEXPECTED(ce == NULL)) {
20578 						CHECK_EXCEPTION();
20579 						ZEND_VM_NEXT_OPCODE();
20580 					}
20581 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
20582 				}
20583 			} else {
20584 				ce = EX_T(opline->op2.var).class_entry;
20585 			}
20586 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
20587 			if (!value) {
20588 				isset = 0;
20589 			}
20590 		} else {
20591 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
20592 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
20593 				isset = 0;
20594 			}
20595 		}
20596 
20597 		if (IS_VAR != IS_CONST && varname == &tmp) {
20598 			zval_dtor(&tmp);
20599 		}
20600 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20601 	}
20602 
20603 	if (opline->extended_value & ZEND_ISSET) {
20604 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
20605 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
20606 		} else {
20607 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
20608 		}
20609 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
20610 		if (!isset || !i_zend_is_true(*value)) {
20611 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
20612 		} else {
20613 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
20614 		}
20615 	}
20616 
20617 	CHECK_EXCEPTION();
20618 	ZEND_VM_NEXT_OPCODE();
20619 }
20620 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)20621 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
20622 {
20623 	USE_OPLINE
20624 	zend_free_op free_op1, free_op2;
20625 	zval *container;
20626 	zval **value = NULL;
20627 	int result = 0;
20628 	ulong hval;
20629 	zval *offset;
20630 
20631 	SAVE_OPLINE();
20632 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20633 
20634 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20635 
20636 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
20637 		HashTable *ht;
20638 		int isset = 0;
20639 
20640 		ht = Z_ARRVAL_P(container);
20641 
20642 		switch (Z_TYPE_P(offset)) {
20643 			case IS_DOUBLE:
20644 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
20645 				goto num_index_prop;
20646 			case IS_RESOURCE:
20647 			case IS_BOOL:
20648 			case IS_LONG:
20649 				hval = Z_LVAL_P(offset);
20650 num_index_prop:
20651 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
20652 					isset = 1;
20653 				}
20654 				break;
20655 			case IS_STRING:
20656 				if (IS_VAR == IS_CONST) {
20657 					hval = Z_HASH_P(offset);
20658 				} else {
20659 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
20660 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
20661 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
20662 					} else {
20663 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
20664 					}
20665 				}
20666 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
20667 					isset = 1;
20668 				}
20669 				break;
20670 			case IS_NULL:
20671 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
20672 					isset = 1;
20673 				}
20674 				break;
20675 			default:
20676 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
20677 				break;
20678 		}
20679 
20680 		if (opline->extended_value & ZEND_ISSET) {
20681 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
20682 				result = 0;
20683 			} else {
20684 				result = isset;
20685 			}
20686 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
20687 			if (!isset || !i_zend_is_true(*value)) {
20688 				result = 0;
20689 			} else {
20690 				result = 1;
20691 			}
20692 		}
20693 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20694 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
20695 		if (0) {
20696 			MAKE_REAL_ZVAL_PTR(offset);
20697 		}
20698 		if (prop_dim) {
20699 			if (Z_OBJ_HT_P(container)->has_property) {
20700 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20701 			} else {
20702 				zend_error(E_NOTICE, "Trying to check property of non-object");
20703 				result = 0;
20704 			}
20705 		} else {
20706 			if (Z_OBJ_HT_P(container)->has_dimension) {
20707 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
20708 			} else {
20709 				zend_error(E_NOTICE, "Trying to check element of non-array");
20710 				result = 0;
20711 			}
20712 		}
20713 		if (0) {
20714 			zval_ptr_dtor(&offset);
20715 		} else {
20716 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20717 		}
20718 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
20719 		zval tmp;
20720 
20721 		if (Z_TYPE_P(offset) != IS_LONG) {
20722 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
20723 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
20724 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
20725 				ZVAL_COPY_VALUE(&tmp, offset);
20726 				zval_copy_ctor(&tmp);
20727 				convert_to_long(&tmp);
20728 				offset = &tmp;
20729 			} else {
20730 				/* can not be converted to proper offset, return "not set" */
20731 				result = 0;
20732 			}
20733 		}
20734 		if (Z_TYPE_P(offset) == IS_LONG) {
20735 			if (opline->extended_value & ZEND_ISSET) {
20736 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
20737 					result = 1;
20738 				}
20739 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
20740 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
20741 					result = 1;
20742 				}
20743 			}
20744 		}
20745 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20746 	} else {
20747 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20748 	}
20749 
20750 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
20751 	if (opline->extended_value & ZEND_ISSET) {
20752 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
20753 	} else {
20754 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
20755 	}
20756 
20757 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20758 
20759 	CHECK_EXCEPTION();
20760 	ZEND_VM_NEXT_OPCODE();
20761 }
20762 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20763 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20764 {
20765 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20766 }
20767 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20768 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20769 {
20770 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
20771 }
20772 
ZEND_YIELD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)20773 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
20774 {
20775 	USE_OPLINE
20776 
20777 	/* The generator object is stored in return_value_ptr_ptr */
20778 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
20779 
20780 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
20781 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
20782 	}
20783 
20784 	/* Destroy the previously yielded value */
20785 	if (generator->value) {
20786 		zval_ptr_dtor(&generator->value);
20787 	}
20788 
20789 	/* Destroy the previously yielded key */
20790 	if (generator->key) {
20791 		zval_ptr_dtor(&generator->key);
20792 	}
20793 
20794 	/* Set the new yielded value */
20795 	if (IS_VAR != IS_UNUSED) {
20796 		zend_free_op free_op1;
20797 
20798 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
20799 			/* Constants and temporary variables aren't yieldable by reference,
20800 			 * but we still allow them with a notice. */
20801 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
20802 				zval *value, *copy;
20803 
20804 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
20805 
20806 				value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20807 				ALLOC_ZVAL(copy);
20808 				INIT_PZVAL_COPY(copy, value);
20809 
20810 				/* Temporary variables don't need ctor copying */
20811 				if (!0) {
20812 					zval_copy_ctor(copy);
20813 				}
20814 
20815 				generator->value = copy;
20816 			} else {
20817 				zval **value_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20818 
20819 				if (IS_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
20820 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
20821 				}
20822 
20823 				/* If a function call result is yielded and the function did
20824 				 * not return by reference we throw a notice. */
20825 				if (IS_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
20826 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
20827 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
20828 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
20829 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
20830 
20831 					Z_ADDREF_PP(value_ptr);
20832 					generator->value = *value_ptr;
20833 				} else {
20834 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
20835 					Z_ADDREF_PP(value_ptr);
20836 					generator->value = *value_ptr;
20837 				}
20838 
20839 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20840 			}
20841 		} else {
20842 			zval *value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20843 
20844 			/* Consts, temporary variables and references need copying */
20845 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
20846 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
20847 			) {
20848 				zval *copy;
20849 
20850 				ALLOC_ZVAL(copy);
20851 				INIT_PZVAL_COPY(copy, value);
20852 
20853 				/* Temporary variables don't need ctor copying */
20854 				if (!0) {
20855 					zval_copy_ctor(copy);
20856 				}
20857 
20858 				generator->value = copy;
20859 			} else {
20860 				Z_ADDREF_P(value);
20861 				generator->value = value;
20862 			}
20863 
20864 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
20865 		}
20866 	} else {
20867 		/* If no value was specified yield null */
20868 		Z_ADDREF(EG(uninitialized_zval));
20869 		generator->value = &EG(uninitialized_zval);
20870 	}
20871 
20872 	/* Set the new yielded key */
20873 	if (IS_VAR != IS_UNUSED) {
20874 		zend_free_op free_op2;
20875 		zval *key = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
20876 
20877 		/* Consts, temporary variables and references need copying */
20878 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
20879 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
20880 		) {
20881 			zval *copy;
20882 
20883 			ALLOC_ZVAL(copy);
20884 			INIT_PZVAL_COPY(copy, key);
20885 
20886 			/* Temporary variables don't need ctor copying */
20887 			if (!0) {
20888 				zval_copy_ctor(copy);
20889 			}
20890 
20891 			generator->key = copy;
20892 		} else {
20893 			Z_ADDREF_P(key);
20894 			generator->key = key;
20895 		}
20896 
20897 		if (Z_TYPE_P(generator->key) == IS_LONG
20898 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
20899 		) {
20900 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
20901 		}
20902 
20903 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
20904 	} else {
20905 		/* If no key was specified we use auto-increment keys */
20906 		generator->largest_used_integer_key++;
20907 
20908 		ALLOC_INIT_ZVAL(generator->key);
20909 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
20910 	}
20911 
20912 	if (RETURN_VALUE_USED(opline)) {
20913 		/* If the return value of yield is used set the send
20914 		 * target and initialize it to NULL */
20915 		generator->send_target = &EX_T(opline->result.var).var.ptr;
20916 		Z_ADDREF(EG(uninitialized_zval));
20917 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
20918 	} else {
20919 		generator->send_target = NULL;
20920 	}
20921 
20922 	/* We increment to the next op, so we are at the correct position when the
20923 	 * generator is resumed. */
20924 	ZEND_VM_INC_OPCODE();
20925 
20926 	/* The GOTO VM uses a local opline variable. We need to set the opline
20927 	 * variable in execute_data so we don't resume at an old position. */
20928 	SAVE_OPLINE();
20929 
20930 	ZEND_VM_RETURN();
20931 }
20932 
zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)20933 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
20934 {
20935 	USE_OPLINE
20936 	zend_free_op free_op1, free_op_data1;
20937 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
20938 	zval *object;
20939 	zval *property = NULL;
20940 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
20941 	int have_get_ptr = 0;
20942 
20943 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
20944 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
20945 	}
20946 
20947 	make_real_object(object_ptr TSRMLS_CC);
20948 	object = *object_ptr;
20949 
20950 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
20951 		zend_error(E_WARNING, "Attempt to assign property of non-object");
20952 
20953 		FREE_OP(free_op_data1);
20954 
20955 		if (RETURN_VALUE_USED(opline)) {
20956 			PZVAL_LOCK(&EG(uninitialized_zval));
20957 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
20958 			EX_T(opline->result.var).var.ptr_ptr = NULL;
20959 		}
20960 	} else {
20961 		/* here we are sure we are dealing with an object */
20962 		if (0) {
20963 			MAKE_REAL_ZVAL_PTR(property);
20964 		}
20965 
20966 		/* here property is a string */
20967 		if (opline->extended_value == ZEND_ASSIGN_OBJ
20968 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
20969 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20970 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
20971 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
20972 
20973 				have_get_ptr = 1;
20974 				binary_op(*zptr, *zptr, value TSRMLS_CC);
20975 				if (RETURN_VALUE_USED(opline)) {
20976 					PZVAL_LOCK(*zptr);
20977 					EX_T(opline->result.var).var.ptr = *zptr;
20978 					EX_T(opline->result.var).var.ptr_ptr = NULL;
20979 				}
20980 			}
20981 		}
20982 
20983 		if (!have_get_ptr) {
20984 			zval *z = NULL;
20985 
20986 			Z_ADDREF_P(object);
20987 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
20988 				if (Z_OBJ_HT_P(object)->read_property) {
20989 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
20990 				}
20991 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
20992 				if (Z_OBJ_HT_P(object)->read_dimension) {
20993 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
20994 				}
20995 			}
20996 			if (z) {
20997 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
20998 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
20999 
21000 					if (Z_REFCOUNT_P(z) == 0) {
21001 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
21002 						zval_dtor(z);
21003 						FREE_ZVAL(z);
21004 					}
21005 					z = value;
21006 				}
21007 				Z_ADDREF_P(z);
21008 				SEPARATE_ZVAL_IF_NOT_REF(&z);
21009 				binary_op(z, z, value TSRMLS_CC);
21010 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
21011 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21012 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
21013 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
21014 				}
21015 				if (RETURN_VALUE_USED(opline)) {
21016 					PZVAL_LOCK(z);
21017 					EX_T(opline->result.var).var.ptr = z;
21018 					EX_T(opline->result.var).var.ptr_ptr = NULL;
21019 				}
21020 				zval_ptr_dtor(&z);
21021 			} else {
21022 				zend_error(E_WARNING, "Attempt to assign property of non-object");
21023 				if (RETURN_VALUE_USED(opline)) {
21024 					PZVAL_LOCK(&EG(uninitialized_zval));
21025 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
21026 					EX_T(opline->result.var).var.ptr_ptr = NULL;
21027 				}
21028 			}
21029 			zval_ptr_dtor(&object);
21030 		}
21031 
21032 		if (0) {
21033 			zval_ptr_dtor(&property);
21034 		} else {
21035 
21036 		}
21037 		FREE_OP(free_op_data1);
21038 	}
21039 
21040 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21041 	/* assign_obj has two opcodes! */
21042 	CHECK_EXCEPTION();
21043 	ZEND_VM_INC_OPCODE();
21044 	ZEND_VM_NEXT_OPCODE();
21045 }
21046 
zend_binary_assign_op_helper_SPEC_VAR_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)21047 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
21048 {
21049 	USE_OPLINE
21050 	zend_free_op free_op1, free_op_data2, free_op_data1;
21051 	zval **var_ptr;
21052 	zval *value;
21053 
21054 	SAVE_OPLINE();
21055 	switch (opline->extended_value) {
21056 		case ZEND_ASSIGN_OBJ:
21057 			return zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21058 			break;
21059 		case ZEND_ASSIGN_DIM: {
21060 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21061 
21062 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
21063 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21064 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
21065 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
21066 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
21067 					}
21068 					return zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21069 				} else {
21070 					zval *dim = NULL;
21071 
21072 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
21073 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
21074 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
21075 				}
21076 			}
21077 			break;
21078 		default:
21079 			value = NULL;
21080 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21081 			/* do nothing */
21082 			break;
21083 	}
21084 
21085 	if (UNEXPECTED(var_ptr == NULL)) {
21086 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
21087 	}
21088 
21089 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
21090 		if (RETURN_VALUE_USED(opline)) {
21091 			PZVAL_LOCK(&EG(uninitialized_zval));
21092 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
21093 		}
21094 
21095 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21096 		CHECK_EXCEPTION();
21097 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
21098 			ZEND_VM_INC_OPCODE();
21099 		}
21100 		ZEND_VM_NEXT_OPCODE();
21101 	}
21102 
21103 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
21104 
21105 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
21106 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
21107 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
21108 		/* proxy object */
21109 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
21110 		Z_ADDREF_P(objval);
21111 		binary_op(objval, objval, value TSRMLS_CC);
21112 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
21113 		zval_ptr_dtor(&objval);
21114 	} else {
21115 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
21116 	}
21117 
21118 	if (RETURN_VALUE_USED(opline)) {
21119 		PZVAL_LOCK(*var_ptr);
21120 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
21121 	}
21122 
21123 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
21124 		FREE_OP(free_op_data1);
21125 		FREE_OP_VAR_PTR(free_op_data2);
21126 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21127 		CHECK_EXCEPTION();
21128 		ZEND_VM_INC_OPCODE();
21129 	} else {
21130 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21131 		CHECK_EXCEPTION();
21132 	}
21133 	ZEND_VM_NEXT_OPCODE();
21134 }
21135 
ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21136 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21137 {
21138 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21139 }
21140 
ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21141 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21142 {
21143 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21144 }
21145 
ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21146 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21147 {
21148 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21149 }
21150 
ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21151 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21152 {
21153 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21154 }
21155 
ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21156 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21157 {
21158 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21159 }
21160 
ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21161 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21162 {
21163 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21164 }
21165 
ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21166 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21167 {
21168 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21169 }
21170 
ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21171 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21172 {
21173 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21174 }
21175 
ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21176 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21177 {
21178 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21179 }
21180 
ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21181 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21182 {
21183 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21184 }
21185 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21186 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21187 {
21188 	return zend_binary_assign_op_helper_SPEC_VAR_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21189 }
21190 
zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)21191 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
21192 {
21193 	USE_OPLINE
21194 	zend_free_op free_op1;
21195 	zval *varname;
21196 	zval **retval;
21197 	zval tmp_varname;
21198 	HashTable *target_symbol_table;
21199 	ulong hash_value;
21200 
21201 	SAVE_OPLINE();
21202 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21203 
21204  	if (IS_VAR != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
21205 		ZVAL_COPY_VALUE(&tmp_varname, varname);
21206 		zval_copy_ctor(&tmp_varname);
21207 		Z_SET_REFCOUNT(tmp_varname, 1);
21208 		Z_UNSET_ISREF(tmp_varname);
21209 		convert_to_string(&tmp_varname);
21210 		varname = &tmp_varname;
21211 	}
21212 
21213 	if (IS_UNUSED != IS_UNUSED) {
21214 		zend_class_entry *ce;
21215 
21216 		if (IS_UNUSED == IS_CONST) {
21217 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
21218 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
21219 			} else {
21220 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
21221 				if (UNEXPECTED(ce == NULL)) {
21222 					if (IS_VAR != IS_CONST && varname == &tmp_varname) {
21223 						zval_dtor(&tmp_varname);
21224 					}
21225 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21226 					CHECK_EXCEPTION();
21227 					ZEND_VM_NEXT_OPCODE();
21228 				}
21229 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
21230 			}
21231 		} else {
21232 			ce = EX_T(opline->op2.var).class_entry;
21233 		}
21234 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
21235 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21236 	} else {
21237 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
21238 /*
21239 		if (!target_symbol_table) {
21240 			CHECK_EXCEPTION();
21241 			ZEND_VM_NEXT_OPCODE();
21242 		}
21243 */
21244 		if (IS_VAR == IS_CONST) {
21245 			hash_value = Z_HASH_P(varname);
21246 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
21247 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
21248 		} else {
21249 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
21250 		}
21251 
21252 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
21253 			switch (type) {
21254 				case BP_VAR_R:
21255 				case BP_VAR_UNSET:
21256 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
21257 					/* break missing intentionally */
21258 				case BP_VAR_IS:
21259 					retval = &EG(uninitialized_zval_ptr);
21260 					break;
21261 				case BP_VAR_RW:
21262 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
21263 					/* break missing intentionally */
21264 				case BP_VAR_W:
21265 					Z_ADDREF_P(&EG(uninitialized_zval));
21266 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
21267 					break;
21268 				EMPTY_SWITCH_DEFAULT_CASE()
21269 			}
21270 		}
21271 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
21272 			case ZEND_FETCH_GLOBAL:
21273 				if (IS_VAR != IS_TMP_VAR) {
21274 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21275 				}
21276 				break;
21277 			case ZEND_FETCH_LOCAL:
21278 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21279 				break;
21280 			case ZEND_FETCH_STATIC:
21281 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
21282 				break;
21283 			case ZEND_FETCH_GLOBAL_LOCK:
21284 				if (IS_VAR == IS_VAR && !free_op1.var) {
21285 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
21286 				}
21287 				break;
21288 		}
21289 	}
21290 
21291 
21292 	if (IS_VAR != IS_CONST && varname == &tmp_varname) {
21293 		zval_dtor(&tmp_varname);
21294 	}
21295 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
21296 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
21297 	}
21298 	PZVAL_LOCK(*retval);
21299 	switch (type) {
21300 		case BP_VAR_R:
21301 		case BP_VAR_IS:
21302 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
21303 			break;
21304 		case BP_VAR_UNSET: {
21305 			zend_free_op free_res;
21306 
21307 			PZVAL_UNLOCK(*retval, &free_res);
21308 			if (retval != &EG(uninitialized_zval_ptr)) {
21309 				SEPARATE_ZVAL_IF_NOT_REF(retval);
21310 			}
21311 			PZVAL_LOCK(*retval);
21312 			FREE_OP_VAR_PTR(free_res);
21313 		}
21314 		/* break missing intentionally */
21315 		default:
21316 			EX_T(opline->result.var).var.ptr_ptr = retval;
21317 			break;
21318 	}
21319 	CHECK_EXCEPTION();
21320 	ZEND_VM_NEXT_OPCODE();
21321 }
21322 
ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21323 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21324 {
21325 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21326 }
21327 
ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21328 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21329 {
21330 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21331 }
21332 
ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21333 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21334 {
21335 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21336 }
21337 
ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21338 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21339 {
21340 	USE_OPLINE
21341 
21342 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21343 }
21344 
ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21345 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21346 {
21347 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21348 }
21349 
ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21350 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21351 {
21352 	return zend_fetch_var_address_helper_SPEC_VAR_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21353 }
21354 
ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21355 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21356 {
21357 	USE_OPLINE
21358 	zend_free_op free_op1;
21359 	zval **container;
21360 
21361 	SAVE_OPLINE();
21362 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21363 
21364 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
21365 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21366 	}
21367 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
21368 
21369 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
21370 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
21371 	}
21372 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21373 
21374 	/* We are going to assign the result by reference */
21375 	if (UNEXPECTED(opline->extended_value != 0)) {
21376 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
21377 
21378 		if (retval_ptr) {
21379 			Z_DELREF_PP(retval_ptr);
21380 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
21381 			Z_ADDREF_PP(retval_ptr);
21382 		}
21383 	}
21384 
21385 	CHECK_EXCEPTION();
21386 	ZEND_VM_NEXT_OPCODE();
21387 }
21388 
ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21389 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21390 {
21391 	USE_OPLINE
21392 	zend_free_op free_op1;
21393 	zval **container;
21394 
21395 	SAVE_OPLINE();
21396 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21397 
21398 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
21399 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21400 	}
21401 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
21402 
21403 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
21404 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
21405 	}
21406 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21407 	CHECK_EXCEPTION();
21408 	ZEND_VM_NEXT_OPCODE();
21409 }
21410 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21411 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21412 {
21413 	USE_OPLINE
21414 	zend_free_op free_op1;
21415 
21416 	SAVE_OPLINE();
21417 
21418 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
21419 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21420 
21421 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
21422 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21423 		}
21424 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
21425 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
21426 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
21427 		}
21428 
21429 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21430 	} else {
21431 		zval *container;
21432 
21433 		if (IS_UNUSED == IS_UNUSED) {
21434 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
21435 		}
21436 		container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21437 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_R TSRMLS_CC);
21438 
21439 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21440 	}
21441 	CHECK_EXCEPTION();
21442 	ZEND_VM_NEXT_OPCODE();
21443 }
21444 
ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21445 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21446 {
21447 	USE_OPLINE
21448 	zend_free_op free_op1;
21449 	zval **object_ptr;
21450 
21451 	SAVE_OPLINE();
21452 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21453 
21454 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
21455 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
21456 	}
21457 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
21458 
21459 		zval *property_name = NULL;
21460 
21461 		if (0) {
21462 			MAKE_REAL_ZVAL_PTR(property_name);
21463 		}
21464 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
21465 		if (0) {
21466 			zval_ptr_dtor(&property_name);
21467 		} else {
21468 
21469 		}
21470 	} else {
21471 		zend_free_op free_op_data1, free_op_data2;
21472 		zval *value;
21473 		zval *dim = NULL;
21474 		zval **variable_ptr_ptr;
21475 
21476 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_UNUSED, BP_VAR_W TSRMLS_CC);
21477 
21478 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
21479 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
21480 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
21481 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
21482 				if (RETURN_VALUE_USED(opline)) {
21483 					zval *retval;
21484 
21485 					ALLOC_ZVAL(retval);
21486 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
21487 					INIT_PZVAL(retval);
21488 					AI_SET_PTR(&EX_T(opline->result.var), retval);
21489 				}
21490 			} else if (RETURN_VALUE_USED(opline)) {
21491 				PZVAL_LOCK(&EG(uninitialized_zval));
21492 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
21493 			}
21494 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
21495 			if (IS_TMP_FREE(free_op_data1)) {
21496 				zval_dtor(value);
21497 			}
21498 			if (RETURN_VALUE_USED(opline)) {
21499 				PZVAL_LOCK(&EG(uninitialized_zval));
21500 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
21501 			}
21502 		} else {
21503 			if ((opline+1)->op1_type == IS_TMP_VAR) {
21504 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
21505 			} else if ((opline+1)->op1_type == IS_CONST) {
21506 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
21507 			} else {
21508 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
21509 			}
21510 			if (RETURN_VALUE_USED(opline)) {
21511 				PZVAL_LOCK(value);
21512 				AI_SET_PTR(&EX_T(opline->result.var), value);
21513 			}
21514 		}
21515 		FREE_OP_VAR_PTR(free_op_data2);
21516 	 	FREE_OP_IF_VAR(free_op_data1);
21517 	}
21518  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21519 	/* assign_dim has two opcodes! */
21520 	CHECK_EXCEPTION();
21521 	ZEND_VM_INC_OPCODE();
21522 	ZEND_VM_NEXT_OPCODE();
21523 }
21524 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21525 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21526 {
21527 	USE_OPLINE
21528 	zval *function_name;
21529 	zend_class_entry *ce;
21530 	call_slot *call = EX(call_slots) + opline->result.num;
21531 
21532 	SAVE_OPLINE();
21533 
21534 	if (IS_VAR == IS_CONST) {
21535 		/* no function found. try a static method in class */
21536 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
21537 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
21538 		} else {
21539 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
21540 			if (UNEXPECTED(EG(exception) != NULL)) {
21541 				HANDLE_EXCEPTION();
21542 			}
21543 			if (UNEXPECTED(ce == NULL)) {
21544 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
21545 			}
21546 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
21547 		}
21548 		call->called_scope = ce;
21549 	} else {
21550 		ce = EX_T(opline->op1.var).class_entry;
21551 
21552 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
21553 			call->called_scope = EG(called_scope);
21554 		} else {
21555 			call->called_scope = ce;
21556 		}
21557 	}
21558 
21559 	if (IS_VAR == IS_CONST &&
21560 	    IS_UNUSED == IS_CONST &&
21561 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
21562 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
21563 	} else if (IS_VAR != IS_CONST &&
21564 	           IS_UNUSED == IS_CONST &&
21565 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
21566 		/* do nothing */
21567 	} else if (IS_UNUSED != IS_UNUSED) {
21568 		char *function_name_strval = NULL;
21569 		int function_name_strlen = 0;
21570 
21571 
21572 		if (IS_UNUSED == IS_CONST) {
21573 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
21574 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
21575 		} else {
21576 			function_name = NULL;
21577 
21578 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
21579 				if (UNEXPECTED(EG(exception) != NULL)) {
21580 					HANDLE_EXCEPTION();
21581 				}
21582 				zend_error_noreturn(E_ERROR, "Function name must be a string");
21583 			} else {
21584 				function_name_strval = Z_STRVAL_P(function_name);
21585 				function_name_strlen = Z_STRLEN_P(function_name);
21586  			}
21587 		}
21588 
21589 		if (function_name_strval) {
21590 			if (ce->get_static_method) {
21591 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
21592 			} else {
21593 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_UNUSED == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
21594 			}
21595 			if (UNEXPECTED(call->fbc == NULL)) {
21596 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
21597 			}
21598 			if (IS_UNUSED == IS_CONST &&
21599 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
21600 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
21601 				if (IS_VAR == IS_CONST) {
21602 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
21603 				} else {
21604 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
21605 				}
21606 			}
21607 		}
21608 		if (IS_UNUSED != IS_CONST) {
21609 
21610 		}
21611 	} else {
21612 		if (UNEXPECTED(ce->constructor == NULL)) {
21613 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
21614 		}
21615 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
21616 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
21617 		}
21618 		call->fbc = ce->constructor;
21619 	}
21620 
21621 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
21622 		call->object = NULL;
21623 	} else {
21624 		if (EG(This) &&
21625 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
21626 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
21627 		    /* We are calling method of the other (incompatible) class,
21628 		       but passing $this. This is done for compatibility with php-4. */
21629 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
21630 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
21631 			} else {
21632 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
21633 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
21634 			}
21635 		}
21636 		if ((call->object = EG(This))) {
21637 			Z_ADDREF_P(call->object);
21638 			call->called_scope = Z_OBJCE_P(call->object);
21639 		}
21640 	}
21641 	call->is_ctor_call = 0;
21642 	EX(call) = call;
21643 
21644 	CHECK_EXCEPTION();
21645 	ZEND_VM_NEXT_OPCODE();
21646 }
21647 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21648 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21649 {
21650 	USE_OPLINE
21651 	zend_free_op free_op1;
21652 	zval *expr_ptr;
21653 
21654 	SAVE_OPLINE();
21655 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
21656 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21657 
21658 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
21659 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
21660 		}
21661 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
21662 		expr_ptr = *expr_ptr_ptr;
21663 		Z_ADDREF_P(expr_ptr);
21664 	} else {
21665 		expr_ptr=_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21666 		if (0) { /* temporary variable */
21667 			zval *new_expr;
21668 
21669 			ALLOC_ZVAL(new_expr);
21670 			INIT_PZVAL_COPY(new_expr, expr_ptr);
21671 			expr_ptr = new_expr;
21672 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
21673 			zval *new_expr;
21674 
21675 			ALLOC_ZVAL(new_expr);
21676 			INIT_PZVAL_COPY(new_expr, expr_ptr);
21677 			expr_ptr = new_expr;
21678 			zendi_zval_copy_ctor(*expr_ptr);
21679 		} else {
21680 			Z_ADDREF_P(expr_ptr);
21681 		}
21682 	}
21683 
21684 	if (IS_UNUSED != IS_UNUSED) {
21685 
21686 		zval *offset = NULL;
21687 		ulong hval;
21688 
21689 		switch (Z_TYPE_P(offset)) {
21690 			case IS_DOUBLE:
21691 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
21692 				goto num_index;
21693 			case IS_LONG:
21694 			case IS_BOOL:
21695 				hval = Z_LVAL_P(offset);
21696 num_index:
21697 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
21698 				break;
21699 			case IS_STRING:
21700 				if (IS_UNUSED == IS_CONST) {
21701 					hval = Z_HASH_P(offset);
21702 				} else {
21703 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
21704 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
21705 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
21706 					} else {
21707 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
21708 					}
21709 				}
21710 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
21711 				break;
21712 			case IS_NULL:
21713 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
21714 				break;
21715 			default:
21716 				zend_error(E_WARNING, "Illegal offset type");
21717 				zval_ptr_dtor(&expr_ptr);
21718 				/* do nothing */
21719 				break;
21720 		}
21721 
21722 	} else {
21723 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
21724 	}
21725 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
21726 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21727 	} else {
21728 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21729 	}
21730 	CHECK_EXCEPTION();
21731 	ZEND_VM_NEXT_OPCODE();
21732 }
21733 
ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21734 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21735 {
21736 	USE_OPLINE
21737 
21738 	array_init(&EX_T(opline->result.var).tmp_var);
21739 	if (IS_VAR == IS_UNUSED) {
21740 		ZEND_VM_NEXT_OPCODE();
21741 #if 0 || IS_VAR != IS_UNUSED
21742 	} else {
21743 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
21744 #endif
21745 	}
21746 }
21747 
ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21748 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21749 {
21750 	USE_OPLINE
21751 	zval tmp, *varname;
21752 	HashTable *target_symbol_table;
21753 	zend_free_op free_op1;
21754 
21755 	SAVE_OPLINE();
21756 	if (IS_VAR == IS_CV &&
21757 	    IS_UNUSED == IS_UNUSED &&
21758 	    (opline->extended_value & ZEND_QUICK_SET)) {
21759 		if (EG(active_symbol_table)) {
21760 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
21761 
21762 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
21763 			EX_CV(opline->op1.var) = NULL;
21764 		} else if (EX_CV(opline->op1.var)) {
21765 			zval_ptr_dtor(EX_CV(opline->op1.var));
21766 			EX_CV(opline->op1.var) = NULL;
21767 		}
21768 		CHECK_EXCEPTION();
21769 		ZEND_VM_NEXT_OPCODE();
21770 	}
21771 
21772 	varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21773 
21774 	if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
21775 		ZVAL_COPY_VALUE(&tmp, varname);
21776 		zval_copy_ctor(&tmp);
21777 		convert_to_string(&tmp);
21778 		varname = &tmp;
21779 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
21780 		Z_ADDREF_P(varname);
21781 	}
21782 
21783 	if (IS_UNUSED != IS_UNUSED) {
21784 		zend_class_entry *ce;
21785 
21786 		if (IS_UNUSED == IS_CONST) {
21787 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
21788 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
21789 			} else {
21790 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
21791 				if (UNEXPECTED(EG(exception) != NULL)) {
21792 					if (IS_VAR != IS_CONST && varname == &tmp) {
21793 						zval_dtor(&tmp);
21794 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
21795 						zval_ptr_dtor(&varname);
21796 					}
21797 					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21798 					HANDLE_EXCEPTION();
21799 				}
21800 				if (UNEXPECTED(ce == NULL)) {
21801 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
21802 				}
21803 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
21804 			}
21805 		} else {
21806 			ce = EX_T(opline->op2.var).class_entry;
21807 		}
21808 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
21809 	} else {
21810 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
21811 
21812 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
21813 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
21814 	}
21815 
21816 	if (IS_VAR != IS_CONST && varname == &tmp) {
21817 		zval_dtor(&tmp);
21818 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
21819 		zval_ptr_dtor(&varname);
21820 	}
21821 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21822 	CHECK_EXCEPTION();
21823 	ZEND_VM_NEXT_OPCODE();
21824 }
21825 
ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21826 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21827 {
21828 	USE_OPLINE
21829 	zval **value;
21830 	zend_bool isset = 1;
21831 
21832 	SAVE_OPLINE();
21833 	if (IS_VAR == IS_CV &&
21834 	    IS_UNUSED == IS_UNUSED &&
21835 	    (opline->extended_value & ZEND_QUICK_SET)) {
21836 		if (EX_CV(opline->op1.var)) {
21837 			value = EX_CV(opline->op1.var);
21838 		} else if (EG(active_symbol_table)) {
21839 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
21840 
21841 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
21842 				isset = 0;
21843 			}
21844 		} else {
21845 			isset = 0;
21846 		}
21847 	} else {
21848 		HashTable *target_symbol_table;
21849 		zend_free_op free_op1;
21850 		zval tmp, *varname = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21851 
21852 		if (IS_VAR != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
21853 			ZVAL_COPY_VALUE(&tmp, varname);
21854 			zval_copy_ctor(&tmp);
21855 			convert_to_string(&tmp);
21856 			varname = &tmp;
21857 		}
21858 
21859 		if (IS_UNUSED != IS_UNUSED) {
21860 			zend_class_entry *ce;
21861 
21862 			if (IS_UNUSED == IS_CONST) {
21863 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
21864 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
21865 				} else {
21866 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
21867 					if (UNEXPECTED(ce == NULL)) {
21868 						CHECK_EXCEPTION();
21869 						ZEND_VM_NEXT_OPCODE();
21870 					}
21871 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
21872 				}
21873 			} else {
21874 				ce = EX_T(opline->op2.var).class_entry;
21875 			}
21876 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_VAR == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
21877 			if (!value) {
21878 				isset = 0;
21879 			}
21880 		} else {
21881 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
21882 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
21883 				isset = 0;
21884 			}
21885 		}
21886 
21887 		if (IS_VAR != IS_CONST && varname == &tmp) {
21888 			zval_dtor(&tmp);
21889 		}
21890 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21891 	}
21892 
21893 	if (opline->extended_value & ZEND_ISSET) {
21894 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
21895 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
21896 		} else {
21897 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
21898 		}
21899 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
21900 		if (!isset || !i_zend_is_true(*value)) {
21901 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
21902 		} else {
21903 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
21904 		}
21905 	}
21906 
21907 	CHECK_EXCEPTION();
21908 	ZEND_VM_NEXT_OPCODE();
21909 }
21910 
ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21911 static int ZEND_FASTCALL  ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21912 {
21913 	USE_OPLINE
21914 	zval *var_ptr, *new_zv;
21915 
21916 	SAVE_OPLINE();
21917 	var_ptr = EX_T(opline->op1.var).var.ptr;
21918 	if (Z_TYPE_P(var_ptr) != IS_OBJECT &&
21919 			!PZVAL_IS_REF(var_ptr) &&
21920 			Z_REFCOUNT_P(var_ptr) > 1) {
21921 
21922 		Z_DELREF_P(var_ptr);
21923 		ALLOC_ZVAL(new_zv);
21924 		INIT_PZVAL_COPY(new_zv, var_ptr);
21925 		var_ptr = new_zv;
21926 		zval_copy_ctor(var_ptr);
21927 		EX_T(opline->op1.var).var.ptr = var_ptr;
21928 	}
21929 	ZEND_VM_NEXT_OPCODE();
21930 }
21931 
ZEND_YIELD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)21932 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
21933 {
21934 	USE_OPLINE
21935 
21936 	/* The generator object is stored in return_value_ptr_ptr */
21937 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
21938 
21939 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
21940 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
21941 	}
21942 
21943 	/* Destroy the previously yielded value */
21944 	if (generator->value) {
21945 		zval_ptr_dtor(&generator->value);
21946 	}
21947 
21948 	/* Destroy the previously yielded key */
21949 	if (generator->key) {
21950 		zval_ptr_dtor(&generator->key);
21951 	}
21952 
21953 	/* Set the new yielded value */
21954 	if (IS_VAR != IS_UNUSED) {
21955 		zend_free_op free_op1;
21956 
21957 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
21958 			/* Constants and temporary variables aren't yieldable by reference,
21959 			 * but we still allow them with a notice. */
21960 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
21961 				zval *value, *copy;
21962 
21963 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
21964 
21965 				value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21966 				ALLOC_ZVAL(copy);
21967 				INIT_PZVAL_COPY(copy, value);
21968 
21969 				/* Temporary variables don't need ctor copying */
21970 				if (!0) {
21971 					zval_copy_ctor(copy);
21972 				}
21973 
21974 				generator->value = copy;
21975 			} else {
21976 				zval **value_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
21977 
21978 				if (IS_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
21979 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
21980 				}
21981 
21982 				/* If a function call result is yielded and the function did
21983 				 * not return by reference we throw a notice. */
21984 				if (IS_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
21985 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
21986 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
21987 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
21988 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
21989 
21990 					Z_ADDREF_PP(value_ptr);
21991 					generator->value = *value_ptr;
21992 				} else {
21993 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
21994 					Z_ADDREF_PP(value_ptr);
21995 					generator->value = *value_ptr;
21996 				}
21997 
21998 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
21999 			}
22000 		} else {
22001 			zval *value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22002 
22003 			/* Consts, temporary variables and references need copying */
22004 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
22005 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
22006 			) {
22007 				zval *copy;
22008 
22009 				ALLOC_ZVAL(copy);
22010 				INIT_PZVAL_COPY(copy, value);
22011 
22012 				/* Temporary variables don't need ctor copying */
22013 				if (!0) {
22014 					zval_copy_ctor(copy);
22015 				}
22016 
22017 				generator->value = copy;
22018 			} else {
22019 				Z_ADDREF_P(value);
22020 				generator->value = value;
22021 			}
22022 
22023 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22024 		}
22025 	} else {
22026 		/* If no value was specified yield null */
22027 		Z_ADDREF(EG(uninitialized_zval));
22028 		generator->value = &EG(uninitialized_zval);
22029 	}
22030 
22031 	/* Set the new yielded key */
22032 	if (IS_UNUSED != IS_UNUSED) {
22033 
22034 		zval *key = NULL;
22035 
22036 		/* Consts, temporary variables and references need copying */
22037 		if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
22038 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
22039 		) {
22040 			zval *copy;
22041 
22042 			ALLOC_ZVAL(copy);
22043 			INIT_PZVAL_COPY(copy, key);
22044 
22045 			/* Temporary variables don't need ctor copying */
22046 			if (!0) {
22047 				zval_copy_ctor(copy);
22048 			}
22049 
22050 			generator->key = copy;
22051 		} else {
22052 			Z_ADDREF_P(key);
22053 			generator->key = key;
22054 		}
22055 
22056 		if (Z_TYPE_P(generator->key) == IS_LONG
22057 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
22058 		) {
22059 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
22060 		}
22061 
22062 	} else {
22063 		/* If no key was specified we use auto-increment keys */
22064 		generator->largest_used_integer_key++;
22065 
22066 		ALLOC_INIT_ZVAL(generator->key);
22067 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
22068 	}
22069 
22070 	if (RETURN_VALUE_USED(opline)) {
22071 		/* If the return value of yield is used set the send
22072 		 * target and initialize it to NULL */
22073 		generator->send_target = &EX_T(opline->result.var).var.ptr;
22074 		Z_ADDREF(EG(uninitialized_zval));
22075 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
22076 	} else {
22077 		generator->send_target = NULL;
22078 	}
22079 
22080 	/* We increment to the next op, so we are at the correct position when the
22081 	 * generator is resumed. */
22082 	ZEND_VM_INC_OPCODE();
22083 
22084 	/* The GOTO VM uses a local opline variable. We need to set the opline
22085 	 * variable in execute_data so we don't resume at an old position. */
22086 	SAVE_OPLINE();
22087 
22088 	ZEND_VM_RETURN();
22089 }
22090 
ZEND_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22091 static int ZEND_FASTCALL  ZEND_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22092 {
22093 	USE_OPLINE
22094 	zend_free_op free_op1;
22095 
22096 	SAVE_OPLINE();
22097 	fast_add_function(&EX_T(opline->result.var).tmp_var,
22098 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22099 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22100 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22101 
22102 	CHECK_EXCEPTION();
22103 	ZEND_VM_NEXT_OPCODE();
22104 }
22105 
ZEND_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22106 static int ZEND_FASTCALL  ZEND_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22107 {
22108 	USE_OPLINE
22109 	zend_free_op free_op1;
22110 
22111 	SAVE_OPLINE();
22112 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
22113 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22114 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22115 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22116 
22117 	CHECK_EXCEPTION();
22118 	ZEND_VM_NEXT_OPCODE();
22119 }
22120 
ZEND_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22121 static int ZEND_FASTCALL  ZEND_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22122 {
22123 	USE_OPLINE
22124 	zend_free_op free_op1;
22125 
22126 	SAVE_OPLINE();
22127 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
22128 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22129 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22130 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22131 
22132 	CHECK_EXCEPTION();
22133 	ZEND_VM_NEXT_OPCODE();
22134 }
22135 
ZEND_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22136 static int ZEND_FASTCALL  ZEND_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22137 {
22138 	USE_OPLINE
22139 	zend_free_op free_op1;
22140 
22141 	SAVE_OPLINE();
22142 	fast_div_function(&EX_T(opline->result.var).tmp_var,
22143 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22144 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22145 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22146 
22147 	CHECK_EXCEPTION();
22148 	ZEND_VM_NEXT_OPCODE();
22149 }
22150 
ZEND_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22151 static int ZEND_FASTCALL  ZEND_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22152 {
22153 	USE_OPLINE
22154 	zend_free_op free_op1;
22155 
22156 	SAVE_OPLINE();
22157 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
22158 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22159 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22160 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22161 
22162 	CHECK_EXCEPTION();
22163 	ZEND_VM_NEXT_OPCODE();
22164 }
22165 
ZEND_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22166 static int ZEND_FASTCALL  ZEND_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22167 {
22168 	USE_OPLINE
22169 	zend_free_op free_op1;
22170 
22171 	SAVE_OPLINE();
22172 	shift_left_function(&EX_T(opline->result.var).tmp_var,
22173 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22174 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22175 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22176 
22177 	CHECK_EXCEPTION();
22178 	ZEND_VM_NEXT_OPCODE();
22179 }
22180 
ZEND_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22181 static int ZEND_FASTCALL  ZEND_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22182 {
22183 	USE_OPLINE
22184 	zend_free_op free_op1;
22185 
22186 	SAVE_OPLINE();
22187 	shift_right_function(&EX_T(opline->result.var).tmp_var,
22188 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22189 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22190 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22191 
22192 	CHECK_EXCEPTION();
22193 	ZEND_VM_NEXT_OPCODE();
22194 }
22195 
ZEND_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22196 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22197 {
22198 	USE_OPLINE
22199 	zend_free_op free_op1;
22200 
22201 	SAVE_OPLINE();
22202 	concat_function(&EX_T(opline->result.var).tmp_var,
22203 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22204 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22205 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22206 
22207 	CHECK_EXCEPTION();
22208 	ZEND_VM_NEXT_OPCODE();
22209 }
22210 
ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22211 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22212 {
22213 	USE_OPLINE
22214 	zend_free_op free_op1;
22215 
22216 	SAVE_OPLINE();
22217 	is_identical_function(&EX_T(opline->result.var).tmp_var,
22218 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22219 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22220 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22221 
22222 	CHECK_EXCEPTION();
22223 	ZEND_VM_NEXT_OPCODE();
22224 }
22225 
ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22226 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22227 {
22228 	USE_OPLINE
22229 	zend_free_op free_op1;
22230 	zval *result = &EX_T(opline->result.var).tmp_var;
22231 
22232 	SAVE_OPLINE();
22233 	is_identical_function(result,
22234 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22235 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22236 	Z_LVAL_P(result) = !Z_LVAL_P(result);
22237 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22238 
22239 	CHECK_EXCEPTION();
22240 	ZEND_VM_NEXT_OPCODE();
22241 }
22242 
ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22243 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22244 {
22245 	USE_OPLINE
22246 	zend_free_op free_op1;
22247 	zval *result = &EX_T(opline->result.var).tmp_var;
22248 
22249 	SAVE_OPLINE();
22250 	ZVAL_BOOL(result, fast_equal_function(result,
22251 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22252 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
22253 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22254 
22255 	CHECK_EXCEPTION();
22256 	ZEND_VM_NEXT_OPCODE();
22257 }
22258 
ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22259 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22260 {
22261 	USE_OPLINE
22262 	zend_free_op free_op1;
22263 	zval *result = &EX_T(opline->result.var).tmp_var;
22264 
22265 	SAVE_OPLINE();
22266 	ZVAL_BOOL(result, fast_not_equal_function(result,
22267 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22268 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
22269 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22270 
22271 	CHECK_EXCEPTION();
22272 	ZEND_VM_NEXT_OPCODE();
22273 }
22274 
ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22275 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22276 {
22277 	USE_OPLINE
22278 	zend_free_op free_op1;
22279 	zval *result = &EX_T(opline->result.var).tmp_var;
22280 
22281 	SAVE_OPLINE();
22282 	ZVAL_BOOL(result, fast_is_smaller_function(result,
22283 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22284 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
22285 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22286 
22287 	CHECK_EXCEPTION();
22288 	ZEND_VM_NEXT_OPCODE();
22289 }
22290 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22291 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22292 {
22293 	USE_OPLINE
22294 	zend_free_op free_op1;
22295 	zval *result = &EX_T(opline->result.var).tmp_var;
22296 
22297 	SAVE_OPLINE();
22298 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
22299 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22300 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
22301 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22302 
22303 	CHECK_EXCEPTION();
22304 	ZEND_VM_NEXT_OPCODE();
22305 }
22306 
ZEND_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22307 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22308 {
22309 	USE_OPLINE
22310 	zend_free_op free_op1;
22311 
22312 	SAVE_OPLINE();
22313 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
22314 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22315 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22316 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22317 
22318 	CHECK_EXCEPTION();
22319 	ZEND_VM_NEXT_OPCODE();
22320 }
22321 
ZEND_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22322 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22323 {
22324 	USE_OPLINE
22325 	zend_free_op free_op1;
22326 
22327 	SAVE_OPLINE();
22328 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
22329 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22330 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22331 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22332 
22333 	CHECK_EXCEPTION();
22334 	ZEND_VM_NEXT_OPCODE();
22335 }
22336 
ZEND_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22337 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22338 {
22339 	USE_OPLINE
22340 	zend_free_op free_op1;
22341 
22342 	SAVE_OPLINE();
22343 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
22344 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22345 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22346 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22347 
22348 	CHECK_EXCEPTION();
22349 	ZEND_VM_NEXT_OPCODE();
22350 }
22351 
ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22352 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22353 {
22354 	USE_OPLINE
22355 	zend_free_op free_op1;
22356 
22357 	SAVE_OPLINE();
22358 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
22359 		_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
22360 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
22361 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22362 
22363 	CHECK_EXCEPTION();
22364 	ZEND_VM_NEXT_OPCODE();
22365 }
22366 
zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)22367 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
22368 {
22369 	USE_OPLINE
22370 	zend_free_op free_op1, free_op_data1;
22371 	zval **object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22372 	zval *object;
22373 	zval *property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
22374 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
22375 	int have_get_ptr = 0;
22376 
22377 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
22378 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
22379 	}
22380 
22381 	make_real_object(object_ptr TSRMLS_CC);
22382 	object = *object_ptr;
22383 
22384 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
22385 		zend_error(E_WARNING, "Attempt to assign property of non-object");
22386 
22387 		FREE_OP(free_op_data1);
22388 
22389 		if (RETURN_VALUE_USED(opline)) {
22390 			PZVAL_LOCK(&EG(uninitialized_zval));
22391 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
22392 			EX_T(opline->result.var).var.ptr_ptr = NULL;
22393 		}
22394 	} else {
22395 		/* here we are sure we are dealing with an object */
22396 		if (0) {
22397 			MAKE_REAL_ZVAL_PTR(property);
22398 		}
22399 
22400 		/* here property is a string */
22401 		if (opline->extended_value == ZEND_ASSIGN_OBJ
22402 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
22403 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22404 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
22405 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
22406 
22407 				have_get_ptr = 1;
22408 				binary_op(*zptr, *zptr, value TSRMLS_CC);
22409 				if (RETURN_VALUE_USED(opline)) {
22410 					PZVAL_LOCK(*zptr);
22411 					EX_T(opline->result.var).var.ptr = *zptr;
22412 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22413 				}
22414 			}
22415 		}
22416 
22417 		if (!have_get_ptr) {
22418 			zval *z = NULL;
22419 
22420 			Z_ADDREF_P(object);
22421 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
22422 				if (Z_OBJ_HT_P(object)->read_property) {
22423 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22424 				}
22425 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
22426 				if (Z_OBJ_HT_P(object)->read_dimension) {
22427 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
22428 				}
22429 			}
22430 			if (z) {
22431 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
22432 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
22433 
22434 					if (Z_REFCOUNT_P(z) == 0) {
22435 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
22436 						zval_dtor(z);
22437 						FREE_ZVAL(z);
22438 					}
22439 					z = value;
22440 				}
22441 				Z_ADDREF_P(z);
22442 				SEPARATE_ZVAL_IF_NOT_REF(&z);
22443 				binary_op(z, z, value TSRMLS_CC);
22444 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
22445 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22446 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
22447 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
22448 				}
22449 				if (RETURN_VALUE_USED(opline)) {
22450 					PZVAL_LOCK(z);
22451 					EX_T(opline->result.var).var.ptr = z;
22452 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22453 				}
22454 				zval_ptr_dtor(&z);
22455 			} else {
22456 				zend_error(E_WARNING, "Attempt to assign property of non-object");
22457 				if (RETURN_VALUE_USED(opline)) {
22458 					PZVAL_LOCK(&EG(uninitialized_zval));
22459 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
22460 					EX_T(opline->result.var).var.ptr_ptr = NULL;
22461 				}
22462 			}
22463 			zval_ptr_dtor(&object);
22464 		}
22465 
22466 		if (0) {
22467 			zval_ptr_dtor(&property);
22468 		} else {
22469 
22470 		}
22471 		FREE_OP(free_op_data1);
22472 	}
22473 
22474 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22475 	/* assign_obj has two opcodes! */
22476 	CHECK_EXCEPTION();
22477 	ZEND_VM_INC_OPCODE();
22478 	ZEND_VM_NEXT_OPCODE();
22479 }
22480 
zend_binary_assign_op_helper_SPEC_VAR_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)22481 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_VAR_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
22482 {
22483 	USE_OPLINE
22484 	zend_free_op free_op1, free_op_data2, free_op_data1;
22485 	zval **var_ptr;
22486 	zval *value;
22487 
22488 	SAVE_OPLINE();
22489 	switch (opline->extended_value) {
22490 		case ZEND_ASSIGN_OBJ:
22491 			return zend_binary_assign_op_obj_helper_SPEC_VAR_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22492 			break;
22493 		case ZEND_ASSIGN_DIM: {
22494 				zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22495 
22496 				if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
22497 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22498 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
22499 					if (IS_VAR == IS_VAR && !(free_op1.var != NULL)) {
22500 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
22501 					}
22502 					return zend_binary_assign_op_obj_helper_SPEC_VAR_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22503 				} else {
22504 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
22505 
22506 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
22507 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
22508 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
22509 				}
22510 			}
22511 			break;
22512 		default:
22513 			value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
22514 			var_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22515 			/* do nothing */
22516 			break;
22517 	}
22518 
22519 	if (UNEXPECTED(var_ptr == NULL)) {
22520 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
22521 	}
22522 
22523 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
22524 		if (RETURN_VALUE_USED(opline)) {
22525 			PZVAL_LOCK(&EG(uninitialized_zval));
22526 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
22527 		}
22528 
22529 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22530 		CHECK_EXCEPTION();
22531 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
22532 			ZEND_VM_INC_OPCODE();
22533 		}
22534 		ZEND_VM_NEXT_OPCODE();
22535 	}
22536 
22537 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
22538 
22539 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
22540 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
22541 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
22542 		/* proxy object */
22543 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
22544 		Z_ADDREF_P(objval);
22545 		binary_op(objval, objval, value TSRMLS_CC);
22546 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
22547 		zval_ptr_dtor(&objval);
22548 	} else {
22549 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
22550 	}
22551 
22552 	if (RETURN_VALUE_USED(opline)) {
22553 		PZVAL_LOCK(*var_ptr);
22554 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
22555 	}
22556 
22557 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
22558 		FREE_OP(free_op_data1);
22559 		FREE_OP_VAR_PTR(free_op_data2);
22560 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22561 		CHECK_EXCEPTION();
22562 		ZEND_VM_INC_OPCODE();
22563 	} else {
22564 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22565 		CHECK_EXCEPTION();
22566 	}
22567 	ZEND_VM_NEXT_OPCODE();
22568 }
22569 
ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22570 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22571 {
22572 	return zend_binary_assign_op_helper_SPEC_VAR_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22573 }
22574 
ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22575 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22576 {
22577 	return zend_binary_assign_op_helper_SPEC_VAR_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22578 }
22579 
ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22580 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22581 {
22582 	return zend_binary_assign_op_helper_SPEC_VAR_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22583 }
22584 
ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22585 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22586 {
22587 	return zend_binary_assign_op_helper_SPEC_VAR_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22588 }
22589 
ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22590 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22591 {
22592 	return zend_binary_assign_op_helper_SPEC_VAR_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22593 }
22594 
ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22595 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22596 {
22597 	return zend_binary_assign_op_helper_SPEC_VAR_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22598 }
22599 
ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22600 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22601 {
22602 	return zend_binary_assign_op_helper_SPEC_VAR_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22603 }
22604 
ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22605 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22606 {
22607 	return zend_binary_assign_op_helper_SPEC_VAR_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22608 }
22609 
ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22610 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22611 {
22612 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22613 }
22614 
ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22615 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22616 {
22617 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22618 }
22619 
ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22620 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22621 {
22622 	return zend_binary_assign_op_helper_SPEC_VAR_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22623 }
22624 
zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)22625 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
22626 {
22627 	USE_OPLINE
22628 	zend_free_op free_op1;
22629 	zval **object_ptr;
22630 	zval *object;
22631 	zval *property;
22632 	zval **retval;
22633 	int have_get_ptr = 0;
22634 
22635 	SAVE_OPLINE();
22636 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22637 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
22638 	retval = &EX_T(opline->result.var).var.ptr;
22639 
22640 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
22641 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
22642 	}
22643 
22644 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
22645 	object = *object_ptr;
22646 
22647 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
22648 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
22649 
22650 		if (RETURN_VALUE_USED(opline)) {
22651 			PZVAL_LOCK(&EG(uninitialized_zval));
22652 			*retval = &EG(uninitialized_zval);
22653 		}
22654 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22655 		CHECK_EXCEPTION();
22656 		ZEND_VM_NEXT_OPCODE();
22657 	}
22658 
22659 	/* here we are sure we are dealing with an object */
22660 
22661 	if (0) {
22662 		MAKE_REAL_ZVAL_PTR(property);
22663 	}
22664 
22665 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
22666 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22667 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
22668 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
22669 
22670 			have_get_ptr = 1;
22671 			incdec_op(*zptr);
22672 			if (RETURN_VALUE_USED(opline)) {
22673 				*retval = *zptr;
22674 				PZVAL_LOCK(*retval);
22675 			}
22676 		}
22677 	}
22678 
22679 	if (!have_get_ptr) {
22680 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
22681 			zval *z;
22682 
22683 			Z_ADDREF_P(object);
22684 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22685 
22686 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
22687 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
22688 
22689 				if (Z_REFCOUNT_P(z) == 0) {
22690 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
22691 					zval_dtor(z);
22692 					FREE_ZVAL(z);
22693 				}
22694 				z = value;
22695 			}
22696 			Z_ADDREF_P(z);
22697 			SEPARATE_ZVAL_IF_NOT_REF(&z);
22698 			incdec_op(z);
22699 			*retval = z;
22700 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22701 			zval_ptr_dtor(&object);
22702 			SELECTIVE_PZVAL_LOCK(*retval, opline);
22703 			zval_ptr_dtor(&z);
22704 		} else {
22705 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
22706 			if (RETURN_VALUE_USED(opline)) {
22707 				PZVAL_LOCK(&EG(uninitialized_zval));
22708 				*retval = &EG(uninitialized_zval);
22709 			}
22710 		}
22711 	}
22712 
22713 	if (0) {
22714 		zval_ptr_dtor(&property);
22715 	} else {
22716 
22717 	}
22718 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22719 	CHECK_EXCEPTION();
22720 	ZEND_VM_NEXT_OPCODE();
22721 }
22722 
ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22723 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22724 {
22725 	return zend_pre_incdec_property_helper_SPEC_VAR_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22726 }
22727 
ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22728 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22729 {
22730 	return zend_pre_incdec_property_helper_SPEC_VAR_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22731 }
22732 
zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)22733 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
22734 {
22735 	USE_OPLINE
22736 	zend_free_op free_op1;
22737 	zval **object_ptr;
22738 	zval *object;
22739 	zval *property;
22740 	zval *retval;
22741 	int have_get_ptr = 0;
22742 
22743 	SAVE_OPLINE();
22744 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22745 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
22746 	retval = &EX_T(opline->result.var).tmp_var;
22747 
22748 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
22749 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
22750 	}
22751 
22752 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
22753 	object = *object_ptr;
22754 
22755 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
22756 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
22757 
22758 		ZVAL_NULL(retval);
22759 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22760 		CHECK_EXCEPTION();
22761 		ZEND_VM_NEXT_OPCODE();
22762 	}
22763 
22764 	/* here we are sure we are dealing with an object */
22765 
22766 	if (0) {
22767 		MAKE_REAL_ZVAL_PTR(property);
22768 	}
22769 
22770 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
22771 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22772 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
22773 			have_get_ptr = 1;
22774 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
22775 
22776 			ZVAL_COPY_VALUE(retval, *zptr);
22777 			zendi_zval_copy_ctor(*retval);
22778 
22779 			incdec_op(*zptr);
22780 
22781 		}
22782 	}
22783 
22784 	if (!have_get_ptr) {
22785 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
22786 			zval *z, *z_copy;
22787 
22788 			Z_ADDREF_P(object);
22789 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22790 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
22791 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
22792 
22793 				if (Z_REFCOUNT_P(z) == 0) {
22794 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
22795 					zval_dtor(z);
22796 					FREE_ZVAL(z);
22797 				}
22798 				z = value;
22799 			}
22800 			ZVAL_COPY_VALUE(retval, z);
22801 			zendi_zval_copy_ctor(*retval);
22802 			ALLOC_ZVAL(z_copy);
22803 			INIT_PZVAL_COPY(z_copy, z);
22804 			zendi_zval_copy_ctor(*z_copy);
22805 			incdec_op(z_copy);
22806 			Z_ADDREF_P(z);
22807 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
22808 			zval_ptr_dtor(&object);
22809 			zval_ptr_dtor(&z_copy);
22810 			zval_ptr_dtor(&z);
22811 		} else {
22812 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
22813 			ZVAL_NULL(retval);
22814 		}
22815 	}
22816 
22817 	if (0) {
22818 		zval_ptr_dtor(&property);
22819 	} else {
22820 
22821 	}
22822 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22823 	CHECK_EXCEPTION();
22824 	ZEND_VM_NEXT_OPCODE();
22825 }
22826 
ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22827 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22828 {
22829 	return zend_post_incdec_property_helper_SPEC_VAR_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22830 }
22831 
ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22832 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22833 {
22834 	return zend_post_incdec_property_helper_SPEC_VAR_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
22835 }
22836 
ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22837 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22838 {
22839 	USE_OPLINE
22840 	zend_free_op free_op1;
22841 	zval *container;
22842 
22843 	SAVE_OPLINE();
22844 
22845 	if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
22846 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
22847 	}
22848 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22849 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
22850 
22851 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22852 	CHECK_EXCEPTION();
22853 	ZEND_VM_NEXT_OPCODE();
22854 }
22855 
ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22856 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22857 {
22858 	USE_OPLINE
22859 	zend_free_op free_op1;
22860 	zval **container;
22861 
22862 	SAVE_OPLINE();
22863 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22864 
22865 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
22866 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22867 	}
22868 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
22869 
22870 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
22871 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22872 	}
22873 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22874 
22875 	/* We are going to assign the result by reference */
22876 	if (UNEXPECTED(opline->extended_value != 0)) {
22877 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
22878 
22879 		if (retval_ptr) {
22880 			Z_DELREF_PP(retval_ptr);
22881 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
22882 			Z_ADDREF_PP(retval_ptr);
22883 		}
22884 	}
22885 
22886 	CHECK_EXCEPTION();
22887 	ZEND_VM_NEXT_OPCODE();
22888 }
22889 
ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22890 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22891 {
22892 	USE_OPLINE
22893 	zend_free_op free_op1;
22894 	zval **container;
22895 
22896 	SAVE_OPLINE();
22897 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22898 
22899 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
22900 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22901 	}
22902 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_RW TSRMLS_CC);
22903 
22904 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
22905 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22906 	}
22907 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22908 	CHECK_EXCEPTION();
22909 	ZEND_VM_NEXT_OPCODE();
22910 }
22911 
ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22912 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22913 {
22914 	USE_OPLINE
22915 	zend_free_op free_op1;
22916 	zval *container;
22917 
22918 	SAVE_OPLINE();
22919 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22920 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_IS TSRMLS_CC);
22921 
22922 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22923 	CHECK_EXCEPTION();
22924 	ZEND_VM_NEXT_OPCODE();
22925 }
22926 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22927 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22928 {
22929 	USE_OPLINE
22930 	zend_free_op free_op1;
22931 
22932 	SAVE_OPLINE();
22933 
22934 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
22935 		zval **container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22936 
22937 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
22938 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22939 		}
22940 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
22941 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
22942 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22943 		}
22944 
22945 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22946 	} else {
22947 		zval *container;
22948 
22949 		if (IS_CV == IS_UNUSED) {
22950 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
22951 		}
22952 		container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22953 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
22954 
22955 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22956 	}
22957 	CHECK_EXCEPTION();
22958 	ZEND_VM_NEXT_OPCODE();
22959 }
22960 
ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)22961 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
22962 {
22963 	USE_OPLINE
22964 	zend_free_op free_op1;
22965 	zval **container;
22966 
22967 	SAVE_OPLINE();
22968 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
22969 
22970 	if (IS_VAR == IS_CV) {
22971 		if (container != &EG(uninitialized_zval_ptr)) {
22972 			SEPARATE_ZVAL_IF_NOT_REF(container);
22973 		}
22974 	}
22975 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
22976 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
22977 	}
22978 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_UNSET TSRMLS_CC);
22979 
22980 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
22981 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
22982 	}
22983 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
22984 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
22985 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
22986 		ZEND_VM_NEXT_OPCODE();
22987 	} else {
22988 		zend_free_op free_res;
22989 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
22990 
22991 		PZVAL_UNLOCK(*retval_ptr, &free_res);
22992 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
22993 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
22994 		}
22995 		PZVAL_LOCK(*retval_ptr);
22996 		FREE_OP_VAR_PTR(free_res);
22997 		CHECK_EXCEPTION();
22998 		ZEND_VM_NEXT_OPCODE();
22999 	}
23000 }
23001 
zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS)23002 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS)
23003 {
23004 	USE_OPLINE
23005 	zend_free_op free_op1;
23006 	zval *container;
23007 
23008 	zval *offset;
23009 
23010 	SAVE_OPLINE();
23011 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23012 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23013 
23014 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
23015 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
23016 		zend_error(E_NOTICE, "Trying to get property of non-object");
23017 		PZVAL_LOCK(&EG(uninitialized_zval));
23018 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23019 
23020 	} else {
23021 		zval *retval;
23022 
23023 		if (0) {
23024 			MAKE_REAL_ZVAL_PTR(offset);
23025 		}
23026 
23027 		/* here we are sure we are dealing with an object */
23028 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23029 
23030 		PZVAL_LOCK(retval);
23031 		AI_SET_PTR(&EX_T(opline->result.var), retval);
23032 
23033 		if (0) {
23034 			zval_ptr_dtor(&offset);
23035 		} else {
23036 
23037 		}
23038 	}
23039 
23040 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23041 	CHECK_EXCEPTION();
23042 	ZEND_VM_NEXT_OPCODE();
23043 }
23044 
ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23045 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23046 {
23047 	return zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23048 }
23049 
ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23050 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23051 {
23052 	USE_OPLINE
23053 	zend_free_op free_op1;
23054 	zval *property;
23055 	zval **container;
23056 
23057 	SAVE_OPLINE();
23058 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23059 
23060 	if (0) {
23061 		MAKE_REAL_ZVAL_PTR(property);
23062 	}
23063 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23064 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
23065 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23066 	}
23067 
23068 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
23069 	if (0) {
23070 		zval_ptr_dtor(&property);
23071 	} else {
23072 
23073 	}
23074 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
23075 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23076 	}
23077 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23078 
23079 	/* We are going to assign the result by reference */
23080 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
23081 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
23082 
23083 		Z_DELREF_PP(retval_ptr);
23084 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
23085 		Z_ADDREF_PP(retval_ptr);
23086 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
23087 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
23088 	}
23089 
23090 	CHECK_EXCEPTION();
23091 	ZEND_VM_NEXT_OPCODE();
23092 }
23093 
ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23094 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23095 {
23096 	USE_OPLINE
23097 	zend_free_op free_op1;
23098 	zval *property;
23099 	zval **container;
23100 
23101 	SAVE_OPLINE();
23102 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23103 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23104 
23105 	if (0) {
23106 		MAKE_REAL_ZVAL_PTR(property);
23107 	}
23108 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
23109 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23110 	}
23111 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
23112 	if (0) {
23113 		zval_ptr_dtor(&property);
23114 	} else {
23115 
23116 	}
23117 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
23118 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23119 	}
23120 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23121 	CHECK_EXCEPTION();
23122 	ZEND_VM_NEXT_OPCODE();
23123 }
23124 
ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23125 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23126 {
23127 	USE_OPLINE
23128 	zend_free_op free_op1;
23129 	zval *container;
23130 
23131 	zval *offset;
23132 
23133 	SAVE_OPLINE();
23134 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23135 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23136 
23137 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
23138 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
23139 		PZVAL_LOCK(&EG(uninitialized_zval));
23140 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23141 
23142 	} else {
23143 		zval *retval;
23144 
23145 		if (0) {
23146 			MAKE_REAL_ZVAL_PTR(offset);
23147 		}
23148 
23149 		/* here we are sure we are dealing with an object */
23150 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23151 
23152 		PZVAL_LOCK(retval);
23153 		AI_SET_PTR(&EX_T(opline->result.var), retval);
23154 
23155 		if (0) {
23156 			zval_ptr_dtor(&offset);
23157 		} else {
23158 
23159 		}
23160 	}
23161 
23162 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23163 	CHECK_EXCEPTION();
23164 	ZEND_VM_NEXT_OPCODE();
23165 }
23166 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23167 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23168 {
23169 	USE_OPLINE
23170 
23171 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
23172 		/* Behave like FETCH_OBJ_W */
23173 		zend_free_op free_op1;
23174 		zval *property;
23175 		zval **container;
23176 
23177 		SAVE_OPLINE();
23178 		property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23179 		container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23180 
23181 		if (0) {
23182 			MAKE_REAL_ZVAL_PTR(property);
23183 		}
23184 		if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
23185 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23186 		}
23187 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
23188 		if (0) {
23189 			zval_ptr_dtor(&property);
23190 		} else {
23191 
23192 		}
23193 		if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
23194 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23195 		}
23196 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23197 		CHECK_EXCEPTION();
23198 		ZEND_VM_NEXT_OPCODE();
23199 	} else {
23200 		return zend_fetch_property_address_read_helper_SPEC_VAR_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23201 	}
23202 }
23203 
ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23204 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23205 {
23206 	USE_OPLINE
23207 	zend_free_op free_op1, free_res;
23208 	zval **container;
23209 	zval *property;
23210 
23211 	SAVE_OPLINE();
23212 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23213 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23214 
23215 	if (IS_VAR == IS_CV) {
23216 		if (container != &EG(uninitialized_zval_ptr)) {
23217 			SEPARATE_ZVAL_IF_NOT_REF(container);
23218 		}
23219 	}
23220 	if (0) {
23221 		MAKE_REAL_ZVAL_PTR(property);
23222 	}
23223 	if (IS_VAR == IS_VAR && UNEXPECTED(container == NULL)) {
23224 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
23225 	}
23226 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
23227 	if (0) {
23228 		zval_ptr_dtor(&property);
23229 	} else {
23230 
23231 	}
23232 	if (IS_VAR == IS_VAR && (free_op1.var != NULL) && READY_TO_DESTROY(free_op1.var)) {
23233 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
23234 	}
23235 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23236 
23237 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
23238 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
23239 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
23240 	}
23241 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
23242 	FREE_OP_VAR_PTR(free_res);
23243 	CHECK_EXCEPTION();
23244 	ZEND_VM_NEXT_OPCODE();
23245 }
23246 
ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23247 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23248 {
23249 	USE_OPLINE
23250 	zend_free_op free_op1;
23251 	zval **object_ptr;
23252 	zval *property_name;
23253 
23254 	SAVE_OPLINE();
23255 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23256 	property_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23257 
23258 	if (0) {
23259 		MAKE_REAL_ZVAL_PTR(property_name);
23260 	}
23261 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
23262 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
23263 	}
23264 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23265 	if (0) {
23266 		zval_ptr_dtor(&property_name);
23267 	} else {
23268 
23269 	}
23270 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23271 	/* assign_obj has two opcodes! */
23272 	CHECK_EXCEPTION();
23273 	ZEND_VM_INC_OPCODE();
23274 	ZEND_VM_NEXT_OPCODE();
23275 }
23276 
ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23277 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23278 {
23279 	USE_OPLINE
23280 	zend_free_op free_op1;
23281 	zval **object_ptr;
23282 
23283 	SAVE_OPLINE();
23284 	object_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23285 
23286 	if (IS_VAR == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
23287 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
23288 	}
23289 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
23290 
23291 		zval *property_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23292 
23293 		if (0) {
23294 			MAKE_REAL_ZVAL_PTR(property_name);
23295 		}
23296 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23297 		if (0) {
23298 			zval_ptr_dtor(&property_name);
23299 		} else {
23300 
23301 		}
23302 	} else {
23303 		zend_free_op free_op_data1, free_op_data2;
23304 		zval *value;
23305 		zval *dim = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23306 		zval **variable_ptr_ptr;
23307 
23308 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CV, BP_VAR_W TSRMLS_CC);
23309 
23310 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
23311 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
23312 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
23313 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
23314 				if (RETURN_VALUE_USED(opline)) {
23315 					zval *retval;
23316 
23317 					ALLOC_ZVAL(retval);
23318 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
23319 					INIT_PZVAL(retval);
23320 					AI_SET_PTR(&EX_T(opline->result.var), retval);
23321 				}
23322 			} else if (RETURN_VALUE_USED(opline)) {
23323 				PZVAL_LOCK(&EG(uninitialized_zval));
23324 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23325 			}
23326 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
23327 			if (IS_TMP_FREE(free_op_data1)) {
23328 				zval_dtor(value);
23329 			}
23330 			if (RETURN_VALUE_USED(opline)) {
23331 				PZVAL_LOCK(&EG(uninitialized_zval));
23332 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23333 			}
23334 		} else {
23335 			if ((opline+1)->op1_type == IS_TMP_VAR) {
23336 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23337 			} else if ((opline+1)->op1_type == IS_CONST) {
23338 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23339 			} else {
23340 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23341 			}
23342 			if (RETURN_VALUE_USED(opline)) {
23343 				PZVAL_LOCK(value);
23344 				AI_SET_PTR(&EX_T(opline->result.var), value);
23345 			}
23346 		}
23347 		FREE_OP_VAR_PTR(free_op_data2);
23348 	 	FREE_OP_IF_VAR(free_op_data1);
23349 	}
23350  	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23351 	/* assign_dim has two opcodes! */
23352 	CHECK_EXCEPTION();
23353 	ZEND_VM_INC_OPCODE();
23354 	ZEND_VM_NEXT_OPCODE();
23355 }
23356 
ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23357 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23358 {
23359 	USE_OPLINE
23360 	zend_free_op free_op1;
23361 	zval *value;
23362 	zval **variable_ptr_ptr;
23363 
23364 	SAVE_OPLINE();
23365 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23366 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23367 
23368 	if (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
23369 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CV TSRMLS_CC)) {
23370 			if (RETURN_VALUE_USED(opline)) {
23371 				zval *retval;
23372 
23373 				ALLOC_ZVAL(retval);
23374 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
23375 				INIT_PZVAL(retval);
23376 				AI_SET_PTR(&EX_T(opline->result.var), retval);
23377 			}
23378 		} else if (RETURN_VALUE_USED(opline)) {
23379 			PZVAL_LOCK(&EG(uninitialized_zval));
23380 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23381 		}
23382 	} else if (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
23383 		if (0) {
23384 			zval_dtor(value);
23385 		}
23386 		if (RETURN_VALUE_USED(opline)) {
23387 			PZVAL_LOCK(&EG(uninitialized_zval));
23388 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
23389 		}
23390 	} else {
23391 		if (IS_CV == IS_TMP_VAR) {
23392 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23393 		} else if (IS_CV == IS_CONST) {
23394 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23395 		} else {
23396 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
23397 		}
23398 		if (RETURN_VALUE_USED(opline)) {
23399 			PZVAL_LOCK(value);
23400 			AI_SET_PTR(&EX_T(opline->result.var), value);
23401 		}
23402 	}
23403 
23404 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
23405 		zval_ptr_dtor(&value);
23406 	}
23407 
23408 	/* zend_assign_to_variable() always takes care of op2, never free it! */
23409 
23410 	CHECK_EXCEPTION();
23411 	ZEND_VM_NEXT_OPCODE();
23412 }
23413 
ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23414 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23415 {
23416 	USE_OPLINE
23417 	zend_free_op free_op1, free_op2;
23418 	zval **variable_ptr_ptr;
23419 	zval **value_ptr_ptr;
23420 
23421 	SAVE_OPLINE();
23422 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);
23423 
23424 	if (IS_CV == IS_VAR &&
23425 	    value_ptr_ptr &&
23426 	    !Z_ISREF_PP(value_ptr_ptr) &&
23427 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
23428 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
23429 		if (free_op2.var == NULL) {
23430 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
23431 		}
23432 		zend_error(E_STRICT, "Only variables should be assigned by reference");
23433 		if (UNEXPECTED(EG(exception) != NULL)) {
23434 
23435 			HANDLE_EXCEPTION();
23436 		}
23437 		return ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23438 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
23439 		PZVAL_LOCK(*value_ptr_ptr);
23440 	}
23441 	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
23442 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
23443 	}
23444 
23445 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23446 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
23447 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
23448 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
23449 	}
23450 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
23451 
23452 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
23453 		Z_DELREF_PP(variable_ptr_ptr);
23454 	}
23455 
23456 	if (RETURN_VALUE_USED(opline)) {
23457 		PZVAL_LOCK(*variable_ptr_ptr);
23458 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
23459 	}
23460 
23461 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23462 
23463 	CHECK_EXCEPTION();
23464 	ZEND_VM_NEXT_OPCODE();
23465 }
23466 
ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23467 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23468 {
23469 	USE_OPLINE
23470 	zval *function_name;
23471 	char *function_name_strval;
23472 	int function_name_strlen;
23473 	zend_free_op free_op1;
23474 	call_slot *call = EX(call_slots) + opline->result.num;
23475 
23476 	SAVE_OPLINE();
23477 
23478 	function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23479 
23480 	if (IS_CV != IS_CONST &&
23481 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
23482 		if (UNEXPECTED(EG(exception) != NULL)) {
23483 			HANDLE_EXCEPTION();
23484 		}
23485 		zend_error_noreturn(E_ERROR, "Method name must be a string");
23486 	}
23487 
23488 	function_name_strval = Z_STRVAL_P(function_name);
23489 	function_name_strlen = Z_STRLEN_P(function_name);
23490 
23491 	call->object = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23492 
23493 	if (EXPECTED(call->object != NULL) &&
23494 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
23495 		call->called_scope = Z_OBJCE_P(call->object);
23496 
23497 		if (IS_CV != IS_CONST ||
23498 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
23499 		    zval *object = call->object;
23500 
23501 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
23502 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
23503 			}
23504 
23505 			/* First, locate the function. */
23506 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
23507 			if (UNEXPECTED(call->fbc == NULL)) {
23508 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
23509 			}
23510 			if (IS_CV == IS_CONST &&
23511 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
23512 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
23513 			    EXPECTED(call->object == object)) {
23514 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
23515 			}
23516 		}
23517 	} else {
23518 		if (UNEXPECTED(EG(exception) != NULL)) {
23519 
23520 			HANDLE_EXCEPTION();
23521 		}
23522 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
23523 	}
23524 
23525 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
23526 		call->object = NULL;
23527 	} else {
23528 		if (!PZVAL_IS_REF(call->object)) {
23529 			Z_ADDREF_P(call->object); /* For $this pointer */
23530 		} else {
23531 			zval *this_ptr;
23532 			ALLOC_ZVAL(this_ptr);
23533 			INIT_PZVAL_COPY(this_ptr, call->object);
23534 			zval_copy_ctor(this_ptr);
23535 			call->object = this_ptr;
23536 		}
23537 	}
23538 	call->is_ctor_call = 0;
23539 	EX(call) = call;
23540 
23541 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23542 
23543 	CHECK_EXCEPTION();
23544 	ZEND_VM_NEXT_OPCODE();
23545 }
23546 
ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23547 static int ZEND_FASTCALL  ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23548 {
23549 	USE_OPLINE
23550 	zval *function_name;
23551 	zend_class_entry *ce;
23552 	call_slot *call = EX(call_slots) + opline->result.num;
23553 
23554 	SAVE_OPLINE();
23555 
23556 	if (IS_VAR == IS_CONST) {
23557 		/* no function found. try a static method in class */
23558 		if (CACHED_PTR(opline->op1.literal->cache_slot)) {
23559 			ce = CACHED_PTR(opline->op1.literal->cache_slot);
23560 		} else {
23561 			ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
23562 			if (UNEXPECTED(EG(exception) != NULL)) {
23563 				HANDLE_EXCEPTION();
23564 			}
23565 			if (UNEXPECTED(ce == NULL)) {
23566 				zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
23567 			}
23568 			CACHE_PTR(opline->op1.literal->cache_slot, ce);
23569 		}
23570 		call->called_scope = ce;
23571 	} else {
23572 		ce = EX_T(opline->op1.var).class_entry;
23573 
23574 		if (opline->extended_value == ZEND_FETCH_CLASS_PARENT || opline->extended_value == ZEND_FETCH_CLASS_SELF) {
23575 			call->called_scope = EG(called_scope);
23576 		} else {
23577 			call->called_scope = ce;
23578 		}
23579 	}
23580 
23581 	if (IS_VAR == IS_CONST &&
23582 	    IS_CV == IS_CONST &&
23583 	    CACHED_PTR(opline->op2.literal->cache_slot)) {
23584 		call->fbc = CACHED_PTR(opline->op2.literal->cache_slot);
23585 	} else if (IS_VAR != IS_CONST &&
23586 	           IS_CV == IS_CONST &&
23587 	           (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce))) {
23588 		/* do nothing */
23589 	} else if (IS_CV != IS_UNUSED) {
23590 		char *function_name_strval = NULL;
23591 		int function_name_strlen = 0;
23592 
23593 
23594 		if (IS_CV == IS_CONST) {
23595 			function_name_strval = Z_STRVAL_P(opline->op2.zv);
23596 			function_name_strlen = Z_STRLEN_P(opline->op2.zv);
23597 		} else {
23598 			function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23599 
23600 			if (UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
23601 				if (UNEXPECTED(EG(exception) != NULL)) {
23602 					HANDLE_EXCEPTION();
23603 				}
23604 				zend_error_noreturn(E_ERROR, "Function name must be a string");
23605 			} else {
23606 				function_name_strval = Z_STRVAL_P(function_name);
23607 				function_name_strlen = Z_STRLEN_P(function_name);
23608  			}
23609 		}
23610 
23611 		if (function_name_strval) {
23612 			if (ce->get_static_method) {
23613 				call->fbc = ce->get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
23614 			} else {
23615 				call->fbc = zend_std_get_static_method(ce, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
23616 			}
23617 			if (UNEXPECTED(call->fbc == NULL)) {
23618 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", ce->name, function_name_strval);
23619 			}
23620 			if (IS_CV == IS_CONST &&
23621 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
23622 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0)) {
23623 				if (IS_VAR == IS_CONST) {
23624 					CACHE_PTR(opline->op2.literal->cache_slot, call->fbc);
23625 				} else {
23626 					CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, call->fbc);
23627 				}
23628 			}
23629 		}
23630 		if (IS_CV != IS_CONST) {
23631 
23632 		}
23633 	} else {
23634 		if (UNEXPECTED(ce->constructor == NULL)) {
23635 			zend_error_noreturn(E_ERROR, "Cannot call constructor");
23636 		}
23637 		if (EG(This) && Z_OBJCE_P(EG(This)) != ce->constructor->common.scope && (ce->constructor->common.fn_flags & ZEND_ACC_PRIVATE)) {
23638 			zend_error_noreturn(E_ERROR, "Cannot call private %s::__construct()", ce->name);
23639 		}
23640 		call->fbc = ce->constructor;
23641 	}
23642 
23643 	if (call->fbc->common.fn_flags & ZEND_ACC_STATIC) {
23644 		call->object = NULL;
23645 	} else {
23646 		if (EG(This) &&
23647 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
23648 		    !instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
23649 		    /* We are calling method of the other (incompatible) class,
23650 		       but passing $this. This is done for compatibility with php-4. */
23651 			if (call->fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
23652 				zend_error(E_STRICT, "Non-static method %s::%s() should not be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
23653 			} else {
23654 				/* An internal function assumes $this is present and won't check that. So PHP would crash by allowing the call. */
23655 				zend_error_noreturn(E_ERROR, "Non-static method %s::%s() cannot be called statically, assuming $this from incompatible context", call->fbc->common.scope->name, call->fbc->common.function_name);
23656 			}
23657 		}
23658 		if ((call->object = EG(This))) {
23659 			Z_ADDREF_P(call->object);
23660 			call->called_scope = Z_OBJCE_P(call->object);
23661 		}
23662 	}
23663 	call->is_ctor_call = 0;
23664 	EX(call) = call;
23665 
23666 	CHECK_EXCEPTION();
23667 	ZEND_VM_NEXT_OPCODE();
23668 }
23669 
ZEND_CASE_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23670 static int ZEND_FASTCALL  ZEND_CASE_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23671 {
23672 	USE_OPLINE
23673 	zend_free_op free_op1;
23674 
23675 	SAVE_OPLINE();
23676 	if (IS_VAR==IS_VAR) {
23677 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
23678 	}
23679 	is_equal_function(&EX_T(opline->result.var).tmp_var,
23680 				 _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC),
23681 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
23682 
23683 	CHECK_EXCEPTION();
23684 	ZEND_VM_NEXT_OPCODE();
23685 }
23686 
ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23687 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23688 {
23689 	USE_OPLINE
23690 	zend_free_op free_op1;
23691 	zval *expr_ptr;
23692 
23693 	SAVE_OPLINE();
23694 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
23695 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23696 
23697 		if (IS_VAR == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
23698 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
23699 		}
23700 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
23701 		expr_ptr = *expr_ptr_ptr;
23702 		Z_ADDREF_P(expr_ptr);
23703 	} else {
23704 		expr_ptr=_get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23705 		if (0) { /* temporary variable */
23706 			zval *new_expr;
23707 
23708 			ALLOC_ZVAL(new_expr);
23709 			INIT_PZVAL_COPY(new_expr, expr_ptr);
23710 			expr_ptr = new_expr;
23711 		} else if (IS_VAR == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
23712 			zval *new_expr;
23713 
23714 			ALLOC_ZVAL(new_expr);
23715 			INIT_PZVAL_COPY(new_expr, expr_ptr);
23716 			expr_ptr = new_expr;
23717 			zendi_zval_copy_ctor(*expr_ptr);
23718 		} else {
23719 			Z_ADDREF_P(expr_ptr);
23720 		}
23721 	}
23722 
23723 	if (IS_CV != IS_UNUSED) {
23724 
23725 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23726 		ulong hval;
23727 
23728 		switch (Z_TYPE_P(offset)) {
23729 			case IS_DOUBLE:
23730 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
23731 				goto num_index;
23732 			case IS_LONG:
23733 			case IS_BOOL:
23734 				hval = Z_LVAL_P(offset);
23735 num_index:
23736 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
23737 				break;
23738 			case IS_STRING:
23739 				if (IS_CV == IS_CONST) {
23740 					hval = Z_HASH_P(offset);
23741 				} else {
23742 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
23743 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
23744 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
23745 					} else {
23746 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
23747 					}
23748 				}
23749 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
23750 				break;
23751 			case IS_NULL:
23752 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
23753 				break;
23754 			default:
23755 				zend_error(E_WARNING, "Illegal offset type");
23756 				zval_ptr_dtor(&expr_ptr);
23757 				/* do nothing */
23758 				break;
23759 		}
23760 
23761 	} else {
23762 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
23763 	}
23764 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
23765 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23766 	} else {
23767 		if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23768 	}
23769 	CHECK_EXCEPTION();
23770 	ZEND_VM_NEXT_OPCODE();
23771 }
23772 
ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23773 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23774 {
23775 	USE_OPLINE
23776 
23777 	array_init(&EX_T(opline->result.var).tmp_var);
23778 	if (IS_VAR == IS_UNUSED) {
23779 		ZEND_VM_NEXT_OPCODE();
23780 #if 0 || IS_VAR != IS_UNUSED
23781 	} else {
23782 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
23783 #endif
23784 	}
23785 }
23786 
ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23787 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23788 {
23789 	USE_OPLINE
23790 	zend_free_op free_op1;
23791 	zval **container;
23792 	zval *offset;
23793 	ulong hval;
23794 
23795 	SAVE_OPLINE();
23796 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23797 	if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
23798 		SEPARATE_ZVAL_IF_NOT_REF(container);
23799 	}
23800 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23801 
23802 	if (IS_VAR != IS_VAR || container) {
23803 		switch (Z_TYPE_PP(container)) {
23804 			case IS_ARRAY: {
23805 				HashTable *ht = Z_ARRVAL_PP(container);
23806 
23807 				switch (Z_TYPE_P(offset)) {
23808 					case IS_DOUBLE:
23809 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
23810 						zend_hash_index_del(ht, hval);
23811 						break;
23812 					case IS_RESOURCE:
23813 					case IS_BOOL:
23814 					case IS_LONG:
23815 						hval = Z_LVAL_P(offset);
23816 						zend_hash_index_del(ht, hval);
23817 						break;
23818 					case IS_STRING:
23819 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
23820 							Z_ADDREF_P(offset);
23821 						}
23822 						if (IS_CV == IS_CONST) {
23823 							hval = Z_HASH_P(offset);
23824 						} else {
23825 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
23826 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
23827 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
23828 							} else {
23829 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
23830 							}
23831 						}
23832 						if (ht == &EG(symbol_table)) {
23833 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
23834 						} else {
23835 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
23836 						}
23837 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
23838 							zval_ptr_dtor(&offset);
23839 						}
23840 						break;
23841 num_index_dim:
23842 						zend_hash_index_del(ht, hval);
23843 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
23844 							zval_ptr_dtor(&offset);
23845 						}
23846 						break;
23847 					case IS_NULL:
23848 						zend_hash_del(ht, "", sizeof(""));
23849 						break;
23850 					default:
23851 						zend_error(E_WARNING, "Illegal offset type in unset");
23852 						break;
23853 				}
23854 
23855 				break;
23856 			}
23857 			case IS_OBJECT:
23858 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
23859 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
23860 				}
23861 				if (0) {
23862 					MAKE_REAL_ZVAL_PTR(offset);
23863 				}
23864 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
23865 				if (0) {
23866 					zval_ptr_dtor(&offset);
23867 				} else {
23868 
23869 				}
23870 				break;
23871 			case IS_STRING:
23872 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
23873 				ZEND_VM_CONTINUE(); /* bailed out before */
23874 			default:
23875 
23876 				break;
23877 		}
23878 	} else {
23879 
23880 	}
23881 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23882 
23883 	CHECK_EXCEPTION();
23884 	ZEND_VM_NEXT_OPCODE();
23885 }
23886 
ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)23887 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
23888 {
23889 	USE_OPLINE
23890 	zend_free_op free_op1;
23891 	zval **container;
23892 	zval *offset;
23893 
23894 	SAVE_OPLINE();
23895 	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23896 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23897 
23898 	if (IS_VAR != IS_VAR || container) {
23899 		if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
23900 			SEPARATE_ZVAL_IF_NOT_REF(container);
23901 		}
23902 		if (Z_TYPE_PP(container) == IS_OBJECT) {
23903 			if (0) {
23904 				MAKE_REAL_ZVAL_PTR(offset);
23905 			}
23906 			if (Z_OBJ_HT_P(*container)->unset_property) {
23907 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
23908 			} else {
23909 				zend_error(E_NOTICE, "Trying to unset property of non-object");
23910 			}
23911 			if (0) {
23912 				zval_ptr_dtor(&offset);
23913 			} else {
23914 
23915 			}
23916 		} else {
23917 
23918 		}
23919 	} else {
23920 
23921 	}
23922 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
23923 
23924 	CHECK_EXCEPTION();
23925 	ZEND_VM_NEXT_OPCODE();
23926 }
23927 
zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)23928 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
23929 {
23930 	USE_OPLINE
23931 	zend_free_op free_op1;
23932 	zval *container;
23933 	zval **value = NULL;
23934 	int result = 0;
23935 	ulong hval;
23936 	zval *offset;
23937 
23938 	SAVE_OPLINE();
23939 	container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
23940 
23941 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
23942 
23943 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
23944 		HashTable *ht;
23945 		int isset = 0;
23946 
23947 		ht = Z_ARRVAL_P(container);
23948 
23949 		switch (Z_TYPE_P(offset)) {
23950 			case IS_DOUBLE:
23951 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
23952 				goto num_index_prop;
23953 			case IS_RESOURCE:
23954 			case IS_BOOL:
23955 			case IS_LONG:
23956 				hval = Z_LVAL_P(offset);
23957 num_index_prop:
23958 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
23959 					isset = 1;
23960 				}
23961 				break;
23962 			case IS_STRING:
23963 				if (IS_CV == IS_CONST) {
23964 					hval = Z_HASH_P(offset);
23965 				} else {
23966 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
23967 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
23968 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
23969 					} else {
23970 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
23971 					}
23972 				}
23973 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
23974 					isset = 1;
23975 				}
23976 				break;
23977 			case IS_NULL:
23978 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
23979 					isset = 1;
23980 				}
23981 				break;
23982 			default:
23983 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
23984 				break;
23985 		}
23986 
23987 		if (opline->extended_value & ZEND_ISSET) {
23988 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
23989 				result = 0;
23990 			} else {
23991 				result = isset;
23992 			}
23993 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
23994 			if (!isset || !i_zend_is_true(*value)) {
23995 				result = 0;
23996 			} else {
23997 				result = 1;
23998 			}
23999 		}
24000 
24001 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
24002 		if (0) {
24003 			MAKE_REAL_ZVAL_PTR(offset);
24004 		}
24005 		if (prop_dim) {
24006 			if (Z_OBJ_HT_P(container)->has_property) {
24007 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24008 			} else {
24009 				zend_error(E_NOTICE, "Trying to check property of non-object");
24010 				result = 0;
24011 			}
24012 		} else {
24013 			if (Z_OBJ_HT_P(container)->has_dimension) {
24014 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
24015 			} else {
24016 				zend_error(E_NOTICE, "Trying to check element of non-array");
24017 				result = 0;
24018 			}
24019 		}
24020 		if (0) {
24021 			zval_ptr_dtor(&offset);
24022 		} else {
24023 
24024 		}
24025 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
24026 		zval tmp;
24027 
24028 		if (Z_TYPE_P(offset) != IS_LONG) {
24029 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
24030 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
24031 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
24032 				ZVAL_COPY_VALUE(&tmp, offset);
24033 				zval_copy_ctor(&tmp);
24034 				convert_to_long(&tmp);
24035 				offset = &tmp;
24036 			} else {
24037 				/* can not be converted to proper offset, return "not set" */
24038 				result = 0;
24039 			}
24040 		}
24041 		if (Z_TYPE_P(offset) == IS_LONG) {
24042 			if (opline->extended_value & ZEND_ISSET) {
24043 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
24044 					result = 1;
24045 				}
24046 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
24047 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
24048 					result = 1;
24049 				}
24050 			}
24051 		}
24052 
24053 	} else {
24054 
24055 	}
24056 
24057 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
24058 	if (opline->extended_value & ZEND_ISSET) {
24059 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
24060 	} else {
24061 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
24062 	}
24063 
24064 	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
24065 
24066 	CHECK_EXCEPTION();
24067 	ZEND_VM_NEXT_OPCODE();
24068 }
24069 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24070 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24071 {
24072 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24073 }
24074 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24075 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24076 {
24077 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24078 }
24079 
ZEND_YIELD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24080 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24081 {
24082 	USE_OPLINE
24083 
24084 	/* The generator object is stored in return_value_ptr_ptr */
24085 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
24086 
24087 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
24088 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
24089 	}
24090 
24091 	/* Destroy the previously yielded value */
24092 	if (generator->value) {
24093 		zval_ptr_dtor(&generator->value);
24094 	}
24095 
24096 	/* Destroy the previously yielded key */
24097 	if (generator->key) {
24098 		zval_ptr_dtor(&generator->key);
24099 	}
24100 
24101 	/* Set the new yielded value */
24102 	if (IS_VAR != IS_UNUSED) {
24103 		zend_free_op free_op1;
24104 
24105 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
24106 			/* Constants and temporary variables aren't yieldable by reference,
24107 			 * but we still allow them with a notice. */
24108 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR) {
24109 				zval *value, *copy;
24110 
24111 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
24112 
24113 				value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
24114 				ALLOC_ZVAL(copy);
24115 				INIT_PZVAL_COPY(copy, value);
24116 
24117 				/* Temporary variables don't need ctor copying */
24118 				if (!0) {
24119 					zval_copy_ctor(copy);
24120 				}
24121 
24122 				generator->value = copy;
24123 			} else {
24124 				zval **value_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
24125 
24126 				if (IS_VAR == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
24127 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
24128 				}
24129 
24130 				/* If a function call result is yielded and the function did
24131 				 * not return by reference we throw a notice. */
24132 				if (IS_VAR == IS_VAR && !Z_ISREF_PP(value_ptr)
24133 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
24134 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
24135 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
24136 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
24137 
24138 					Z_ADDREF_PP(value_ptr);
24139 					generator->value = *value_ptr;
24140 				} else {
24141 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
24142 					Z_ADDREF_PP(value_ptr);
24143 					generator->value = *value_ptr;
24144 				}
24145 
24146 				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
24147 			}
24148 		} else {
24149 			zval *value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
24150 
24151 			/* Consts, temporary variables and references need copying */
24152 			if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
24153 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
24154 			) {
24155 				zval *copy;
24156 
24157 				ALLOC_ZVAL(copy);
24158 				INIT_PZVAL_COPY(copy, value);
24159 
24160 				/* Temporary variables don't need ctor copying */
24161 				if (!0) {
24162 					zval_copy_ctor(copy);
24163 				}
24164 
24165 				generator->value = copy;
24166 			} else {
24167 				Z_ADDREF_P(value);
24168 				generator->value = value;
24169 			}
24170 
24171 			if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
24172 		}
24173 	} else {
24174 		/* If no value was specified yield null */
24175 		Z_ADDREF(EG(uninitialized_zval));
24176 		generator->value = &EG(uninitialized_zval);
24177 	}
24178 
24179 	/* Set the new yielded key */
24180 	if (IS_CV != IS_UNUSED) {
24181 
24182 		zval *key = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
24183 
24184 		/* Consts, temporary variables and references need copying */
24185 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
24186 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
24187 		) {
24188 			zval *copy;
24189 
24190 			ALLOC_ZVAL(copy);
24191 			INIT_PZVAL_COPY(copy, key);
24192 
24193 			/* Temporary variables don't need ctor copying */
24194 			if (!0) {
24195 				zval_copy_ctor(copy);
24196 			}
24197 
24198 			generator->key = copy;
24199 		} else {
24200 			Z_ADDREF_P(key);
24201 			generator->key = key;
24202 		}
24203 
24204 		if (Z_TYPE_P(generator->key) == IS_LONG
24205 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
24206 		) {
24207 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
24208 		}
24209 
24210 	} else {
24211 		/* If no key was specified we use auto-increment keys */
24212 		generator->largest_used_integer_key++;
24213 
24214 		ALLOC_INIT_ZVAL(generator->key);
24215 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
24216 	}
24217 
24218 	if (RETURN_VALUE_USED(opline)) {
24219 		/* If the return value of yield is used set the send
24220 		 * target and initialize it to NULL */
24221 		generator->send_target = &EX_T(opline->result.var).var.ptr;
24222 		Z_ADDREF(EG(uninitialized_zval));
24223 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
24224 	} else {
24225 		generator->send_target = NULL;
24226 	}
24227 
24228 	/* We increment to the next op, so we are at the correct position when the
24229 	 * generator is resumed. */
24230 	ZEND_VM_INC_OPCODE();
24231 
24232 	/* The GOTO VM uses a local opline variable. We need to set the opline
24233 	 * variable in execute_data so we don't resume at an old position. */
24234 	SAVE_OPLINE();
24235 
24236 	ZEND_VM_RETURN();
24237 }
24238 
ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24239 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24240 {
24241 	USE_OPLINE
24242 
24243 	zval *obj;
24244 	zend_class_entry *ce;
24245 	zend_function *clone;
24246 	zend_object_clone_obj_t clone_call;
24247 
24248 	SAVE_OPLINE();
24249 	obj = _get_obj_zval_ptr_unused(TSRMLS_C);
24250 
24251 	if (IS_UNUSED == IS_CONST ||
24252 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
24253 		if (UNEXPECTED(EG(exception) != NULL)) {
24254 			HANDLE_EXCEPTION();
24255 		}
24256 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
24257 	}
24258 
24259 	ce = Z_OBJCE_P(obj);
24260 	clone = ce ? ce->clone : NULL;
24261 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
24262 	if (UNEXPECTED(clone_call == NULL)) {
24263 		if (ce) {
24264 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
24265 		} else {
24266 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
24267 		}
24268 	}
24269 
24270 	if (ce && clone) {
24271 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
24272 			/* Ensure that if we're calling a private function, we're allowed to do so.
24273 			 */
24274 			if (UNEXPECTED(ce != EG(scope))) {
24275 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
24276 			}
24277 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
24278 			/* Ensure that if we're calling a protected function, we're allowed to do so.
24279 			 */
24280 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
24281 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
24282 			}
24283 		}
24284 	}
24285 
24286 	if (EXPECTED(EG(exception) == NULL)) {
24287 		zval *retval;
24288 
24289 		ALLOC_ZVAL(retval);
24290 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
24291 		Z_TYPE_P(retval) = IS_OBJECT;
24292 		Z_SET_REFCOUNT_P(retval, 1);
24293 		Z_SET_ISREF_P(retval);
24294 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
24295 			zval_ptr_dtor(&retval);
24296 		} else {
24297 			AI_SET_PTR(&EX_T(opline->result.var), retval);
24298 		}
24299 	}
24300 
24301 	CHECK_EXCEPTION();
24302 	ZEND_VM_NEXT_OPCODE();
24303 }
24304 
ZEND_EXIT_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24305 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24306 {
24307 #if 0 || (IS_UNUSED != IS_UNUSED)
24308 	USE_OPLINE
24309 
24310 	SAVE_OPLINE();
24311 	if (IS_UNUSED != IS_UNUSED) {
24312 
24313 		zval *ptr = NULL;
24314 
24315 		if (Z_TYPE_P(ptr) == IS_LONG) {
24316 			EG(exit_status) = Z_LVAL_P(ptr);
24317 		} else {
24318 			zend_print_variable(ptr);
24319 		}
24320 
24321 	}
24322 #endif
24323 	zend_bailout();
24324 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
24325 }
24326 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)24327 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
24328 {
24329 	USE_OPLINE
24330 	zend_free_op free_op_data1;
24331 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24332 	zval *object;
24333 	zval *property = opline->op2.zv;
24334 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
24335 	int have_get_ptr = 0;
24336 
24337 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24338 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24339 	}
24340 
24341 	make_real_object(object_ptr TSRMLS_CC);
24342 	object = *object_ptr;
24343 
24344 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24345 		zend_error(E_WARNING, "Attempt to assign property of non-object");
24346 
24347 		FREE_OP(free_op_data1);
24348 
24349 		if (RETURN_VALUE_USED(opline)) {
24350 			PZVAL_LOCK(&EG(uninitialized_zval));
24351 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
24352 			EX_T(opline->result.var).var.ptr_ptr = NULL;
24353 		}
24354 	} else {
24355 		/* here we are sure we are dealing with an object */
24356 		if (0) {
24357 			MAKE_REAL_ZVAL_PTR(property);
24358 		}
24359 
24360 		/* here property is a string */
24361 		if (opline->extended_value == ZEND_ASSIGN_OBJ
24362 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24363 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24364 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24365 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
24366 
24367 				have_get_ptr = 1;
24368 				binary_op(*zptr, *zptr, value TSRMLS_CC);
24369 				if (RETURN_VALUE_USED(opline)) {
24370 					PZVAL_LOCK(*zptr);
24371 					EX_T(opline->result.var).var.ptr = *zptr;
24372 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24373 				}
24374 			}
24375 		}
24376 
24377 		if (!have_get_ptr) {
24378 			zval *z = NULL;
24379 
24380 			Z_ADDREF_P(object);
24381 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
24382 				if (Z_OBJ_HT_P(object)->read_property) {
24383 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24384 				}
24385 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
24386 				if (Z_OBJ_HT_P(object)->read_dimension) {
24387 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
24388 				}
24389 			}
24390 			if (z) {
24391 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
24392 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24393 
24394 					if (Z_REFCOUNT_P(z) == 0) {
24395 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
24396 						zval_dtor(z);
24397 						FREE_ZVAL(z);
24398 					}
24399 					z = value;
24400 				}
24401 				Z_ADDREF_P(z);
24402 				SEPARATE_ZVAL_IF_NOT_REF(&z);
24403 				binary_op(z, z, value TSRMLS_CC);
24404 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
24405 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24406 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
24407 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
24408 				}
24409 				if (RETURN_VALUE_USED(opline)) {
24410 					PZVAL_LOCK(z);
24411 					EX_T(opline->result.var).var.ptr = z;
24412 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24413 				}
24414 				zval_ptr_dtor(&z);
24415 			} else {
24416 				zend_error(E_WARNING, "Attempt to assign property of non-object");
24417 				if (RETURN_VALUE_USED(opline)) {
24418 					PZVAL_LOCK(&EG(uninitialized_zval));
24419 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
24420 					EX_T(opline->result.var).var.ptr_ptr = NULL;
24421 				}
24422 			}
24423 			zval_ptr_dtor(&object);
24424 		}
24425 
24426 		if (0) {
24427 			zval_ptr_dtor(&property);
24428 		} else {
24429 
24430 		}
24431 		FREE_OP(free_op_data1);
24432 	}
24433 
24434 	/* assign_obj has two opcodes! */
24435 	CHECK_EXCEPTION();
24436 	ZEND_VM_INC_OPCODE();
24437 	ZEND_VM_NEXT_OPCODE();
24438 }
24439 
zend_binary_assign_op_helper_SPEC_UNUSED_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)24440 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
24441 {
24442 	USE_OPLINE
24443 	zend_free_op free_op_data2, free_op_data1;
24444 	zval **var_ptr;
24445 	zval *value;
24446 
24447 	SAVE_OPLINE();
24448 	switch (opline->extended_value) {
24449 		case ZEND_ASSIGN_OBJ:
24450 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24451 			break;
24452 		case ZEND_ASSIGN_DIM: {
24453 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24454 
24455 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24456 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
24457 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
24458 					if (IS_UNUSED == IS_VAR && !0) {
24459 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
24460 					}
24461 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24462 				} else {
24463 					zval *dim = opline->op2.zv;
24464 
24465 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
24466 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
24467 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
24468 				}
24469 			}
24470 			break;
24471 		default:
24472 			value = opline->op2.zv;
24473 			var_ptr = NULL;
24474 			/* do nothing */
24475 			break;
24476 	}
24477 
24478 	if (UNEXPECTED(var_ptr == NULL)) {
24479 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
24480 	}
24481 
24482 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
24483 		if (RETURN_VALUE_USED(opline)) {
24484 			PZVAL_LOCK(&EG(uninitialized_zval));
24485 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24486 		}
24487 
24488 
24489 		CHECK_EXCEPTION();
24490 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
24491 			ZEND_VM_INC_OPCODE();
24492 		}
24493 		ZEND_VM_NEXT_OPCODE();
24494 	}
24495 
24496 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
24497 
24498 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
24499 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
24500 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
24501 		/* proxy object */
24502 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
24503 		Z_ADDREF_P(objval);
24504 		binary_op(objval, objval, value TSRMLS_CC);
24505 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
24506 		zval_ptr_dtor(&objval);
24507 	} else {
24508 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
24509 	}
24510 
24511 	if (RETURN_VALUE_USED(opline)) {
24512 		PZVAL_LOCK(*var_ptr);
24513 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
24514 	}
24515 
24516 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
24517 		FREE_OP(free_op_data1);
24518 		FREE_OP_VAR_PTR(free_op_data2);
24519 
24520 		CHECK_EXCEPTION();
24521 		ZEND_VM_INC_OPCODE();
24522 	} else {
24523 
24524 		CHECK_EXCEPTION();
24525 	}
24526 	ZEND_VM_NEXT_OPCODE();
24527 }
24528 
ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24529 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24530 {
24531 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24532 }
24533 
ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24534 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24535 {
24536 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24537 }
24538 
ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24539 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24540 {
24541 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24542 }
24543 
ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24544 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24545 {
24546 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24547 }
24548 
ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24549 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24550 {
24551 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24552 }
24553 
ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24554 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24555 {
24556 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24557 }
24558 
ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24559 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24560 {
24561 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24562 }
24563 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24564 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24565 {
24566 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24567 }
24568 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24569 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24570 {
24571 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24572 }
24573 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24574 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24575 {
24576 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24577 }
24578 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24579 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24580 {
24581 	return zend_binary_assign_op_helper_SPEC_UNUSED_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24582 }
24583 
zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)24584 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
24585 {
24586 	USE_OPLINE
24587 
24588 	zval **object_ptr;
24589 	zval *object;
24590 	zval *property;
24591 	zval **retval;
24592 	int have_get_ptr = 0;
24593 
24594 	SAVE_OPLINE();
24595 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24596 	property = opline->op2.zv;
24597 	retval = &EX_T(opline->result.var).var.ptr;
24598 
24599 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24600 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
24601 	}
24602 
24603 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
24604 	object = *object_ptr;
24605 
24606 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24607 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24608 
24609 		if (RETURN_VALUE_USED(opline)) {
24610 			PZVAL_LOCK(&EG(uninitialized_zval));
24611 			*retval = &EG(uninitialized_zval);
24612 		}
24613 
24614 		CHECK_EXCEPTION();
24615 		ZEND_VM_NEXT_OPCODE();
24616 	}
24617 
24618 	/* here we are sure we are dealing with an object */
24619 
24620 	if (0) {
24621 		MAKE_REAL_ZVAL_PTR(property);
24622 	}
24623 
24624 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24625 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24626 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24627 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
24628 
24629 			have_get_ptr = 1;
24630 			incdec_op(*zptr);
24631 			if (RETURN_VALUE_USED(opline)) {
24632 				*retval = *zptr;
24633 				PZVAL_LOCK(*retval);
24634 			}
24635 		}
24636 	}
24637 
24638 	if (!have_get_ptr) {
24639 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
24640 			zval *z;
24641 
24642 			Z_ADDREF_P(object);
24643 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24644 
24645 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
24646 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24647 
24648 				if (Z_REFCOUNT_P(z) == 0) {
24649 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
24650 					zval_dtor(z);
24651 					FREE_ZVAL(z);
24652 				}
24653 				z = value;
24654 			}
24655 			Z_ADDREF_P(z);
24656 			SEPARATE_ZVAL_IF_NOT_REF(&z);
24657 			incdec_op(z);
24658 			*retval = z;
24659 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24660 			zval_ptr_dtor(&object);
24661 			SELECTIVE_PZVAL_LOCK(*retval, opline);
24662 			zval_ptr_dtor(&z);
24663 		} else {
24664 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24665 			if (RETURN_VALUE_USED(opline)) {
24666 				PZVAL_LOCK(&EG(uninitialized_zval));
24667 				*retval = &EG(uninitialized_zval);
24668 			}
24669 		}
24670 	}
24671 
24672 	if (0) {
24673 		zval_ptr_dtor(&property);
24674 	} else {
24675 
24676 	}
24677 
24678 	CHECK_EXCEPTION();
24679 	ZEND_VM_NEXT_OPCODE();
24680 }
24681 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24682 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24683 {
24684 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24685 }
24686 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24687 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24688 {
24689 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24690 }
24691 
zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)24692 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
24693 {
24694 	USE_OPLINE
24695 
24696 	zval **object_ptr;
24697 	zval *object;
24698 	zval *property;
24699 	zval *retval;
24700 	int have_get_ptr = 0;
24701 
24702 	SAVE_OPLINE();
24703 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24704 	property = opline->op2.zv;
24705 	retval = &EX_T(opline->result.var).tmp_var;
24706 
24707 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
24708 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
24709 	}
24710 
24711 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
24712 	object = *object_ptr;
24713 
24714 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
24715 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24716 
24717 		ZVAL_NULL(retval);
24718 
24719 		CHECK_EXCEPTION();
24720 		ZEND_VM_NEXT_OPCODE();
24721 	}
24722 
24723 	/* here we are sure we are dealing with an object */
24724 
24725 	if (0) {
24726 		MAKE_REAL_ZVAL_PTR(property);
24727 	}
24728 
24729 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
24730 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24731 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
24732 			have_get_ptr = 1;
24733 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
24734 
24735 			ZVAL_COPY_VALUE(retval, *zptr);
24736 			zendi_zval_copy_ctor(*retval);
24737 
24738 			incdec_op(*zptr);
24739 
24740 		}
24741 	}
24742 
24743 	if (!have_get_ptr) {
24744 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
24745 			zval *z, *z_copy;
24746 
24747 			Z_ADDREF_P(object);
24748 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24749 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
24750 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
24751 
24752 				if (Z_REFCOUNT_P(z) == 0) {
24753 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
24754 					zval_dtor(z);
24755 					FREE_ZVAL(z);
24756 				}
24757 				z = value;
24758 			}
24759 			ZVAL_COPY_VALUE(retval, z);
24760 			zendi_zval_copy_ctor(*retval);
24761 			ALLOC_ZVAL(z_copy);
24762 			INIT_PZVAL_COPY(z_copy, z);
24763 			zendi_zval_copy_ctor(*z_copy);
24764 			incdec_op(z_copy);
24765 			Z_ADDREF_P(z);
24766 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24767 			zval_ptr_dtor(&object);
24768 			zval_ptr_dtor(&z_copy);
24769 			zval_ptr_dtor(&z);
24770 		} else {
24771 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
24772 			ZVAL_NULL(retval);
24773 		}
24774 	}
24775 
24776 	if (0) {
24777 		zval_ptr_dtor(&property);
24778 	} else {
24779 
24780 	}
24781 
24782 	CHECK_EXCEPTION();
24783 	ZEND_VM_NEXT_OPCODE();
24784 }
24785 
ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24786 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24787 {
24788 	return zend_post_incdec_property_helper_SPEC_UNUSED_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24789 }
24790 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24791 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24792 {
24793 	return zend_post_incdec_property_helper_SPEC_UNUSED_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24794 }
24795 
zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS)24796 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS)
24797 {
24798 	USE_OPLINE
24799 
24800 	zval *container;
24801 
24802 	zval *offset;
24803 
24804 	SAVE_OPLINE();
24805 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
24806 	offset  = opline->op2.zv;
24807 
24808 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
24809 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
24810 		zend_error(E_NOTICE, "Trying to get property of non-object");
24811 		PZVAL_LOCK(&EG(uninitialized_zval));
24812 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24813 
24814 	} else {
24815 		zval *retval;
24816 
24817 		if (0) {
24818 			MAKE_REAL_ZVAL_PTR(offset);
24819 		}
24820 
24821 		/* here we are sure we are dealing with an object */
24822 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24823 
24824 		PZVAL_LOCK(retval);
24825 		AI_SET_PTR(&EX_T(opline->result.var), retval);
24826 
24827 		if (0) {
24828 			zval_ptr_dtor(&offset);
24829 		} else {
24830 
24831 		}
24832 	}
24833 
24834 	CHECK_EXCEPTION();
24835 	ZEND_VM_NEXT_OPCODE();
24836 }
24837 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24838 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24839 {
24840 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24841 }
24842 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24843 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24844 {
24845 	USE_OPLINE
24846 	zend_free_op free_op1;
24847 	zval *property;
24848 	zval **container;
24849 
24850 	SAVE_OPLINE();
24851 	property = opline->op2.zv;
24852 
24853 	if (0) {
24854 		MAKE_REAL_ZVAL_PTR(property);
24855 	}
24856 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24857 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24858 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24859 	}
24860 
24861 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
24862 	if (0) {
24863 		zval_ptr_dtor(&property);
24864 	} else {
24865 
24866 	}
24867 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24868 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24869 	}
24870 
24871 	/* We are going to assign the result by reference */
24872 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
24873 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
24874 
24875 		Z_DELREF_PP(retval_ptr);
24876 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
24877 		Z_ADDREF_PP(retval_ptr);
24878 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
24879 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
24880 	}
24881 
24882 	CHECK_EXCEPTION();
24883 	ZEND_VM_NEXT_OPCODE();
24884 }
24885 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24886 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24887 {
24888 	USE_OPLINE
24889 	zend_free_op free_op1;
24890 	zval *property;
24891 	zval **container;
24892 
24893 	SAVE_OPLINE();
24894 	property = opline->op2.zv;
24895 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24896 
24897 	if (0) {
24898 		MAKE_REAL_ZVAL_PTR(property);
24899 	}
24900 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24901 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24902 	}
24903 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
24904 	if (0) {
24905 		zval_ptr_dtor(&property);
24906 	} else {
24907 
24908 	}
24909 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24910 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24911 	}
24912 
24913 	CHECK_EXCEPTION();
24914 	ZEND_VM_NEXT_OPCODE();
24915 }
24916 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24917 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24918 {
24919 	USE_OPLINE
24920 
24921 	zval *container;
24922 
24923 	zval *offset;
24924 
24925 	SAVE_OPLINE();
24926 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
24927 	offset  = opline->op2.zv;
24928 
24929 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
24930 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
24931 		PZVAL_LOCK(&EG(uninitialized_zval));
24932 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
24933 
24934 	} else {
24935 		zval *retval;
24936 
24937 		if (0) {
24938 			MAKE_REAL_ZVAL_PTR(offset);
24939 		}
24940 
24941 		/* here we are sure we are dealing with an object */
24942 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
24943 
24944 		PZVAL_LOCK(retval);
24945 		AI_SET_PTR(&EX_T(opline->result.var), retval);
24946 
24947 		if (0) {
24948 			zval_ptr_dtor(&offset);
24949 		} else {
24950 
24951 		}
24952 	}
24953 
24954 	CHECK_EXCEPTION();
24955 	ZEND_VM_NEXT_OPCODE();
24956 }
24957 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24958 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24959 {
24960 	USE_OPLINE
24961 
24962 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
24963 		/* Behave like FETCH_OBJ_W */
24964 		zend_free_op free_op1;
24965 		zval *property;
24966 		zval **container;
24967 
24968 		SAVE_OPLINE();
24969 		property = opline->op2.zv;
24970 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
24971 
24972 		if (0) {
24973 			MAKE_REAL_ZVAL_PTR(property);
24974 		}
24975 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
24976 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
24977 		}
24978 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
24979 		if (0) {
24980 			zval_ptr_dtor(&property);
24981 		} else {
24982 
24983 		}
24984 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
24985 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
24986 		}
24987 
24988 		CHECK_EXCEPTION();
24989 		ZEND_VM_NEXT_OPCODE();
24990 	} else {
24991 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
24992 	}
24993 }
24994 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)24995 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
24996 {
24997 	USE_OPLINE
24998 	zend_free_op free_op1, free_res;
24999 	zval **container;
25000 	zval *property;
25001 
25002 	SAVE_OPLINE();
25003 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25004 	property = opline->op2.zv;
25005 
25006 	if (IS_UNUSED == IS_CV) {
25007 		if (container != &EG(uninitialized_zval_ptr)) {
25008 			SEPARATE_ZVAL_IF_NOT_REF(container);
25009 		}
25010 	}
25011 	if (0) {
25012 		MAKE_REAL_ZVAL_PTR(property);
25013 	}
25014 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
25015 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
25016 	}
25017 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
25018 	if (0) {
25019 		zval_ptr_dtor(&property);
25020 	} else {
25021 
25022 	}
25023 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
25024 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
25025 	}
25026 
25027 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
25028 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
25029 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
25030 	}
25031 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
25032 	FREE_OP_VAR_PTR(free_res);
25033 	CHECK_EXCEPTION();
25034 	ZEND_VM_NEXT_OPCODE();
25035 }
25036 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25037 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25038 {
25039 	USE_OPLINE
25040 
25041 	zval **object_ptr;
25042 	zval *property_name;
25043 
25044 	SAVE_OPLINE();
25045 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25046 	property_name = opline->op2.zv;
25047 
25048 	if (0) {
25049 		MAKE_REAL_ZVAL_PTR(property_name);
25050 	}
25051 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25052 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
25053 	}
25054 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25055 	if (0) {
25056 		zval_ptr_dtor(&property_name);
25057 	} else {
25058 
25059 	}
25060 
25061 	/* assign_obj has two opcodes! */
25062 	CHECK_EXCEPTION();
25063 	ZEND_VM_INC_OPCODE();
25064 	ZEND_VM_NEXT_OPCODE();
25065 }
25066 
ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25067 static int ZEND_FASTCALL  ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25068 {
25069 	USE_OPLINE
25070 	zval *str = &EX_T(opline->result.var).tmp_var;
25071 
25072 	SAVE_OPLINE();
25073 
25074 	if (IS_UNUSED == IS_UNUSED) {
25075 		/* Initialize for erealloc in add_char_to_string */
25076 		Z_STRVAL_P(str) = NULL;
25077 		Z_STRLEN_P(str) = 0;
25078 		Z_TYPE_P(str) = IS_STRING;
25079 
25080 		INIT_PZVAL(str);
25081 	}
25082 
25083 	add_char_to_string(str, str, opline->op2.zv);
25084 
25085 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
25086 	/*CHECK_EXCEPTION();*/
25087 	ZEND_VM_NEXT_OPCODE();
25088 }
25089 
ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25090 static int ZEND_FASTCALL  ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25091 {
25092 	USE_OPLINE
25093 	zval *str = &EX_T(opline->result.var).tmp_var;
25094 
25095 	SAVE_OPLINE();
25096 
25097 	if (IS_UNUSED == IS_UNUSED) {
25098 		/* Initialize for erealloc in add_string_to_string */
25099 		Z_STRVAL_P(str) = NULL;
25100 		Z_STRLEN_P(str) = 0;
25101 		Z_TYPE_P(str) = IS_STRING;
25102 
25103 		INIT_PZVAL(str);
25104 	}
25105 
25106 	add_string_to_string(str, str, opline->op2.zv);
25107 
25108 	/* FREE_OP is missing intentionally here - we're always working on the same temporary variable */
25109 	/*CHECK_EXCEPTION();*/
25110 	ZEND_VM_NEXT_OPCODE();
25111 }
25112 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25113 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25114 {
25115 	USE_OPLINE
25116 	zval *function_name;
25117 	char *function_name_strval;
25118 	int function_name_strlen;
25119 
25120 	call_slot *call = EX(call_slots) + opline->result.num;
25121 
25122 	SAVE_OPLINE();
25123 
25124 	function_name = opline->op2.zv;
25125 
25126 	if (IS_CONST != IS_CONST &&
25127 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
25128 		if (UNEXPECTED(EG(exception) != NULL)) {
25129 			HANDLE_EXCEPTION();
25130 		}
25131 		zend_error_noreturn(E_ERROR, "Method name must be a string");
25132 	}
25133 
25134 	function_name_strval = Z_STRVAL_P(function_name);
25135 	function_name_strlen = Z_STRLEN_P(function_name);
25136 
25137 	call->object = _get_obj_zval_ptr_unused(TSRMLS_C);
25138 
25139 	if (EXPECTED(call->object != NULL) &&
25140 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
25141 		call->called_scope = Z_OBJCE_P(call->object);
25142 
25143 		if (IS_CONST != IS_CONST ||
25144 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
25145 		    zval *object = call->object;
25146 
25147 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
25148 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
25149 			}
25150 
25151 			/* First, locate the function. */
25152 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
25153 			if (UNEXPECTED(call->fbc == NULL)) {
25154 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
25155 			}
25156 			if (IS_CONST == IS_CONST &&
25157 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
25158 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
25159 			    EXPECTED(call->object == object)) {
25160 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
25161 			}
25162 		}
25163 	} else {
25164 		if (UNEXPECTED(EG(exception) != NULL)) {
25165 
25166 			HANDLE_EXCEPTION();
25167 		}
25168 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
25169 	}
25170 
25171 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
25172 		call->object = NULL;
25173 	} else {
25174 		if (!PZVAL_IS_REF(call->object)) {
25175 			Z_ADDREF_P(call->object); /* For $this pointer */
25176 		} else {
25177 			zval *this_ptr;
25178 			ALLOC_ZVAL(this_ptr);
25179 			INIT_PZVAL_COPY(this_ptr, call->object);
25180 			zval_copy_ctor(this_ptr);
25181 			call->object = this_ptr;
25182 		}
25183 	}
25184 	call->is_ctor_call = 0;
25185 	EX(call) = call;
25186 
25187 
25188 	CHECK_EXCEPTION();
25189 	ZEND_VM_NEXT_OPCODE();
25190 }
25191 
ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25192 static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25193 {
25194 	USE_OPLINE
25195 
25196 	SAVE_OPLINE();
25197 	if (IS_UNUSED == IS_UNUSED) {
25198 		zend_constant *c;
25199 		zval *retval;
25200 
25201 		if (CACHED_PTR(opline->op2.literal->cache_slot)) {
25202 			c = CACHED_PTR(opline->op2.literal->cache_slot);
25203 		} else if ((c = zend_quick_get_constant(opline->op2.literal + 1, opline->extended_value TSRMLS_CC)) == NULL) {
25204 			if ((opline->extended_value & IS_CONSTANT_UNQUALIFIED) != 0) {
25205 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(opline->op2.zv), '\\', Z_STRLEN_P(opline->op2.zv));
25206 				if(!actual) {
25207 					actual = Z_STRVAL_P(opline->op2.zv);
25208 				} else {
25209 					actual++;
25210 				}
25211 				/* non-qualified constant - allow text substitution */
25212 				zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
25213 				ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, actual, Z_STRLEN_P(opline->op2.zv)-(actual - Z_STRVAL_P(opline->op2.zv)), 1);
25214 				CHECK_EXCEPTION();
25215 				ZEND_VM_NEXT_OPCODE();
25216 			} else {
25217 				zend_error_noreturn(E_ERROR, "Undefined constant '%s'", Z_STRVAL_P(opline->op2.zv));
25218 			}
25219 		} else {
25220 			CACHE_PTR(opline->op2.literal->cache_slot, c);
25221 		}
25222 		retval = &EX_T(opline->result.var).tmp_var;
25223 		ZVAL_COPY_VALUE(retval, &c->value);
25224 		zval_copy_ctor(retval);
25225 		CHECK_EXCEPTION();
25226 		ZEND_VM_NEXT_OPCODE();
25227 	} else {
25228 		/* class constant */
25229 		zend_class_entry *ce;
25230 		zval **value;
25231 
25232 		if (IS_UNUSED == IS_CONST) {
25233 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
25234 				value = CACHED_PTR(opline->op2.literal->cache_slot);
25235 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
25236 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
25237 				CHECK_EXCEPTION();
25238 				ZEND_VM_NEXT_OPCODE();
25239 			} else if (CACHED_PTR(opline->op1.literal->cache_slot)) {
25240 				ce = CACHED_PTR(opline->op1.literal->cache_slot);
25241 			} else {
25242 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op1.zv), Z_STRLEN_P(opline->op1.zv), opline->op1.literal + 1, opline->extended_value TSRMLS_CC);
25243 				if (UNEXPECTED(EG(exception) != NULL)) {
25244 					HANDLE_EXCEPTION();
25245 				}
25246 				if (UNEXPECTED(ce == NULL)) {
25247 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op1.zv));
25248 				}
25249 				CACHE_PTR(opline->op1.literal->cache_slot, ce);
25250 			}
25251 		} else {
25252 			ce = EX_T(opline->op1.var).class_entry;
25253 			if ((value = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce)) != NULL) {
25254 				ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
25255 				zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
25256 				CHECK_EXCEPTION();
25257 				ZEND_VM_NEXT_OPCODE();
25258 			}
25259 		}
25260 
25261 		if (EXPECTED(zend_hash_quick_find(&ce->constants_table, Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv)+1, Z_HASH_P(opline->op2.zv), (void **) &value) == SUCCESS)) {
25262 			if (Z_TYPE_PP(value) == IS_CONSTANT_ARRAY ||
25263 			    (Z_TYPE_PP(value) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
25264 				zend_class_entry *old_scope = EG(scope);
25265 
25266 				EG(scope) = ce;
25267 				zval_update_constant(value, (void *) 1 TSRMLS_CC);
25268 				EG(scope) = old_scope;
25269 			}
25270 			if (IS_UNUSED == IS_CONST) {
25271 				CACHE_PTR(opline->op2.literal->cache_slot, value);
25272 			} else {
25273 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, ce, value);
25274 			}
25275 			ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, *value);
25276 			zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
25277 		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && strcmp(Z_STRVAL_P(opline->op2.zv), "class") == 0) {
25278 			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */
25279 			ZVAL_STRINGL(&EX_T(opline->result.var).tmp_var, ce->name, ce->name_length, 1);
25280 		} else {
25281 			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));
25282 		}
25283 
25284 		CHECK_EXCEPTION();
25285 		ZEND_VM_NEXT_OPCODE();
25286 	}
25287 }
25288 
ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25289 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25290 {
25291 	USE_OPLINE
25292 
25293 	array_init(&EX_T(opline->result.var).tmp_var);
25294 	if (IS_UNUSED == IS_UNUSED) {
25295 		ZEND_VM_NEXT_OPCODE();
25296 #if 0 || IS_UNUSED != IS_UNUSED
25297 	} else {
25298 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25299 #endif
25300 	}
25301 }
25302 
ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25303 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25304 {
25305 	USE_OPLINE
25306 
25307 	zval **container;
25308 	zval *offset;
25309 	ulong hval;
25310 
25311 	SAVE_OPLINE();
25312 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25313 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
25314 		SEPARATE_ZVAL_IF_NOT_REF(container);
25315 	}
25316 	offset = opline->op2.zv;
25317 
25318 	if (IS_UNUSED != IS_VAR || container) {
25319 		switch (Z_TYPE_PP(container)) {
25320 			case IS_ARRAY: {
25321 				HashTable *ht = Z_ARRVAL_PP(container);
25322 
25323 				switch (Z_TYPE_P(offset)) {
25324 					case IS_DOUBLE:
25325 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
25326 						zend_hash_index_del(ht, hval);
25327 						break;
25328 					case IS_RESOURCE:
25329 					case IS_BOOL:
25330 					case IS_LONG:
25331 						hval = Z_LVAL_P(offset);
25332 						zend_hash_index_del(ht, hval);
25333 						break;
25334 					case IS_STRING:
25335 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
25336 							Z_ADDREF_P(offset);
25337 						}
25338 						if (IS_CONST == IS_CONST) {
25339 							hval = Z_HASH_P(offset);
25340 						} else {
25341 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
25342 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
25343 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
25344 							} else {
25345 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
25346 							}
25347 						}
25348 						if (ht == &EG(symbol_table)) {
25349 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
25350 						} else {
25351 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
25352 						}
25353 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
25354 							zval_ptr_dtor(&offset);
25355 						}
25356 						break;
25357 num_index_dim:
25358 						zend_hash_index_del(ht, hval);
25359 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
25360 							zval_ptr_dtor(&offset);
25361 						}
25362 						break;
25363 					case IS_NULL:
25364 						zend_hash_del(ht, "", sizeof(""));
25365 						break;
25366 					default:
25367 						zend_error(E_WARNING, "Illegal offset type in unset");
25368 						break;
25369 				}
25370 
25371 				break;
25372 			}
25373 			case IS_OBJECT:
25374 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
25375 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
25376 				}
25377 				if (0) {
25378 					MAKE_REAL_ZVAL_PTR(offset);
25379 				}
25380 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
25381 				if (0) {
25382 					zval_ptr_dtor(&offset);
25383 				} else {
25384 
25385 				}
25386 				break;
25387 			case IS_STRING:
25388 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
25389 				ZEND_VM_CONTINUE(); /* bailed out before */
25390 			default:
25391 
25392 				break;
25393 		}
25394 	} else {
25395 
25396 	}
25397 
25398 	CHECK_EXCEPTION();
25399 	ZEND_VM_NEXT_OPCODE();
25400 }
25401 
ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25402 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25403 {
25404 	USE_OPLINE
25405 
25406 	zval **container;
25407 	zval *offset;
25408 
25409 	SAVE_OPLINE();
25410 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25411 	offset = opline->op2.zv;
25412 
25413 	if (IS_UNUSED != IS_VAR || container) {
25414 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
25415 			SEPARATE_ZVAL_IF_NOT_REF(container);
25416 		}
25417 		if (Z_TYPE_PP(container) == IS_OBJECT) {
25418 			if (0) {
25419 				MAKE_REAL_ZVAL_PTR(offset);
25420 			}
25421 			if (Z_OBJ_HT_P(*container)->unset_property) {
25422 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25423 			} else {
25424 				zend_error(E_NOTICE, "Trying to unset property of non-object");
25425 			}
25426 			if (0) {
25427 				zval_ptr_dtor(&offset);
25428 			} else {
25429 
25430 			}
25431 		} else {
25432 
25433 		}
25434 	} else {
25435 
25436 	}
25437 
25438 	CHECK_EXCEPTION();
25439 	ZEND_VM_NEXT_OPCODE();
25440 }
25441 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)25442 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
25443 {
25444 	USE_OPLINE
25445 
25446 	zval *container;
25447 	zval **value = NULL;
25448 	int result = 0;
25449 	ulong hval;
25450 	zval *offset;
25451 
25452 	SAVE_OPLINE();
25453 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
25454 
25455 	offset = opline->op2.zv;
25456 
25457 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
25458 		HashTable *ht;
25459 		int isset = 0;
25460 
25461 		ht = Z_ARRVAL_P(container);
25462 
25463 		switch (Z_TYPE_P(offset)) {
25464 			case IS_DOUBLE:
25465 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
25466 				goto num_index_prop;
25467 			case IS_RESOURCE:
25468 			case IS_BOOL:
25469 			case IS_LONG:
25470 				hval = Z_LVAL_P(offset);
25471 num_index_prop:
25472 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
25473 					isset = 1;
25474 				}
25475 				break;
25476 			case IS_STRING:
25477 				if (IS_CONST == IS_CONST) {
25478 					hval = Z_HASH_P(offset);
25479 				} else {
25480 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
25481 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
25482 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
25483 					} else {
25484 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
25485 					}
25486 				}
25487 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
25488 					isset = 1;
25489 				}
25490 				break;
25491 			case IS_NULL:
25492 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
25493 					isset = 1;
25494 				}
25495 				break;
25496 			default:
25497 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
25498 				break;
25499 		}
25500 
25501 		if (opline->extended_value & ZEND_ISSET) {
25502 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
25503 				result = 0;
25504 			} else {
25505 				result = isset;
25506 			}
25507 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
25508 			if (!isset || !i_zend_is_true(*value)) {
25509 				result = 0;
25510 			} else {
25511 				result = 1;
25512 			}
25513 		}
25514 
25515 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
25516 		if (0) {
25517 			MAKE_REAL_ZVAL_PTR(offset);
25518 		}
25519 		if (prop_dim) {
25520 			if (Z_OBJ_HT_P(container)->has_property) {
25521 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25522 			} else {
25523 				zend_error(E_NOTICE, "Trying to check property of non-object");
25524 				result = 0;
25525 			}
25526 		} else {
25527 			if (Z_OBJ_HT_P(container)->has_dimension) {
25528 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
25529 			} else {
25530 				zend_error(E_NOTICE, "Trying to check element of non-array");
25531 				result = 0;
25532 			}
25533 		}
25534 		if (0) {
25535 			zval_ptr_dtor(&offset);
25536 		} else {
25537 
25538 		}
25539 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
25540 		zval tmp;
25541 
25542 		if (Z_TYPE_P(offset) != IS_LONG) {
25543 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
25544 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
25545 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
25546 				ZVAL_COPY_VALUE(&tmp, offset);
25547 				zval_copy_ctor(&tmp);
25548 				convert_to_long(&tmp);
25549 				offset = &tmp;
25550 			} else {
25551 				/* can not be converted to proper offset, return "not set" */
25552 				result = 0;
25553 			}
25554 		}
25555 		if (Z_TYPE_P(offset) == IS_LONG) {
25556 			if (opline->extended_value & ZEND_ISSET) {
25557 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
25558 					result = 1;
25559 				}
25560 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
25561 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
25562 					result = 1;
25563 				}
25564 			}
25565 		}
25566 
25567 	} else {
25568 
25569 	}
25570 
25571 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
25572 	if (opline->extended_value & ZEND_ISSET) {
25573 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
25574 	} else {
25575 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
25576 	}
25577 
25578 	CHECK_EXCEPTION();
25579 	ZEND_VM_NEXT_OPCODE();
25580 }
25581 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25582 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25583 {
25584 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25585 }
25586 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25587 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25588 {
25589 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25590 }
25591 
ZEND_YIELD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25592 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25593 {
25594 	USE_OPLINE
25595 
25596 	/* The generator object is stored in return_value_ptr_ptr */
25597 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
25598 
25599 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
25600 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
25601 	}
25602 
25603 	/* Destroy the previously yielded value */
25604 	if (generator->value) {
25605 		zval_ptr_dtor(&generator->value);
25606 	}
25607 
25608 	/* Destroy the previously yielded key */
25609 	if (generator->key) {
25610 		zval_ptr_dtor(&generator->key);
25611 	}
25612 
25613 	/* Set the new yielded value */
25614 	if (IS_UNUSED != IS_UNUSED) {
25615 
25616 
25617 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
25618 			/* Constants and temporary variables aren't yieldable by reference,
25619 			 * but we still allow them with a notice. */
25620 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR) {
25621 				zval *value, *copy;
25622 
25623 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
25624 
25625 				value = NULL;
25626 				ALLOC_ZVAL(copy);
25627 				INIT_PZVAL_COPY(copy, value);
25628 
25629 				/* Temporary variables don't need ctor copying */
25630 				if (!0) {
25631 					zval_copy_ctor(copy);
25632 				}
25633 
25634 				generator->value = copy;
25635 			} else {
25636 				zval **value_ptr = NULL;
25637 
25638 				if (IS_UNUSED == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
25639 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
25640 				}
25641 
25642 				/* If a function call result is yielded and the function did
25643 				 * not return by reference we throw a notice. */
25644 				if (IS_UNUSED == IS_VAR && !Z_ISREF_PP(value_ptr)
25645 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
25646 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
25647 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
25648 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
25649 
25650 					Z_ADDREF_PP(value_ptr);
25651 					generator->value = *value_ptr;
25652 				} else {
25653 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
25654 					Z_ADDREF_PP(value_ptr);
25655 					generator->value = *value_ptr;
25656 				}
25657 
25658 			}
25659 		} else {
25660 			zval *value = NULL;
25661 
25662 			/* Consts, temporary variables and references need copying */
25663 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
25664 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
25665 			) {
25666 				zval *copy;
25667 
25668 				ALLOC_ZVAL(copy);
25669 				INIT_PZVAL_COPY(copy, value);
25670 
25671 				/* Temporary variables don't need ctor copying */
25672 				if (!0) {
25673 					zval_copy_ctor(copy);
25674 				}
25675 
25676 				generator->value = copy;
25677 			} else {
25678 				Z_ADDREF_P(value);
25679 				generator->value = value;
25680 			}
25681 
25682 		}
25683 	} else {
25684 		/* If no value was specified yield null */
25685 		Z_ADDREF(EG(uninitialized_zval));
25686 		generator->value = &EG(uninitialized_zval);
25687 	}
25688 
25689 	/* Set the new yielded key */
25690 	if (IS_CONST != IS_UNUSED) {
25691 
25692 		zval *key = opline->op2.zv;
25693 
25694 		/* Consts, temporary variables and references need copying */
25695 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
25696 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
25697 		) {
25698 			zval *copy;
25699 
25700 			ALLOC_ZVAL(copy);
25701 			INIT_PZVAL_COPY(copy, key);
25702 
25703 			/* Temporary variables don't need ctor copying */
25704 			if (!0) {
25705 				zval_copy_ctor(copy);
25706 			}
25707 
25708 			generator->key = copy;
25709 		} else {
25710 			Z_ADDREF_P(key);
25711 			generator->key = key;
25712 		}
25713 
25714 		if (Z_TYPE_P(generator->key) == IS_LONG
25715 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
25716 		) {
25717 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
25718 		}
25719 
25720 	} else {
25721 		/* If no key was specified we use auto-increment keys */
25722 		generator->largest_used_integer_key++;
25723 
25724 		ALLOC_INIT_ZVAL(generator->key);
25725 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
25726 	}
25727 
25728 	if (RETURN_VALUE_USED(opline)) {
25729 		/* If the return value of yield is used set the send
25730 		 * target and initialize it to NULL */
25731 		generator->send_target = &EX_T(opline->result.var).var.ptr;
25732 		Z_ADDREF(EG(uninitialized_zval));
25733 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25734 	} else {
25735 		generator->send_target = NULL;
25736 	}
25737 
25738 	/* We increment to the next op, so we are at the correct position when the
25739 	 * generator is resumed. */
25740 	ZEND_VM_INC_OPCODE();
25741 
25742 	/* The GOTO VM uses a local opline variable. We need to set the opline
25743 	 * variable in execute_data so we don't resume at an old position. */
25744 	SAVE_OPLINE();
25745 
25746 	ZEND_VM_RETURN();
25747 }
25748 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25749 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25750 {
25751 	USE_OPLINE
25752 	zend_free_op free_op2, free_op_data1;
25753 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25754 	zval *object;
25755 	zval *property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
25756 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
25757 	int have_get_ptr = 0;
25758 
25759 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
25760 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
25761 	}
25762 
25763 	make_real_object(object_ptr TSRMLS_CC);
25764 	object = *object_ptr;
25765 
25766 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
25767 		zend_error(E_WARNING, "Attempt to assign property of non-object");
25768 		zval_dtor(free_op2.var);
25769 		FREE_OP(free_op_data1);
25770 
25771 		if (RETURN_VALUE_USED(opline)) {
25772 			PZVAL_LOCK(&EG(uninitialized_zval));
25773 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25774 			EX_T(opline->result.var).var.ptr_ptr = NULL;
25775 		}
25776 	} else {
25777 		/* here we are sure we are dealing with an object */
25778 		if (1) {
25779 			MAKE_REAL_ZVAL_PTR(property);
25780 		}
25781 
25782 		/* here property is a string */
25783 		if (opline->extended_value == ZEND_ASSIGN_OBJ
25784 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
25785 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25786 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
25787 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
25788 
25789 				have_get_ptr = 1;
25790 				binary_op(*zptr, *zptr, value TSRMLS_CC);
25791 				if (RETURN_VALUE_USED(opline)) {
25792 					PZVAL_LOCK(*zptr);
25793 					EX_T(opline->result.var).var.ptr = *zptr;
25794 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25795 				}
25796 			}
25797 		}
25798 
25799 		if (!have_get_ptr) {
25800 			zval *z = NULL;
25801 
25802 			Z_ADDREF_P(object);
25803 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25804 				if (Z_OBJ_HT_P(object)->read_property) {
25805 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25806 				}
25807 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25808 				if (Z_OBJ_HT_P(object)->read_dimension) {
25809 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
25810 				}
25811 			}
25812 			if (z) {
25813 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
25814 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
25815 
25816 					if (Z_REFCOUNT_P(z) == 0) {
25817 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
25818 						zval_dtor(z);
25819 						FREE_ZVAL(z);
25820 					}
25821 					z = value;
25822 				}
25823 				Z_ADDREF_P(z);
25824 				SEPARATE_ZVAL_IF_NOT_REF(&z);
25825 				binary_op(z, z, value TSRMLS_CC);
25826 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
25827 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
25828 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
25829 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
25830 				}
25831 				if (RETURN_VALUE_USED(opline)) {
25832 					PZVAL_LOCK(z);
25833 					EX_T(opline->result.var).var.ptr = z;
25834 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25835 				}
25836 				zval_ptr_dtor(&z);
25837 			} else {
25838 				zend_error(E_WARNING, "Attempt to assign property of non-object");
25839 				if (RETURN_VALUE_USED(opline)) {
25840 					PZVAL_LOCK(&EG(uninitialized_zval));
25841 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
25842 					EX_T(opline->result.var).var.ptr_ptr = NULL;
25843 				}
25844 			}
25845 			zval_ptr_dtor(&object);
25846 		}
25847 
25848 		if (1) {
25849 			zval_ptr_dtor(&property);
25850 		} else {
25851 			zval_dtor(free_op2.var);
25852 		}
25853 		FREE_OP(free_op_data1);
25854 	}
25855 
25856 	/* assign_obj has two opcodes! */
25857 	CHECK_EXCEPTION();
25858 	ZEND_VM_INC_OPCODE();
25859 	ZEND_VM_NEXT_OPCODE();
25860 }
25861 
zend_binary_assign_op_helper_SPEC_UNUSED_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)25862 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
25863 {
25864 	USE_OPLINE
25865 	zend_free_op free_op2, free_op_data2, free_op_data1;
25866 	zval **var_ptr;
25867 	zval *value;
25868 
25869 	SAVE_OPLINE();
25870 	switch (opline->extended_value) {
25871 		case ZEND_ASSIGN_OBJ:
25872 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25873 			break;
25874 		case ZEND_ASSIGN_DIM: {
25875 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
25876 
25877 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
25878 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
25879 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
25880 					if (IS_UNUSED == IS_VAR && !0) {
25881 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
25882 					}
25883 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25884 				} else {
25885 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
25886 
25887 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
25888 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
25889 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
25890 				}
25891 			}
25892 			break;
25893 		default:
25894 			value = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
25895 			var_ptr = NULL;
25896 			/* do nothing */
25897 			break;
25898 	}
25899 
25900 	if (UNEXPECTED(var_ptr == NULL)) {
25901 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
25902 	}
25903 
25904 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
25905 		if (RETURN_VALUE_USED(opline)) {
25906 			PZVAL_LOCK(&EG(uninitialized_zval));
25907 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
25908 		}
25909 		zval_dtor(free_op2.var);
25910 
25911 		CHECK_EXCEPTION();
25912 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
25913 			ZEND_VM_INC_OPCODE();
25914 		}
25915 		ZEND_VM_NEXT_OPCODE();
25916 	}
25917 
25918 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
25919 
25920 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
25921 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
25922 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
25923 		/* proxy object */
25924 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
25925 		Z_ADDREF_P(objval);
25926 		binary_op(objval, objval, value TSRMLS_CC);
25927 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
25928 		zval_ptr_dtor(&objval);
25929 	} else {
25930 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
25931 	}
25932 
25933 	if (RETURN_VALUE_USED(opline)) {
25934 		PZVAL_LOCK(*var_ptr);
25935 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
25936 	}
25937 	zval_dtor(free_op2.var);
25938 
25939 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
25940 		FREE_OP(free_op_data1);
25941 		FREE_OP_VAR_PTR(free_op_data2);
25942 
25943 		CHECK_EXCEPTION();
25944 		ZEND_VM_INC_OPCODE();
25945 	} else {
25946 
25947 		CHECK_EXCEPTION();
25948 	}
25949 	ZEND_VM_NEXT_OPCODE();
25950 }
25951 
ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25952 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25953 {
25954 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25955 }
25956 
ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25957 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25958 {
25959 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25960 }
25961 
ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25962 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25963 {
25964 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25965 }
25966 
ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25967 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25968 {
25969 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25970 }
25971 
ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25972 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25973 {
25974 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25975 }
25976 
ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25977 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25978 {
25979 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25980 }
25981 
ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25982 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25983 {
25984 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25985 }
25986 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25987 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25988 {
25989 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25990 }
25991 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25992 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25993 {
25994 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
25995 }
25996 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)25997 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
25998 {
25999 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26000 }
26001 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26002 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26003 {
26004 	return zend_binary_assign_op_helper_SPEC_UNUSED_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26005 }
26006 
zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)26007 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
26008 {
26009 	USE_OPLINE
26010 	zend_free_op free_op2;
26011 	zval **object_ptr;
26012 	zval *object;
26013 	zval *property;
26014 	zval **retval;
26015 	int have_get_ptr = 0;
26016 
26017 	SAVE_OPLINE();
26018 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26019 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26020 	retval = &EX_T(opline->result.var).var.ptr;
26021 
26022 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
26023 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26024 	}
26025 
26026 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
26027 	object = *object_ptr;
26028 
26029 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
26030 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
26031 		zval_dtor(free_op2.var);
26032 		if (RETURN_VALUE_USED(opline)) {
26033 			PZVAL_LOCK(&EG(uninitialized_zval));
26034 			*retval = &EG(uninitialized_zval);
26035 		}
26036 
26037 		CHECK_EXCEPTION();
26038 		ZEND_VM_NEXT_OPCODE();
26039 	}
26040 
26041 	/* here we are sure we are dealing with an object */
26042 
26043 	if (1) {
26044 		MAKE_REAL_ZVAL_PTR(property);
26045 	}
26046 
26047 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
26048 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26049 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
26050 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
26051 
26052 			have_get_ptr = 1;
26053 			incdec_op(*zptr);
26054 			if (RETURN_VALUE_USED(opline)) {
26055 				*retval = *zptr;
26056 				PZVAL_LOCK(*retval);
26057 			}
26058 		}
26059 	}
26060 
26061 	if (!have_get_ptr) {
26062 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
26063 			zval *z;
26064 
26065 			Z_ADDREF_P(object);
26066 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26067 
26068 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
26069 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
26070 
26071 				if (Z_REFCOUNT_P(z) == 0) {
26072 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
26073 					zval_dtor(z);
26074 					FREE_ZVAL(z);
26075 				}
26076 				z = value;
26077 			}
26078 			Z_ADDREF_P(z);
26079 			SEPARATE_ZVAL_IF_NOT_REF(&z);
26080 			incdec_op(z);
26081 			*retval = z;
26082 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26083 			zval_ptr_dtor(&object);
26084 			SELECTIVE_PZVAL_LOCK(*retval, opline);
26085 			zval_ptr_dtor(&z);
26086 		} else {
26087 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
26088 			if (RETURN_VALUE_USED(opline)) {
26089 				PZVAL_LOCK(&EG(uninitialized_zval));
26090 				*retval = &EG(uninitialized_zval);
26091 			}
26092 		}
26093 	}
26094 
26095 	if (1) {
26096 		zval_ptr_dtor(&property);
26097 	} else {
26098 		zval_dtor(free_op2.var);
26099 	}
26100 
26101 	CHECK_EXCEPTION();
26102 	ZEND_VM_NEXT_OPCODE();
26103 }
26104 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26105 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26106 {
26107 	return zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26108 }
26109 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26110 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26111 {
26112 	return zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26113 }
26114 
zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)26115 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
26116 {
26117 	USE_OPLINE
26118 	zend_free_op free_op2;
26119 	zval **object_ptr;
26120 	zval *object;
26121 	zval *property;
26122 	zval *retval;
26123 	int have_get_ptr = 0;
26124 
26125 	SAVE_OPLINE();
26126 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26127 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26128 	retval = &EX_T(opline->result.var).tmp_var;
26129 
26130 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
26131 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
26132 	}
26133 
26134 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
26135 	object = *object_ptr;
26136 
26137 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
26138 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
26139 		zval_dtor(free_op2.var);
26140 		ZVAL_NULL(retval);
26141 
26142 		CHECK_EXCEPTION();
26143 		ZEND_VM_NEXT_OPCODE();
26144 	}
26145 
26146 	/* here we are sure we are dealing with an object */
26147 
26148 	if (1) {
26149 		MAKE_REAL_ZVAL_PTR(property);
26150 	}
26151 
26152 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
26153 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26154 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
26155 			have_get_ptr = 1;
26156 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
26157 
26158 			ZVAL_COPY_VALUE(retval, *zptr);
26159 			zendi_zval_copy_ctor(*retval);
26160 
26161 			incdec_op(*zptr);
26162 
26163 		}
26164 	}
26165 
26166 	if (!have_get_ptr) {
26167 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
26168 			zval *z, *z_copy;
26169 
26170 			Z_ADDREF_P(object);
26171 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26172 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
26173 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
26174 
26175 				if (Z_REFCOUNT_P(z) == 0) {
26176 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
26177 					zval_dtor(z);
26178 					FREE_ZVAL(z);
26179 				}
26180 				z = value;
26181 			}
26182 			ZVAL_COPY_VALUE(retval, z);
26183 			zendi_zval_copy_ctor(*retval);
26184 			ALLOC_ZVAL(z_copy);
26185 			INIT_PZVAL_COPY(z_copy, z);
26186 			zendi_zval_copy_ctor(*z_copy);
26187 			incdec_op(z_copy);
26188 			Z_ADDREF_P(z);
26189 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26190 			zval_ptr_dtor(&object);
26191 			zval_ptr_dtor(&z_copy);
26192 			zval_ptr_dtor(&z);
26193 		} else {
26194 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
26195 			ZVAL_NULL(retval);
26196 		}
26197 	}
26198 
26199 	if (1) {
26200 		zval_ptr_dtor(&property);
26201 	} else {
26202 		zval_dtor(free_op2.var);
26203 	}
26204 
26205 	CHECK_EXCEPTION();
26206 	ZEND_VM_NEXT_OPCODE();
26207 }
26208 
ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26209 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26210 {
26211 	return zend_post_incdec_property_helper_SPEC_UNUSED_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26212 }
26213 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26214 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26215 {
26216 	return zend_post_incdec_property_helper_SPEC_UNUSED_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26217 }
26218 
zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS)26219 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS)
26220 {
26221 	USE_OPLINE
26222 
26223 	zval *container;
26224 	zend_free_op free_op2;
26225 	zval *offset;
26226 
26227 	SAVE_OPLINE();
26228 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
26229 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26230 
26231 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
26232 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
26233 		zend_error(E_NOTICE, "Trying to get property of non-object");
26234 		PZVAL_LOCK(&EG(uninitialized_zval));
26235 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
26236 		zval_dtor(free_op2.var);
26237 	} else {
26238 		zval *retval;
26239 
26240 		if (1) {
26241 			MAKE_REAL_ZVAL_PTR(offset);
26242 		}
26243 
26244 		/* here we are sure we are dealing with an object */
26245 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26246 
26247 		PZVAL_LOCK(retval);
26248 		AI_SET_PTR(&EX_T(opline->result.var), retval);
26249 
26250 		if (1) {
26251 			zval_ptr_dtor(&offset);
26252 		} else {
26253 			zval_dtor(free_op2.var);
26254 		}
26255 	}
26256 
26257 	CHECK_EXCEPTION();
26258 	ZEND_VM_NEXT_OPCODE();
26259 }
26260 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26261 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26262 {
26263 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26264 }
26265 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26266 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26267 {
26268 	USE_OPLINE
26269 	zend_free_op free_op1, free_op2;
26270 	zval *property;
26271 	zval **container;
26272 
26273 	SAVE_OPLINE();
26274 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26275 
26276 	if (1) {
26277 		MAKE_REAL_ZVAL_PTR(property);
26278 	}
26279 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26280 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26281 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26282 	}
26283 
26284 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
26285 	if (1) {
26286 		zval_ptr_dtor(&property);
26287 	} else {
26288 		zval_dtor(free_op2.var);
26289 	}
26290 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26291 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26292 	}
26293 
26294 	/* We are going to assign the result by reference */
26295 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
26296 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
26297 
26298 		Z_DELREF_PP(retval_ptr);
26299 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
26300 		Z_ADDREF_PP(retval_ptr);
26301 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
26302 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
26303 	}
26304 
26305 	CHECK_EXCEPTION();
26306 	ZEND_VM_NEXT_OPCODE();
26307 }
26308 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26309 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26310 {
26311 	USE_OPLINE
26312 	zend_free_op free_op1, free_op2;
26313 	zval *property;
26314 	zval **container;
26315 
26316 	SAVE_OPLINE();
26317 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26318 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26319 
26320 	if (1) {
26321 		MAKE_REAL_ZVAL_PTR(property);
26322 	}
26323 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26324 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26325 	}
26326 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
26327 	if (1) {
26328 		zval_ptr_dtor(&property);
26329 	} else {
26330 		zval_dtor(free_op2.var);
26331 	}
26332 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26333 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26334 	}
26335 
26336 	CHECK_EXCEPTION();
26337 	ZEND_VM_NEXT_OPCODE();
26338 }
26339 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26340 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26341 {
26342 	USE_OPLINE
26343 
26344 	zval *container;
26345 	zend_free_op free_op2;
26346 	zval *offset;
26347 
26348 	SAVE_OPLINE();
26349 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
26350 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26351 
26352 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
26353 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
26354 		PZVAL_LOCK(&EG(uninitialized_zval));
26355 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
26356 		zval_dtor(free_op2.var);
26357 	} else {
26358 		zval *retval;
26359 
26360 		if (1) {
26361 			MAKE_REAL_ZVAL_PTR(offset);
26362 		}
26363 
26364 		/* here we are sure we are dealing with an object */
26365 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26366 
26367 		PZVAL_LOCK(retval);
26368 		AI_SET_PTR(&EX_T(opline->result.var), retval);
26369 
26370 		if (1) {
26371 			zval_ptr_dtor(&offset);
26372 		} else {
26373 			zval_dtor(free_op2.var);
26374 		}
26375 	}
26376 
26377 	CHECK_EXCEPTION();
26378 	ZEND_VM_NEXT_OPCODE();
26379 }
26380 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26381 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26382 {
26383 	USE_OPLINE
26384 
26385 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
26386 		/* Behave like FETCH_OBJ_W */
26387 		zend_free_op free_op1, free_op2;
26388 		zval *property;
26389 		zval **container;
26390 
26391 		SAVE_OPLINE();
26392 		property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26393 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26394 
26395 		if (1) {
26396 			MAKE_REAL_ZVAL_PTR(property);
26397 		}
26398 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26399 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26400 		}
26401 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
26402 		if (1) {
26403 			zval_ptr_dtor(&property);
26404 		} else {
26405 			zval_dtor(free_op2.var);
26406 		}
26407 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26408 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26409 		}
26410 
26411 		CHECK_EXCEPTION();
26412 		ZEND_VM_NEXT_OPCODE();
26413 	} else {
26414 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26415 	}
26416 }
26417 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26418 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26419 {
26420 	USE_OPLINE
26421 	zend_free_op free_op1, free_op2, free_res;
26422 	zval **container;
26423 	zval *property;
26424 
26425 	SAVE_OPLINE();
26426 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26427 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26428 
26429 	if (IS_UNUSED == IS_CV) {
26430 		if (container != &EG(uninitialized_zval_ptr)) {
26431 			SEPARATE_ZVAL_IF_NOT_REF(container);
26432 		}
26433 	}
26434 	if (1) {
26435 		MAKE_REAL_ZVAL_PTR(property);
26436 	}
26437 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
26438 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
26439 	}
26440 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
26441 	if (1) {
26442 		zval_ptr_dtor(&property);
26443 	} else {
26444 		zval_dtor(free_op2.var);
26445 	}
26446 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
26447 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
26448 	}
26449 
26450 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
26451 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
26452 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
26453 	}
26454 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
26455 	FREE_OP_VAR_PTR(free_res);
26456 	CHECK_EXCEPTION();
26457 	ZEND_VM_NEXT_OPCODE();
26458 }
26459 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26460 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26461 {
26462 	USE_OPLINE
26463 	zend_free_op free_op2;
26464 	zval **object_ptr;
26465 	zval *property_name;
26466 
26467 	SAVE_OPLINE();
26468 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26469 	property_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26470 
26471 	if (1) {
26472 		MAKE_REAL_ZVAL_PTR(property_name);
26473 	}
26474 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
26475 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
26476 	}
26477 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26478 	if (1) {
26479 		zval_ptr_dtor(&property_name);
26480 	} else {
26481 		zval_dtor(free_op2.var);
26482 	}
26483 
26484 	/* assign_obj has two opcodes! */
26485 	CHECK_EXCEPTION();
26486 	ZEND_VM_INC_OPCODE();
26487 	ZEND_VM_NEXT_OPCODE();
26488 }
26489 
ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26490 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26491 {
26492 	USE_OPLINE
26493 	zend_free_op free_op2;
26494 	zval *str = &EX_T(opline->result.var).tmp_var;
26495 	zval *var;
26496 	zval var_copy;
26497 	int use_copy = 0;
26498 
26499 	SAVE_OPLINE();
26500 	var = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26501 
26502 	if (IS_UNUSED == IS_UNUSED) {
26503 		/* Initialize for erealloc in add_string_to_string */
26504 		Z_STRVAL_P(str) = NULL;
26505 		Z_STRLEN_P(str) = 0;
26506 		Z_TYPE_P(str) = IS_STRING;
26507 
26508 		INIT_PZVAL(str);
26509 	}
26510 
26511 	if (Z_TYPE_P(var) != IS_STRING) {
26512 		zend_make_printable_zval(var, &var_copy, &use_copy);
26513 
26514 		if (use_copy) {
26515 			var = &var_copy;
26516 		}
26517 	}
26518 	add_string_to_string(str, str, var);
26519 
26520 	if (use_copy) {
26521 		zval_dtor(var);
26522 	}
26523 	/* original comment, possibly problematic:
26524 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
26525 	 * (Zeev):  I don't think it's problematic, we only use variables
26526 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
26527 	 * string offsets or overloaded objects
26528 	 */
26529 	zval_dtor(free_op2.var);
26530 
26531 	CHECK_EXCEPTION();
26532 	ZEND_VM_NEXT_OPCODE();
26533 }
26534 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26535 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26536 {
26537 	USE_OPLINE
26538 	zval *function_name;
26539 	char *function_name_strval;
26540 	int function_name_strlen;
26541 	zend_free_op free_op2;
26542 	call_slot *call = EX(call_slots) + opline->result.num;
26543 
26544 	SAVE_OPLINE();
26545 
26546 	function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26547 
26548 	if (IS_TMP_VAR != IS_CONST &&
26549 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
26550 		if (UNEXPECTED(EG(exception) != NULL)) {
26551 			HANDLE_EXCEPTION();
26552 		}
26553 		zend_error_noreturn(E_ERROR, "Method name must be a string");
26554 	}
26555 
26556 	function_name_strval = Z_STRVAL_P(function_name);
26557 	function_name_strlen = Z_STRLEN_P(function_name);
26558 
26559 	call->object = _get_obj_zval_ptr_unused(TSRMLS_C);
26560 
26561 	if (EXPECTED(call->object != NULL) &&
26562 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
26563 		call->called_scope = Z_OBJCE_P(call->object);
26564 
26565 		if (IS_TMP_VAR != IS_CONST ||
26566 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
26567 		    zval *object = call->object;
26568 
26569 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
26570 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
26571 			}
26572 
26573 			/* First, locate the function. */
26574 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
26575 			if (UNEXPECTED(call->fbc == NULL)) {
26576 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
26577 			}
26578 			if (IS_TMP_VAR == IS_CONST &&
26579 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
26580 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
26581 			    EXPECTED(call->object == object)) {
26582 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
26583 			}
26584 		}
26585 	} else {
26586 		if (UNEXPECTED(EG(exception) != NULL)) {
26587 			zval_dtor(free_op2.var);
26588 			HANDLE_EXCEPTION();
26589 		}
26590 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
26591 	}
26592 
26593 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
26594 		call->object = NULL;
26595 	} else {
26596 		if (!PZVAL_IS_REF(call->object)) {
26597 			Z_ADDREF_P(call->object); /* For $this pointer */
26598 		} else {
26599 			zval *this_ptr;
26600 			ALLOC_ZVAL(this_ptr);
26601 			INIT_PZVAL_COPY(this_ptr, call->object);
26602 			zval_copy_ctor(this_ptr);
26603 			call->object = this_ptr;
26604 		}
26605 	}
26606 	call->is_ctor_call = 0;
26607 	EX(call) = call;
26608 
26609 	zval_dtor(free_op2.var);
26610 
26611 	CHECK_EXCEPTION();
26612 	ZEND_VM_NEXT_OPCODE();
26613 }
26614 
ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26615 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26616 {
26617 	USE_OPLINE
26618 
26619 	array_init(&EX_T(opline->result.var).tmp_var);
26620 	if (IS_UNUSED == IS_UNUSED) {
26621 		ZEND_VM_NEXT_OPCODE();
26622 #if 0 || IS_UNUSED != IS_UNUSED
26623 	} else {
26624 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26625 #endif
26626 	}
26627 }
26628 
ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26629 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26630 {
26631 	USE_OPLINE
26632 	zend_free_op free_op2;
26633 	zval **container;
26634 	zval *offset;
26635 	ulong hval;
26636 
26637 	SAVE_OPLINE();
26638 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26639 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
26640 		SEPARATE_ZVAL_IF_NOT_REF(container);
26641 	}
26642 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26643 
26644 	if (IS_UNUSED != IS_VAR || container) {
26645 		switch (Z_TYPE_PP(container)) {
26646 			case IS_ARRAY: {
26647 				HashTable *ht = Z_ARRVAL_PP(container);
26648 
26649 				switch (Z_TYPE_P(offset)) {
26650 					case IS_DOUBLE:
26651 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
26652 						zend_hash_index_del(ht, hval);
26653 						break;
26654 					case IS_RESOURCE:
26655 					case IS_BOOL:
26656 					case IS_LONG:
26657 						hval = Z_LVAL_P(offset);
26658 						zend_hash_index_del(ht, hval);
26659 						break;
26660 					case IS_STRING:
26661 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
26662 							Z_ADDREF_P(offset);
26663 						}
26664 						if (IS_TMP_VAR == IS_CONST) {
26665 							hval = Z_HASH_P(offset);
26666 						} else {
26667 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
26668 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
26669 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
26670 							} else {
26671 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
26672 							}
26673 						}
26674 						if (ht == &EG(symbol_table)) {
26675 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
26676 						} else {
26677 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
26678 						}
26679 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
26680 							zval_ptr_dtor(&offset);
26681 						}
26682 						break;
26683 num_index_dim:
26684 						zend_hash_index_del(ht, hval);
26685 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
26686 							zval_ptr_dtor(&offset);
26687 						}
26688 						break;
26689 					case IS_NULL:
26690 						zend_hash_del(ht, "", sizeof(""));
26691 						break;
26692 					default:
26693 						zend_error(E_WARNING, "Illegal offset type in unset");
26694 						break;
26695 				}
26696 				zval_dtor(free_op2.var);
26697 				break;
26698 			}
26699 			case IS_OBJECT:
26700 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
26701 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
26702 				}
26703 				if (1) {
26704 					MAKE_REAL_ZVAL_PTR(offset);
26705 				}
26706 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
26707 				if (1) {
26708 					zval_ptr_dtor(&offset);
26709 				} else {
26710 					zval_dtor(free_op2.var);
26711 				}
26712 				break;
26713 			case IS_STRING:
26714 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
26715 				ZEND_VM_CONTINUE(); /* bailed out before */
26716 			default:
26717 				zval_dtor(free_op2.var);
26718 				break;
26719 		}
26720 	} else {
26721 		zval_dtor(free_op2.var);
26722 	}
26723 
26724 	CHECK_EXCEPTION();
26725 	ZEND_VM_NEXT_OPCODE();
26726 }
26727 
ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26728 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26729 {
26730 	USE_OPLINE
26731 	zend_free_op free_op2;
26732 	zval **container;
26733 	zval *offset;
26734 
26735 	SAVE_OPLINE();
26736 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
26737 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26738 
26739 	if (IS_UNUSED != IS_VAR || container) {
26740 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
26741 			SEPARATE_ZVAL_IF_NOT_REF(container);
26742 		}
26743 		if (Z_TYPE_PP(container) == IS_OBJECT) {
26744 			if (1) {
26745 				MAKE_REAL_ZVAL_PTR(offset);
26746 			}
26747 			if (Z_OBJ_HT_P(*container)->unset_property) {
26748 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26749 			} else {
26750 				zend_error(E_NOTICE, "Trying to unset property of non-object");
26751 			}
26752 			if (1) {
26753 				zval_ptr_dtor(&offset);
26754 			} else {
26755 				zval_dtor(free_op2.var);
26756 			}
26757 		} else {
26758 			zval_dtor(free_op2.var);
26759 		}
26760 	} else {
26761 		zval_dtor(free_op2.var);
26762 	}
26763 
26764 	CHECK_EXCEPTION();
26765 	ZEND_VM_NEXT_OPCODE();
26766 }
26767 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)26768 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
26769 {
26770 	USE_OPLINE
26771 	zend_free_op free_op2;
26772 	zval *container;
26773 	zval **value = NULL;
26774 	int result = 0;
26775 	ulong hval;
26776 	zval *offset;
26777 
26778 	SAVE_OPLINE();
26779 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
26780 
26781 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
26782 
26783 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
26784 		HashTable *ht;
26785 		int isset = 0;
26786 
26787 		ht = Z_ARRVAL_P(container);
26788 
26789 		switch (Z_TYPE_P(offset)) {
26790 			case IS_DOUBLE:
26791 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
26792 				goto num_index_prop;
26793 			case IS_RESOURCE:
26794 			case IS_BOOL:
26795 			case IS_LONG:
26796 				hval = Z_LVAL_P(offset);
26797 num_index_prop:
26798 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
26799 					isset = 1;
26800 				}
26801 				break;
26802 			case IS_STRING:
26803 				if (IS_TMP_VAR == IS_CONST) {
26804 					hval = Z_HASH_P(offset);
26805 				} else {
26806 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
26807 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
26808 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
26809 					} else {
26810 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
26811 					}
26812 				}
26813 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
26814 					isset = 1;
26815 				}
26816 				break;
26817 			case IS_NULL:
26818 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
26819 					isset = 1;
26820 				}
26821 				break;
26822 			default:
26823 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
26824 				break;
26825 		}
26826 
26827 		if (opline->extended_value & ZEND_ISSET) {
26828 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
26829 				result = 0;
26830 			} else {
26831 				result = isset;
26832 			}
26833 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
26834 			if (!isset || !i_zend_is_true(*value)) {
26835 				result = 0;
26836 			} else {
26837 				result = 1;
26838 			}
26839 		}
26840 		zval_dtor(free_op2.var);
26841 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
26842 		if (1) {
26843 			MAKE_REAL_ZVAL_PTR(offset);
26844 		}
26845 		if (prop_dim) {
26846 			if (Z_OBJ_HT_P(container)->has_property) {
26847 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
26848 			} else {
26849 				zend_error(E_NOTICE, "Trying to check property of non-object");
26850 				result = 0;
26851 			}
26852 		} else {
26853 			if (Z_OBJ_HT_P(container)->has_dimension) {
26854 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
26855 			} else {
26856 				zend_error(E_NOTICE, "Trying to check element of non-array");
26857 				result = 0;
26858 			}
26859 		}
26860 		if (1) {
26861 			zval_ptr_dtor(&offset);
26862 		} else {
26863 			zval_dtor(free_op2.var);
26864 		}
26865 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
26866 		zval tmp;
26867 
26868 		if (Z_TYPE_P(offset) != IS_LONG) {
26869 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
26870 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
26871 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
26872 				ZVAL_COPY_VALUE(&tmp, offset);
26873 				zval_copy_ctor(&tmp);
26874 				convert_to_long(&tmp);
26875 				offset = &tmp;
26876 			} else {
26877 				/* can not be converted to proper offset, return "not set" */
26878 				result = 0;
26879 			}
26880 		}
26881 		if (Z_TYPE_P(offset) == IS_LONG) {
26882 			if (opline->extended_value & ZEND_ISSET) {
26883 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
26884 					result = 1;
26885 				}
26886 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
26887 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
26888 					result = 1;
26889 				}
26890 			}
26891 		}
26892 		zval_dtor(free_op2.var);
26893 	} else {
26894 		zval_dtor(free_op2.var);
26895 	}
26896 
26897 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
26898 	if (opline->extended_value & ZEND_ISSET) {
26899 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
26900 	} else {
26901 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
26902 	}
26903 
26904 	CHECK_EXCEPTION();
26905 	ZEND_VM_NEXT_OPCODE();
26906 }
26907 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26908 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26909 {
26910 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26911 }
26912 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26913 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26914 {
26915 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
26916 }
26917 
ZEND_YIELD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)26918 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
26919 {
26920 	USE_OPLINE
26921 
26922 	/* The generator object is stored in return_value_ptr_ptr */
26923 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
26924 
26925 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
26926 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
26927 	}
26928 
26929 	/* Destroy the previously yielded value */
26930 	if (generator->value) {
26931 		zval_ptr_dtor(&generator->value);
26932 	}
26933 
26934 	/* Destroy the previously yielded key */
26935 	if (generator->key) {
26936 		zval_ptr_dtor(&generator->key);
26937 	}
26938 
26939 	/* Set the new yielded value */
26940 	if (IS_UNUSED != IS_UNUSED) {
26941 
26942 
26943 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
26944 			/* Constants and temporary variables aren't yieldable by reference,
26945 			 * but we still allow them with a notice. */
26946 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR) {
26947 				zval *value, *copy;
26948 
26949 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
26950 
26951 				value = NULL;
26952 				ALLOC_ZVAL(copy);
26953 				INIT_PZVAL_COPY(copy, value);
26954 
26955 				/* Temporary variables don't need ctor copying */
26956 				if (!0) {
26957 					zval_copy_ctor(copy);
26958 				}
26959 
26960 				generator->value = copy;
26961 			} else {
26962 				zval **value_ptr = NULL;
26963 
26964 				if (IS_UNUSED == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
26965 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
26966 				}
26967 
26968 				/* If a function call result is yielded and the function did
26969 				 * not return by reference we throw a notice. */
26970 				if (IS_UNUSED == IS_VAR && !Z_ISREF_PP(value_ptr)
26971 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
26972 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
26973 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
26974 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
26975 
26976 					Z_ADDREF_PP(value_ptr);
26977 					generator->value = *value_ptr;
26978 				} else {
26979 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
26980 					Z_ADDREF_PP(value_ptr);
26981 					generator->value = *value_ptr;
26982 				}
26983 
26984 			}
26985 		} else {
26986 			zval *value = NULL;
26987 
26988 			/* Consts, temporary variables and references need copying */
26989 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
26990 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
26991 			) {
26992 				zval *copy;
26993 
26994 				ALLOC_ZVAL(copy);
26995 				INIT_PZVAL_COPY(copy, value);
26996 
26997 				/* Temporary variables don't need ctor copying */
26998 				if (!0) {
26999 					zval_copy_ctor(copy);
27000 				}
27001 
27002 				generator->value = copy;
27003 			} else {
27004 				Z_ADDREF_P(value);
27005 				generator->value = value;
27006 			}
27007 
27008 		}
27009 	} else {
27010 		/* If no value was specified yield null */
27011 		Z_ADDREF(EG(uninitialized_zval));
27012 		generator->value = &EG(uninitialized_zval);
27013 	}
27014 
27015 	/* Set the new yielded key */
27016 	if (IS_TMP_VAR != IS_UNUSED) {
27017 		zend_free_op free_op2;
27018 		zval *key = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27019 
27020 		/* Consts, temporary variables and references need copying */
27021 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
27022 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
27023 		) {
27024 			zval *copy;
27025 
27026 			ALLOC_ZVAL(copy);
27027 			INIT_PZVAL_COPY(copy, key);
27028 
27029 			/* Temporary variables don't need ctor copying */
27030 			if (!1) {
27031 				zval_copy_ctor(copy);
27032 			}
27033 
27034 			generator->key = copy;
27035 		} else {
27036 			Z_ADDREF_P(key);
27037 			generator->key = key;
27038 		}
27039 
27040 		if (Z_TYPE_P(generator->key) == IS_LONG
27041 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
27042 		) {
27043 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
27044 		}
27045 
27046 	} else {
27047 		/* If no key was specified we use auto-increment keys */
27048 		generator->largest_used_integer_key++;
27049 
27050 		ALLOC_INIT_ZVAL(generator->key);
27051 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
27052 	}
27053 
27054 	if (RETURN_VALUE_USED(opline)) {
27055 		/* If the return value of yield is used set the send
27056 		 * target and initialize it to NULL */
27057 		generator->send_target = &EX_T(opline->result.var).var.ptr;
27058 		Z_ADDREF(EG(uninitialized_zval));
27059 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
27060 	} else {
27061 		generator->send_target = NULL;
27062 	}
27063 
27064 	/* We increment to the next op, so we are at the correct position when the
27065 	 * generator is resumed. */
27066 	ZEND_VM_INC_OPCODE();
27067 
27068 	/* The GOTO VM uses a local opline variable. We need to set the opline
27069 	 * variable in execute_data so we don't resume at an old position. */
27070 	SAVE_OPLINE();
27071 
27072 	ZEND_VM_RETURN();
27073 }
27074 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)27075 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
27076 {
27077 	USE_OPLINE
27078 	zend_free_op free_op2, free_op_data1;
27079 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27080 	zval *object;
27081 	zval *property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27082 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
27083 	int have_get_ptr = 0;
27084 
27085 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
27086 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
27087 	}
27088 
27089 	make_real_object(object_ptr TSRMLS_CC);
27090 	object = *object_ptr;
27091 
27092 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
27093 		zend_error(E_WARNING, "Attempt to assign property of non-object");
27094 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27095 		FREE_OP(free_op_data1);
27096 
27097 		if (RETURN_VALUE_USED(opline)) {
27098 			PZVAL_LOCK(&EG(uninitialized_zval));
27099 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
27100 			EX_T(opline->result.var).var.ptr_ptr = NULL;
27101 		}
27102 	} else {
27103 		/* here we are sure we are dealing with an object */
27104 		if (0) {
27105 			MAKE_REAL_ZVAL_PTR(property);
27106 		}
27107 
27108 		/* here property is a string */
27109 		if (opline->extended_value == ZEND_ASSIGN_OBJ
27110 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
27111 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27112 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
27113 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
27114 
27115 				have_get_ptr = 1;
27116 				binary_op(*zptr, *zptr, value TSRMLS_CC);
27117 				if (RETURN_VALUE_USED(opline)) {
27118 					PZVAL_LOCK(*zptr);
27119 					EX_T(opline->result.var).var.ptr = *zptr;
27120 					EX_T(opline->result.var).var.ptr_ptr = NULL;
27121 				}
27122 			}
27123 		}
27124 
27125 		if (!have_get_ptr) {
27126 			zval *z = NULL;
27127 
27128 			Z_ADDREF_P(object);
27129 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
27130 				if (Z_OBJ_HT_P(object)->read_property) {
27131 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27132 				}
27133 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
27134 				if (Z_OBJ_HT_P(object)->read_dimension) {
27135 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
27136 				}
27137 			}
27138 			if (z) {
27139 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
27140 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
27141 
27142 					if (Z_REFCOUNT_P(z) == 0) {
27143 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
27144 						zval_dtor(z);
27145 						FREE_ZVAL(z);
27146 					}
27147 					z = value;
27148 				}
27149 				Z_ADDREF_P(z);
27150 				SEPARATE_ZVAL_IF_NOT_REF(&z);
27151 				binary_op(z, z, value TSRMLS_CC);
27152 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
27153 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27154 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
27155 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
27156 				}
27157 				if (RETURN_VALUE_USED(opline)) {
27158 					PZVAL_LOCK(z);
27159 					EX_T(opline->result.var).var.ptr = z;
27160 					EX_T(opline->result.var).var.ptr_ptr = NULL;
27161 				}
27162 				zval_ptr_dtor(&z);
27163 			} else {
27164 				zend_error(E_WARNING, "Attempt to assign property of non-object");
27165 				if (RETURN_VALUE_USED(opline)) {
27166 					PZVAL_LOCK(&EG(uninitialized_zval));
27167 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
27168 					EX_T(opline->result.var).var.ptr_ptr = NULL;
27169 				}
27170 			}
27171 			zval_ptr_dtor(&object);
27172 		}
27173 
27174 		if (0) {
27175 			zval_ptr_dtor(&property);
27176 		} else {
27177 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27178 		}
27179 		FREE_OP(free_op_data1);
27180 	}
27181 
27182 	/* assign_obj has two opcodes! */
27183 	CHECK_EXCEPTION();
27184 	ZEND_VM_INC_OPCODE();
27185 	ZEND_VM_NEXT_OPCODE();
27186 }
27187 
zend_binary_assign_op_helper_SPEC_UNUSED_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)27188 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
27189 {
27190 	USE_OPLINE
27191 	zend_free_op free_op2, free_op_data2, free_op_data1;
27192 	zval **var_ptr;
27193 	zval *value;
27194 
27195 	SAVE_OPLINE();
27196 	switch (opline->extended_value) {
27197 		case ZEND_ASSIGN_OBJ:
27198 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27199 			break;
27200 		case ZEND_ASSIGN_DIM: {
27201 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27202 
27203 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
27204 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
27205 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
27206 					if (IS_UNUSED == IS_VAR && !0) {
27207 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
27208 					}
27209 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27210 				} else {
27211 					zval *dim = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27212 
27213 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
27214 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
27215 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
27216 				}
27217 			}
27218 			break;
27219 		default:
27220 			value = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27221 			var_ptr = NULL;
27222 			/* do nothing */
27223 			break;
27224 	}
27225 
27226 	if (UNEXPECTED(var_ptr == NULL)) {
27227 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
27228 	}
27229 
27230 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
27231 		if (RETURN_VALUE_USED(opline)) {
27232 			PZVAL_LOCK(&EG(uninitialized_zval));
27233 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
27234 		}
27235 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27236 
27237 		CHECK_EXCEPTION();
27238 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
27239 			ZEND_VM_INC_OPCODE();
27240 		}
27241 		ZEND_VM_NEXT_OPCODE();
27242 	}
27243 
27244 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
27245 
27246 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
27247 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
27248 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
27249 		/* proxy object */
27250 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
27251 		Z_ADDREF_P(objval);
27252 		binary_op(objval, objval, value TSRMLS_CC);
27253 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
27254 		zval_ptr_dtor(&objval);
27255 	} else {
27256 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
27257 	}
27258 
27259 	if (RETURN_VALUE_USED(opline)) {
27260 		PZVAL_LOCK(*var_ptr);
27261 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
27262 	}
27263 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27264 
27265 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
27266 		FREE_OP(free_op_data1);
27267 		FREE_OP_VAR_PTR(free_op_data2);
27268 
27269 		CHECK_EXCEPTION();
27270 		ZEND_VM_INC_OPCODE();
27271 	} else {
27272 
27273 		CHECK_EXCEPTION();
27274 	}
27275 	ZEND_VM_NEXT_OPCODE();
27276 }
27277 
ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27278 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27279 {
27280 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27281 }
27282 
ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27283 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27284 {
27285 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27286 }
27287 
ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27288 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27289 {
27290 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27291 }
27292 
ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27293 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27294 {
27295 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27296 }
27297 
ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27298 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27299 {
27300 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27301 }
27302 
ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27303 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27304 {
27305 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27306 }
27307 
ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27308 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27309 {
27310 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27311 }
27312 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27313 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27314 {
27315 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27316 }
27317 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27318 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27319 {
27320 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27321 }
27322 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27323 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27324 {
27325 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27326 }
27327 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27328 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27329 {
27330 	return zend_binary_assign_op_helper_SPEC_UNUSED_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27331 }
27332 
zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)27333 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
27334 {
27335 	USE_OPLINE
27336 	zend_free_op free_op2;
27337 	zval **object_ptr;
27338 	zval *object;
27339 	zval *property;
27340 	zval **retval;
27341 	int have_get_ptr = 0;
27342 
27343 	SAVE_OPLINE();
27344 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27345 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27346 	retval = &EX_T(opline->result.var).var.ptr;
27347 
27348 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
27349 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
27350 	}
27351 
27352 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
27353 	object = *object_ptr;
27354 
27355 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
27356 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
27357 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27358 		if (RETURN_VALUE_USED(opline)) {
27359 			PZVAL_LOCK(&EG(uninitialized_zval));
27360 			*retval = &EG(uninitialized_zval);
27361 		}
27362 
27363 		CHECK_EXCEPTION();
27364 		ZEND_VM_NEXT_OPCODE();
27365 	}
27366 
27367 	/* here we are sure we are dealing with an object */
27368 
27369 	if (0) {
27370 		MAKE_REAL_ZVAL_PTR(property);
27371 	}
27372 
27373 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
27374 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27375 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
27376 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
27377 
27378 			have_get_ptr = 1;
27379 			incdec_op(*zptr);
27380 			if (RETURN_VALUE_USED(opline)) {
27381 				*retval = *zptr;
27382 				PZVAL_LOCK(*retval);
27383 			}
27384 		}
27385 	}
27386 
27387 	if (!have_get_ptr) {
27388 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
27389 			zval *z;
27390 
27391 			Z_ADDREF_P(object);
27392 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27393 
27394 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
27395 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
27396 
27397 				if (Z_REFCOUNT_P(z) == 0) {
27398 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
27399 					zval_dtor(z);
27400 					FREE_ZVAL(z);
27401 				}
27402 				z = value;
27403 			}
27404 			Z_ADDREF_P(z);
27405 			SEPARATE_ZVAL_IF_NOT_REF(&z);
27406 			incdec_op(z);
27407 			*retval = z;
27408 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27409 			zval_ptr_dtor(&object);
27410 			SELECTIVE_PZVAL_LOCK(*retval, opline);
27411 			zval_ptr_dtor(&z);
27412 		} else {
27413 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
27414 			if (RETURN_VALUE_USED(opline)) {
27415 				PZVAL_LOCK(&EG(uninitialized_zval));
27416 				*retval = &EG(uninitialized_zval);
27417 			}
27418 		}
27419 	}
27420 
27421 	if (0) {
27422 		zval_ptr_dtor(&property);
27423 	} else {
27424 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27425 	}
27426 
27427 	CHECK_EXCEPTION();
27428 	ZEND_VM_NEXT_OPCODE();
27429 }
27430 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27431 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27432 {
27433 	return zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27434 }
27435 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27436 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27437 {
27438 	return zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27439 }
27440 
zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)27441 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
27442 {
27443 	USE_OPLINE
27444 	zend_free_op free_op2;
27445 	zval **object_ptr;
27446 	zval *object;
27447 	zval *property;
27448 	zval *retval;
27449 	int have_get_ptr = 0;
27450 
27451 	SAVE_OPLINE();
27452 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27453 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27454 	retval = &EX_T(opline->result.var).tmp_var;
27455 
27456 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
27457 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
27458 	}
27459 
27460 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
27461 	object = *object_ptr;
27462 
27463 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
27464 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
27465 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27466 		ZVAL_NULL(retval);
27467 
27468 		CHECK_EXCEPTION();
27469 		ZEND_VM_NEXT_OPCODE();
27470 	}
27471 
27472 	/* here we are sure we are dealing with an object */
27473 
27474 	if (0) {
27475 		MAKE_REAL_ZVAL_PTR(property);
27476 	}
27477 
27478 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
27479 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27480 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
27481 			have_get_ptr = 1;
27482 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
27483 
27484 			ZVAL_COPY_VALUE(retval, *zptr);
27485 			zendi_zval_copy_ctor(*retval);
27486 
27487 			incdec_op(*zptr);
27488 
27489 		}
27490 	}
27491 
27492 	if (!have_get_ptr) {
27493 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
27494 			zval *z, *z_copy;
27495 
27496 			Z_ADDREF_P(object);
27497 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27498 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
27499 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
27500 
27501 				if (Z_REFCOUNT_P(z) == 0) {
27502 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
27503 					zval_dtor(z);
27504 					FREE_ZVAL(z);
27505 				}
27506 				z = value;
27507 			}
27508 			ZVAL_COPY_VALUE(retval, z);
27509 			zendi_zval_copy_ctor(*retval);
27510 			ALLOC_ZVAL(z_copy);
27511 			INIT_PZVAL_COPY(z_copy, z);
27512 			zendi_zval_copy_ctor(*z_copy);
27513 			incdec_op(z_copy);
27514 			Z_ADDREF_P(z);
27515 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27516 			zval_ptr_dtor(&object);
27517 			zval_ptr_dtor(&z_copy);
27518 			zval_ptr_dtor(&z);
27519 		} else {
27520 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
27521 			ZVAL_NULL(retval);
27522 		}
27523 	}
27524 
27525 	if (0) {
27526 		zval_ptr_dtor(&property);
27527 	} else {
27528 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27529 	}
27530 
27531 	CHECK_EXCEPTION();
27532 	ZEND_VM_NEXT_OPCODE();
27533 }
27534 
ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27535 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27536 {
27537 	return zend_post_incdec_property_helper_SPEC_UNUSED_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27538 }
27539 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27540 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27541 {
27542 	return zend_post_incdec_property_helper_SPEC_UNUSED_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27543 }
27544 
zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS)27545 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS)
27546 {
27547 	USE_OPLINE
27548 
27549 	zval *container;
27550 	zend_free_op free_op2;
27551 	zval *offset;
27552 
27553 	SAVE_OPLINE();
27554 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
27555 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27556 
27557 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
27558 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
27559 		zend_error(E_NOTICE, "Trying to get property of non-object");
27560 		PZVAL_LOCK(&EG(uninitialized_zval));
27561 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
27562 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27563 	} else {
27564 		zval *retval;
27565 
27566 		if (0) {
27567 			MAKE_REAL_ZVAL_PTR(offset);
27568 		}
27569 
27570 		/* here we are sure we are dealing with an object */
27571 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27572 
27573 		PZVAL_LOCK(retval);
27574 		AI_SET_PTR(&EX_T(opline->result.var), retval);
27575 
27576 		if (0) {
27577 			zval_ptr_dtor(&offset);
27578 		} else {
27579 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27580 		}
27581 	}
27582 
27583 	CHECK_EXCEPTION();
27584 	ZEND_VM_NEXT_OPCODE();
27585 }
27586 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27587 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27588 {
27589 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27590 }
27591 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27592 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27593 {
27594 	USE_OPLINE
27595 	zend_free_op free_op1, free_op2;
27596 	zval *property;
27597 	zval **container;
27598 
27599 	SAVE_OPLINE();
27600 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27601 
27602 	if (0) {
27603 		MAKE_REAL_ZVAL_PTR(property);
27604 	}
27605 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27606 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
27607 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
27608 	}
27609 
27610 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
27611 	if (0) {
27612 		zval_ptr_dtor(&property);
27613 	} else {
27614 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27615 	}
27616 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
27617 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
27618 	}
27619 
27620 	/* We are going to assign the result by reference */
27621 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
27622 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
27623 
27624 		Z_DELREF_PP(retval_ptr);
27625 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
27626 		Z_ADDREF_PP(retval_ptr);
27627 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
27628 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
27629 	}
27630 
27631 	CHECK_EXCEPTION();
27632 	ZEND_VM_NEXT_OPCODE();
27633 }
27634 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27635 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27636 {
27637 	USE_OPLINE
27638 	zend_free_op free_op1, free_op2;
27639 	zval *property;
27640 	zval **container;
27641 
27642 	SAVE_OPLINE();
27643 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27644 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27645 
27646 	if (0) {
27647 		MAKE_REAL_ZVAL_PTR(property);
27648 	}
27649 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
27650 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
27651 	}
27652 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
27653 	if (0) {
27654 		zval_ptr_dtor(&property);
27655 	} else {
27656 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27657 	}
27658 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
27659 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
27660 	}
27661 
27662 	CHECK_EXCEPTION();
27663 	ZEND_VM_NEXT_OPCODE();
27664 }
27665 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27666 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27667 {
27668 	USE_OPLINE
27669 
27670 	zval *container;
27671 	zend_free_op free_op2;
27672 	zval *offset;
27673 
27674 	SAVE_OPLINE();
27675 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
27676 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27677 
27678 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
27679 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
27680 		PZVAL_LOCK(&EG(uninitialized_zval));
27681 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
27682 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27683 	} else {
27684 		zval *retval;
27685 
27686 		if (0) {
27687 			MAKE_REAL_ZVAL_PTR(offset);
27688 		}
27689 
27690 		/* here we are sure we are dealing with an object */
27691 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27692 
27693 		PZVAL_LOCK(retval);
27694 		AI_SET_PTR(&EX_T(opline->result.var), retval);
27695 
27696 		if (0) {
27697 			zval_ptr_dtor(&offset);
27698 		} else {
27699 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27700 		}
27701 	}
27702 
27703 	CHECK_EXCEPTION();
27704 	ZEND_VM_NEXT_OPCODE();
27705 }
27706 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27707 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27708 {
27709 	USE_OPLINE
27710 
27711 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
27712 		/* Behave like FETCH_OBJ_W */
27713 		zend_free_op free_op1, free_op2;
27714 		zval *property;
27715 		zval **container;
27716 
27717 		SAVE_OPLINE();
27718 		property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27719 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27720 
27721 		if (0) {
27722 			MAKE_REAL_ZVAL_PTR(property);
27723 		}
27724 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
27725 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
27726 		}
27727 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
27728 		if (0) {
27729 			zval_ptr_dtor(&property);
27730 		} else {
27731 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27732 		}
27733 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
27734 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
27735 		}
27736 
27737 		CHECK_EXCEPTION();
27738 		ZEND_VM_NEXT_OPCODE();
27739 	} else {
27740 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27741 	}
27742 }
27743 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27744 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27745 {
27746 	USE_OPLINE
27747 	zend_free_op free_op1, free_op2, free_res;
27748 	zval **container;
27749 	zval *property;
27750 
27751 	SAVE_OPLINE();
27752 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27753 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27754 
27755 	if (IS_UNUSED == IS_CV) {
27756 		if (container != &EG(uninitialized_zval_ptr)) {
27757 			SEPARATE_ZVAL_IF_NOT_REF(container);
27758 		}
27759 	}
27760 	if (0) {
27761 		MAKE_REAL_ZVAL_PTR(property);
27762 	}
27763 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
27764 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
27765 	}
27766 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
27767 	if (0) {
27768 		zval_ptr_dtor(&property);
27769 	} else {
27770 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27771 	}
27772 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
27773 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
27774 	}
27775 
27776 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
27777 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
27778 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
27779 	}
27780 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
27781 	FREE_OP_VAR_PTR(free_res);
27782 	CHECK_EXCEPTION();
27783 	ZEND_VM_NEXT_OPCODE();
27784 }
27785 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27786 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27787 {
27788 	USE_OPLINE
27789 	zend_free_op free_op2;
27790 	zval **object_ptr;
27791 	zval *property_name;
27792 
27793 	SAVE_OPLINE();
27794 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27795 	property_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27796 
27797 	if (0) {
27798 		MAKE_REAL_ZVAL_PTR(property_name);
27799 	}
27800 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
27801 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
27802 	}
27803 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
27804 	if (0) {
27805 		zval_ptr_dtor(&property_name);
27806 	} else {
27807 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27808 	}
27809 
27810 	/* assign_obj has two opcodes! */
27811 	CHECK_EXCEPTION();
27812 	ZEND_VM_INC_OPCODE();
27813 	ZEND_VM_NEXT_OPCODE();
27814 }
27815 
ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27816 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27817 {
27818 	USE_OPLINE
27819 	zend_free_op free_op2;
27820 	zval *str = &EX_T(opline->result.var).tmp_var;
27821 	zval *var;
27822 	zval var_copy;
27823 	int use_copy = 0;
27824 
27825 	SAVE_OPLINE();
27826 	var = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27827 
27828 	if (IS_UNUSED == IS_UNUSED) {
27829 		/* Initialize for erealloc in add_string_to_string */
27830 		Z_STRVAL_P(str) = NULL;
27831 		Z_STRLEN_P(str) = 0;
27832 		Z_TYPE_P(str) = IS_STRING;
27833 
27834 		INIT_PZVAL(str);
27835 	}
27836 
27837 	if (Z_TYPE_P(var) != IS_STRING) {
27838 		zend_make_printable_zval(var, &var_copy, &use_copy);
27839 
27840 		if (use_copy) {
27841 			var = &var_copy;
27842 		}
27843 	}
27844 	add_string_to_string(str, str, var);
27845 
27846 	if (use_copy) {
27847 		zval_dtor(var);
27848 	}
27849 	/* original comment, possibly problematic:
27850 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
27851 	 * (Zeev):  I don't think it's problematic, we only use variables
27852 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
27853 	 * string offsets or overloaded objects
27854 	 */
27855 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27856 
27857 	CHECK_EXCEPTION();
27858 	ZEND_VM_NEXT_OPCODE();
27859 }
27860 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27861 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27862 {
27863 	USE_OPLINE
27864 	zval *function_name;
27865 	char *function_name_strval;
27866 	int function_name_strlen;
27867 	zend_free_op free_op2;
27868 	call_slot *call = EX(call_slots) + opline->result.num;
27869 
27870 	SAVE_OPLINE();
27871 
27872 	function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27873 
27874 	if (IS_VAR != IS_CONST &&
27875 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
27876 		if (UNEXPECTED(EG(exception) != NULL)) {
27877 			HANDLE_EXCEPTION();
27878 		}
27879 		zend_error_noreturn(E_ERROR, "Method name must be a string");
27880 	}
27881 
27882 	function_name_strval = Z_STRVAL_P(function_name);
27883 	function_name_strlen = Z_STRLEN_P(function_name);
27884 
27885 	call->object = _get_obj_zval_ptr_unused(TSRMLS_C);
27886 
27887 	if (EXPECTED(call->object != NULL) &&
27888 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
27889 		call->called_scope = Z_OBJCE_P(call->object);
27890 
27891 		if (IS_VAR != IS_CONST ||
27892 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
27893 		    zval *object = call->object;
27894 
27895 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
27896 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
27897 			}
27898 
27899 			/* First, locate the function. */
27900 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
27901 			if (UNEXPECTED(call->fbc == NULL)) {
27902 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
27903 			}
27904 			if (IS_VAR == IS_CONST &&
27905 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
27906 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
27907 			    EXPECTED(call->object == object)) {
27908 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
27909 			}
27910 		}
27911 	} else {
27912 		if (UNEXPECTED(EG(exception) != NULL)) {
27913 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27914 			HANDLE_EXCEPTION();
27915 		}
27916 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
27917 	}
27918 
27919 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
27920 		call->object = NULL;
27921 	} else {
27922 		if (!PZVAL_IS_REF(call->object)) {
27923 			Z_ADDREF_P(call->object); /* For $this pointer */
27924 		} else {
27925 			zval *this_ptr;
27926 			ALLOC_ZVAL(this_ptr);
27927 			INIT_PZVAL_COPY(this_ptr, call->object);
27928 			zval_copy_ctor(this_ptr);
27929 			call->object = this_ptr;
27930 		}
27931 	}
27932 	call->is_ctor_call = 0;
27933 	EX(call) = call;
27934 
27935 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
27936 
27937 	CHECK_EXCEPTION();
27938 	ZEND_VM_NEXT_OPCODE();
27939 }
27940 
ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27941 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27942 {
27943 	USE_OPLINE
27944 
27945 	array_init(&EX_T(opline->result.var).tmp_var);
27946 	if (IS_UNUSED == IS_UNUSED) {
27947 		ZEND_VM_NEXT_OPCODE();
27948 #if 0 || IS_UNUSED != IS_UNUSED
27949 	} else {
27950 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
27951 #endif
27952 	}
27953 }
27954 
ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)27955 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
27956 {
27957 	USE_OPLINE
27958 	zend_free_op free_op2;
27959 	zval **container;
27960 	zval *offset;
27961 	ulong hval;
27962 
27963 	SAVE_OPLINE();
27964 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
27965 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
27966 		SEPARATE_ZVAL_IF_NOT_REF(container);
27967 	}
27968 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
27969 
27970 	if (IS_UNUSED != IS_VAR || container) {
27971 		switch (Z_TYPE_PP(container)) {
27972 			case IS_ARRAY: {
27973 				HashTable *ht = Z_ARRVAL_PP(container);
27974 
27975 				switch (Z_TYPE_P(offset)) {
27976 					case IS_DOUBLE:
27977 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
27978 						zend_hash_index_del(ht, hval);
27979 						break;
27980 					case IS_RESOURCE:
27981 					case IS_BOOL:
27982 					case IS_LONG:
27983 						hval = Z_LVAL_P(offset);
27984 						zend_hash_index_del(ht, hval);
27985 						break;
27986 					case IS_STRING:
27987 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
27988 							Z_ADDREF_P(offset);
27989 						}
27990 						if (IS_VAR == IS_CONST) {
27991 							hval = Z_HASH_P(offset);
27992 						} else {
27993 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
27994 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
27995 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
27996 							} else {
27997 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
27998 							}
27999 						}
28000 						if (ht == &EG(symbol_table)) {
28001 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
28002 						} else {
28003 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
28004 						}
28005 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
28006 							zval_ptr_dtor(&offset);
28007 						}
28008 						break;
28009 num_index_dim:
28010 						zend_hash_index_del(ht, hval);
28011 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
28012 							zval_ptr_dtor(&offset);
28013 						}
28014 						break;
28015 					case IS_NULL:
28016 						zend_hash_del(ht, "", sizeof(""));
28017 						break;
28018 					default:
28019 						zend_error(E_WARNING, "Illegal offset type in unset");
28020 						break;
28021 				}
28022 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28023 				break;
28024 			}
28025 			case IS_OBJECT:
28026 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
28027 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
28028 				}
28029 				if (0) {
28030 					MAKE_REAL_ZVAL_PTR(offset);
28031 				}
28032 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
28033 				if (0) {
28034 					zval_ptr_dtor(&offset);
28035 				} else {
28036 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28037 				}
28038 				break;
28039 			case IS_STRING:
28040 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
28041 				ZEND_VM_CONTINUE(); /* bailed out before */
28042 			default:
28043 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28044 				break;
28045 		}
28046 	} else {
28047 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28048 	}
28049 
28050 	CHECK_EXCEPTION();
28051 	ZEND_VM_NEXT_OPCODE();
28052 }
28053 
ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28054 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28055 {
28056 	USE_OPLINE
28057 	zend_free_op free_op2;
28058 	zval **container;
28059 	zval *offset;
28060 
28061 	SAVE_OPLINE();
28062 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
28063 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
28064 
28065 	if (IS_UNUSED != IS_VAR || container) {
28066 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
28067 			SEPARATE_ZVAL_IF_NOT_REF(container);
28068 		}
28069 		if (Z_TYPE_PP(container) == IS_OBJECT) {
28070 			if (0) {
28071 				MAKE_REAL_ZVAL_PTR(offset);
28072 			}
28073 			if (Z_OBJ_HT_P(*container)->unset_property) {
28074 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28075 			} else {
28076 				zend_error(E_NOTICE, "Trying to unset property of non-object");
28077 			}
28078 			if (0) {
28079 				zval_ptr_dtor(&offset);
28080 			} else {
28081 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28082 			}
28083 		} else {
28084 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28085 		}
28086 	} else {
28087 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28088 	}
28089 
28090 	CHECK_EXCEPTION();
28091 	ZEND_VM_NEXT_OPCODE();
28092 }
28093 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)28094 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
28095 {
28096 	USE_OPLINE
28097 	zend_free_op free_op2;
28098 	zval *container;
28099 	zval **value = NULL;
28100 	int result = 0;
28101 	ulong hval;
28102 	zval *offset;
28103 
28104 	SAVE_OPLINE();
28105 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
28106 
28107 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
28108 
28109 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
28110 		HashTable *ht;
28111 		int isset = 0;
28112 
28113 		ht = Z_ARRVAL_P(container);
28114 
28115 		switch (Z_TYPE_P(offset)) {
28116 			case IS_DOUBLE:
28117 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
28118 				goto num_index_prop;
28119 			case IS_RESOURCE:
28120 			case IS_BOOL:
28121 			case IS_LONG:
28122 				hval = Z_LVAL_P(offset);
28123 num_index_prop:
28124 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
28125 					isset = 1;
28126 				}
28127 				break;
28128 			case IS_STRING:
28129 				if (IS_VAR == IS_CONST) {
28130 					hval = Z_HASH_P(offset);
28131 				} else {
28132 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
28133 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
28134 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
28135 					} else {
28136 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
28137 					}
28138 				}
28139 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
28140 					isset = 1;
28141 				}
28142 				break;
28143 			case IS_NULL:
28144 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
28145 					isset = 1;
28146 				}
28147 				break;
28148 			default:
28149 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
28150 				break;
28151 		}
28152 
28153 		if (opline->extended_value & ZEND_ISSET) {
28154 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
28155 				result = 0;
28156 			} else {
28157 				result = isset;
28158 			}
28159 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
28160 			if (!isset || !i_zend_is_true(*value)) {
28161 				result = 0;
28162 			} else {
28163 				result = 1;
28164 			}
28165 		}
28166 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28167 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
28168 		if (0) {
28169 			MAKE_REAL_ZVAL_PTR(offset);
28170 		}
28171 		if (prop_dim) {
28172 			if (Z_OBJ_HT_P(container)->has_property) {
28173 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28174 			} else {
28175 				zend_error(E_NOTICE, "Trying to check property of non-object");
28176 				result = 0;
28177 			}
28178 		} else {
28179 			if (Z_OBJ_HT_P(container)->has_dimension) {
28180 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
28181 			} else {
28182 				zend_error(E_NOTICE, "Trying to check element of non-array");
28183 				result = 0;
28184 			}
28185 		}
28186 		if (0) {
28187 			zval_ptr_dtor(&offset);
28188 		} else {
28189 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28190 		}
28191 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
28192 		zval tmp;
28193 
28194 		if (Z_TYPE_P(offset) != IS_LONG) {
28195 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
28196 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
28197 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
28198 				ZVAL_COPY_VALUE(&tmp, offset);
28199 				zval_copy_ctor(&tmp);
28200 				convert_to_long(&tmp);
28201 				offset = &tmp;
28202 			} else {
28203 				/* can not be converted to proper offset, return "not set" */
28204 				result = 0;
28205 			}
28206 		}
28207 		if (Z_TYPE_P(offset) == IS_LONG) {
28208 			if (opline->extended_value & ZEND_ISSET) {
28209 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
28210 					result = 1;
28211 				}
28212 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
28213 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
28214 					result = 1;
28215 				}
28216 			}
28217 		}
28218 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28219 	} else {
28220 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28221 	}
28222 
28223 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
28224 	if (opline->extended_value & ZEND_ISSET) {
28225 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
28226 	} else {
28227 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
28228 	}
28229 
28230 	CHECK_EXCEPTION();
28231 	ZEND_VM_NEXT_OPCODE();
28232 }
28233 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28234 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28235 {
28236 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28237 }
28238 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28239 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28240 {
28241 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28242 }
28243 
ZEND_YIELD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28244 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28245 {
28246 	USE_OPLINE
28247 
28248 	/* The generator object is stored in return_value_ptr_ptr */
28249 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
28250 
28251 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
28252 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
28253 	}
28254 
28255 	/* Destroy the previously yielded value */
28256 	if (generator->value) {
28257 		zval_ptr_dtor(&generator->value);
28258 	}
28259 
28260 	/* Destroy the previously yielded key */
28261 	if (generator->key) {
28262 		zval_ptr_dtor(&generator->key);
28263 	}
28264 
28265 	/* Set the new yielded value */
28266 	if (IS_UNUSED != IS_UNUSED) {
28267 
28268 
28269 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
28270 			/* Constants and temporary variables aren't yieldable by reference,
28271 			 * but we still allow them with a notice. */
28272 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR) {
28273 				zval *value, *copy;
28274 
28275 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
28276 
28277 				value = NULL;
28278 				ALLOC_ZVAL(copy);
28279 				INIT_PZVAL_COPY(copy, value);
28280 
28281 				/* Temporary variables don't need ctor copying */
28282 				if (!0) {
28283 					zval_copy_ctor(copy);
28284 				}
28285 
28286 				generator->value = copy;
28287 			} else {
28288 				zval **value_ptr = NULL;
28289 
28290 				if (IS_UNUSED == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
28291 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
28292 				}
28293 
28294 				/* If a function call result is yielded and the function did
28295 				 * not return by reference we throw a notice. */
28296 				if (IS_UNUSED == IS_VAR && !Z_ISREF_PP(value_ptr)
28297 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
28298 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
28299 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
28300 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
28301 
28302 					Z_ADDREF_PP(value_ptr);
28303 					generator->value = *value_ptr;
28304 				} else {
28305 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
28306 					Z_ADDREF_PP(value_ptr);
28307 					generator->value = *value_ptr;
28308 				}
28309 
28310 			}
28311 		} else {
28312 			zval *value = NULL;
28313 
28314 			/* Consts, temporary variables and references need copying */
28315 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
28316 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
28317 			) {
28318 				zval *copy;
28319 
28320 				ALLOC_ZVAL(copy);
28321 				INIT_PZVAL_COPY(copy, value);
28322 
28323 				/* Temporary variables don't need ctor copying */
28324 				if (!0) {
28325 					zval_copy_ctor(copy);
28326 				}
28327 
28328 				generator->value = copy;
28329 			} else {
28330 				Z_ADDREF_P(value);
28331 				generator->value = value;
28332 			}
28333 
28334 		}
28335 	} else {
28336 		/* If no value was specified yield null */
28337 		Z_ADDREF(EG(uninitialized_zval));
28338 		generator->value = &EG(uninitialized_zval);
28339 	}
28340 
28341 	/* Set the new yielded key */
28342 	if (IS_VAR != IS_UNUSED) {
28343 		zend_free_op free_op2;
28344 		zval *key = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
28345 
28346 		/* Consts, temporary variables and references need copying */
28347 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
28348 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
28349 		) {
28350 			zval *copy;
28351 
28352 			ALLOC_ZVAL(copy);
28353 			INIT_PZVAL_COPY(copy, key);
28354 
28355 			/* Temporary variables don't need ctor copying */
28356 			if (!0) {
28357 				zval_copy_ctor(copy);
28358 			}
28359 
28360 			generator->key = copy;
28361 		} else {
28362 			Z_ADDREF_P(key);
28363 			generator->key = key;
28364 		}
28365 
28366 		if (Z_TYPE_P(generator->key) == IS_LONG
28367 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
28368 		) {
28369 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
28370 		}
28371 
28372 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
28373 	} else {
28374 		/* If no key was specified we use auto-increment keys */
28375 		generator->largest_used_integer_key++;
28376 
28377 		ALLOC_INIT_ZVAL(generator->key);
28378 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
28379 	}
28380 
28381 	if (RETURN_VALUE_USED(opline)) {
28382 		/* If the return value of yield is used set the send
28383 		 * target and initialize it to NULL */
28384 		generator->send_target = &EX_T(opline->result.var).var.ptr;
28385 		Z_ADDREF(EG(uninitialized_zval));
28386 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28387 	} else {
28388 		generator->send_target = NULL;
28389 	}
28390 
28391 	/* We increment to the next op, so we are at the correct position when the
28392 	 * generator is resumed. */
28393 	ZEND_VM_INC_OPCODE();
28394 
28395 	/* The GOTO VM uses a local opline variable. We need to set the opline
28396 	 * variable in execute_data so we don't resume at an old position. */
28397 	SAVE_OPLINE();
28398 
28399 	ZEND_VM_RETURN();
28400 }
28401 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28402 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28403 {
28404 	USE_OPLINE
28405 	zend_free_op free_op_data1;
28406 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
28407 	zval *object;
28408 	zval *property = NULL;
28409 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
28410 	int have_get_ptr = 0;
28411 
28412 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
28413 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
28414 	}
28415 
28416 	make_real_object(object_ptr TSRMLS_CC);
28417 	object = *object_ptr;
28418 
28419 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
28420 		zend_error(E_WARNING, "Attempt to assign property of non-object");
28421 
28422 		FREE_OP(free_op_data1);
28423 
28424 		if (RETURN_VALUE_USED(opline)) {
28425 			PZVAL_LOCK(&EG(uninitialized_zval));
28426 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28427 			EX_T(opline->result.var).var.ptr_ptr = NULL;
28428 		}
28429 	} else {
28430 		/* here we are sure we are dealing with an object */
28431 		if (0) {
28432 			MAKE_REAL_ZVAL_PTR(property);
28433 		}
28434 
28435 		/* here property is a string */
28436 		if (opline->extended_value == ZEND_ASSIGN_OBJ
28437 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
28438 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28439 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
28440 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
28441 
28442 				have_get_ptr = 1;
28443 				binary_op(*zptr, *zptr, value TSRMLS_CC);
28444 				if (RETURN_VALUE_USED(opline)) {
28445 					PZVAL_LOCK(*zptr);
28446 					EX_T(opline->result.var).var.ptr = *zptr;
28447 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28448 				}
28449 			}
28450 		}
28451 
28452 		if (!have_get_ptr) {
28453 			zval *z = NULL;
28454 
28455 			Z_ADDREF_P(object);
28456 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28457 				if (Z_OBJ_HT_P(object)->read_property) {
28458 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28459 				}
28460 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28461 				if (Z_OBJ_HT_P(object)->read_dimension) {
28462 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
28463 				}
28464 			}
28465 			if (z) {
28466 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
28467 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
28468 
28469 					if (Z_REFCOUNT_P(z) == 0) {
28470 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
28471 						zval_dtor(z);
28472 						FREE_ZVAL(z);
28473 					}
28474 					z = value;
28475 				}
28476 				Z_ADDREF_P(z);
28477 				SEPARATE_ZVAL_IF_NOT_REF(&z);
28478 				binary_op(z, z, value TSRMLS_CC);
28479 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28480 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28481 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28482 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
28483 				}
28484 				if (RETURN_VALUE_USED(opline)) {
28485 					PZVAL_LOCK(z);
28486 					EX_T(opline->result.var).var.ptr = z;
28487 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28488 				}
28489 				zval_ptr_dtor(&z);
28490 			} else {
28491 				zend_error(E_WARNING, "Attempt to assign property of non-object");
28492 				if (RETURN_VALUE_USED(opline)) {
28493 					PZVAL_LOCK(&EG(uninitialized_zval));
28494 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28495 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28496 				}
28497 			}
28498 			zval_ptr_dtor(&object);
28499 		}
28500 
28501 		if (0) {
28502 			zval_ptr_dtor(&property);
28503 		} else {
28504 
28505 		}
28506 		FREE_OP(free_op_data1);
28507 	}
28508 
28509 	/* assign_obj has two opcodes! */
28510 	CHECK_EXCEPTION();
28511 	ZEND_VM_INC_OPCODE();
28512 	ZEND_VM_NEXT_OPCODE();
28513 }
28514 
zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28515 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28516 {
28517 	USE_OPLINE
28518 	zend_free_op free_op_data2, free_op_data1;
28519 	zval **var_ptr;
28520 	zval *value;
28521 
28522 	SAVE_OPLINE();
28523 	switch (opline->extended_value) {
28524 		case ZEND_ASSIGN_OBJ:
28525 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28526 			break;
28527 		case ZEND_ASSIGN_DIM: {
28528 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
28529 
28530 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
28531 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28532 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
28533 					if (IS_UNUSED == IS_VAR && !0) {
28534 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
28535 					}
28536 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28537 				} else {
28538 					zval *dim = NULL;
28539 
28540 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
28541 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
28542 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
28543 				}
28544 			}
28545 			break;
28546 		default:
28547 			value = NULL;
28548 			var_ptr = NULL;
28549 			/* do nothing */
28550 			break;
28551 	}
28552 
28553 	if (UNEXPECTED(var_ptr == NULL)) {
28554 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
28555 	}
28556 
28557 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
28558 		if (RETURN_VALUE_USED(opline)) {
28559 			PZVAL_LOCK(&EG(uninitialized_zval));
28560 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
28561 		}
28562 
28563 
28564 		CHECK_EXCEPTION();
28565 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
28566 			ZEND_VM_INC_OPCODE();
28567 		}
28568 		ZEND_VM_NEXT_OPCODE();
28569 	}
28570 
28571 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
28572 
28573 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
28574 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
28575 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
28576 		/* proxy object */
28577 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
28578 		Z_ADDREF_P(objval);
28579 		binary_op(objval, objval, value TSRMLS_CC);
28580 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
28581 		zval_ptr_dtor(&objval);
28582 	} else {
28583 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
28584 	}
28585 
28586 	if (RETURN_VALUE_USED(opline)) {
28587 		PZVAL_LOCK(*var_ptr);
28588 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
28589 	}
28590 
28591 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
28592 		FREE_OP(free_op_data1);
28593 		FREE_OP_VAR_PTR(free_op_data2);
28594 
28595 		CHECK_EXCEPTION();
28596 		ZEND_VM_INC_OPCODE();
28597 	} else {
28598 
28599 		CHECK_EXCEPTION();
28600 	}
28601 	ZEND_VM_NEXT_OPCODE();
28602 }
28603 
ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28604 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28605 {
28606 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28607 }
28608 
ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28609 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28610 {
28611 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28612 }
28613 
ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28614 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28615 {
28616 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28617 }
28618 
ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28619 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28620 {
28621 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28622 }
28623 
ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28624 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28625 {
28626 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28627 }
28628 
ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28629 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28630 {
28631 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28632 }
28633 
ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28634 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28635 {
28636 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28637 }
28638 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28639 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28640 {
28641 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28642 }
28643 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28644 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28645 {
28646 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28647 }
28648 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28649 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28650 {
28651 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28652 }
28653 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28654 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28655 {
28656 	return zend_binary_assign_op_helper_SPEC_UNUSED_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28657 }
28658 
ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28659 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28660 {
28661 	USE_OPLINE
28662 
28663 	array_init(&EX_T(opline->result.var).tmp_var);
28664 	if (IS_UNUSED == IS_UNUSED) {
28665 		ZEND_VM_NEXT_OPCODE();
28666 #if 0 || IS_UNUSED != IS_UNUSED
28667 	} else {
28668 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28669 #endif
28670 	}
28671 }
28672 
ZEND_YIELD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)28673 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
28674 {
28675 	USE_OPLINE
28676 
28677 	/* The generator object is stored in return_value_ptr_ptr */
28678 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
28679 
28680 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
28681 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
28682 	}
28683 
28684 	/* Destroy the previously yielded value */
28685 	if (generator->value) {
28686 		zval_ptr_dtor(&generator->value);
28687 	}
28688 
28689 	/* Destroy the previously yielded key */
28690 	if (generator->key) {
28691 		zval_ptr_dtor(&generator->key);
28692 	}
28693 
28694 	/* Set the new yielded value */
28695 	if (IS_UNUSED != IS_UNUSED) {
28696 
28697 
28698 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
28699 			/* Constants and temporary variables aren't yieldable by reference,
28700 			 * but we still allow them with a notice. */
28701 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR) {
28702 				zval *value, *copy;
28703 
28704 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
28705 
28706 				value = NULL;
28707 				ALLOC_ZVAL(copy);
28708 				INIT_PZVAL_COPY(copy, value);
28709 
28710 				/* Temporary variables don't need ctor copying */
28711 				if (!0) {
28712 					zval_copy_ctor(copy);
28713 				}
28714 
28715 				generator->value = copy;
28716 			} else {
28717 				zval **value_ptr = NULL;
28718 
28719 				if (IS_UNUSED == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
28720 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
28721 				}
28722 
28723 				/* If a function call result is yielded and the function did
28724 				 * not return by reference we throw a notice. */
28725 				if (IS_UNUSED == IS_VAR && !Z_ISREF_PP(value_ptr)
28726 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
28727 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
28728 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
28729 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
28730 
28731 					Z_ADDREF_PP(value_ptr);
28732 					generator->value = *value_ptr;
28733 				} else {
28734 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
28735 					Z_ADDREF_PP(value_ptr);
28736 					generator->value = *value_ptr;
28737 				}
28738 
28739 			}
28740 		} else {
28741 			zval *value = NULL;
28742 
28743 			/* Consts, temporary variables and references need copying */
28744 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
28745 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
28746 			) {
28747 				zval *copy;
28748 
28749 				ALLOC_ZVAL(copy);
28750 				INIT_PZVAL_COPY(copy, value);
28751 
28752 				/* Temporary variables don't need ctor copying */
28753 				if (!0) {
28754 					zval_copy_ctor(copy);
28755 				}
28756 
28757 				generator->value = copy;
28758 			} else {
28759 				Z_ADDREF_P(value);
28760 				generator->value = value;
28761 			}
28762 
28763 		}
28764 	} else {
28765 		/* If no value was specified yield null */
28766 		Z_ADDREF(EG(uninitialized_zval));
28767 		generator->value = &EG(uninitialized_zval);
28768 	}
28769 
28770 	/* Set the new yielded key */
28771 	if (IS_UNUSED != IS_UNUSED) {
28772 
28773 		zval *key = NULL;
28774 
28775 		/* Consts, temporary variables and references need copying */
28776 		if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
28777 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
28778 		) {
28779 			zval *copy;
28780 
28781 			ALLOC_ZVAL(copy);
28782 			INIT_PZVAL_COPY(copy, key);
28783 
28784 			/* Temporary variables don't need ctor copying */
28785 			if (!0) {
28786 				zval_copy_ctor(copy);
28787 			}
28788 
28789 			generator->key = copy;
28790 		} else {
28791 			Z_ADDREF_P(key);
28792 			generator->key = key;
28793 		}
28794 
28795 		if (Z_TYPE_P(generator->key) == IS_LONG
28796 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
28797 		) {
28798 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
28799 		}
28800 
28801 	} else {
28802 		/* If no key was specified we use auto-increment keys */
28803 		generator->largest_used_integer_key++;
28804 
28805 		ALLOC_INIT_ZVAL(generator->key);
28806 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
28807 	}
28808 
28809 	if (RETURN_VALUE_USED(opline)) {
28810 		/* If the return value of yield is used set the send
28811 		 * target and initialize it to NULL */
28812 		generator->send_target = &EX_T(opline->result.var).var.ptr;
28813 		Z_ADDREF(EG(uninitialized_zval));
28814 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28815 	} else {
28816 		generator->send_target = NULL;
28817 	}
28818 
28819 	/* We increment to the next op, so we are at the correct position when the
28820 	 * generator is resumed. */
28821 	ZEND_VM_INC_OPCODE();
28822 
28823 	/* The GOTO VM uses a local opline variable. We need to set the opline
28824 	 * variable in execute_data so we don't resume at an old position. */
28825 	SAVE_OPLINE();
28826 
28827 	ZEND_VM_RETURN();
28828 }
28829 
zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28830 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28831 {
28832 	USE_OPLINE
28833 	zend_free_op free_op_data1;
28834 	zval **object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
28835 	zval *object;
28836 	zval *property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
28837 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
28838 	int have_get_ptr = 0;
28839 
28840 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
28841 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
28842 	}
28843 
28844 	make_real_object(object_ptr TSRMLS_CC);
28845 	object = *object_ptr;
28846 
28847 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
28848 		zend_error(E_WARNING, "Attempt to assign property of non-object");
28849 
28850 		FREE_OP(free_op_data1);
28851 
28852 		if (RETURN_VALUE_USED(opline)) {
28853 			PZVAL_LOCK(&EG(uninitialized_zval));
28854 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28855 			EX_T(opline->result.var).var.ptr_ptr = NULL;
28856 		}
28857 	} else {
28858 		/* here we are sure we are dealing with an object */
28859 		if (0) {
28860 			MAKE_REAL_ZVAL_PTR(property);
28861 		}
28862 
28863 		/* here property is a string */
28864 		if (opline->extended_value == ZEND_ASSIGN_OBJ
28865 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
28866 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28867 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
28868 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
28869 
28870 				have_get_ptr = 1;
28871 				binary_op(*zptr, *zptr, value TSRMLS_CC);
28872 				if (RETURN_VALUE_USED(opline)) {
28873 					PZVAL_LOCK(*zptr);
28874 					EX_T(opline->result.var).var.ptr = *zptr;
28875 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28876 				}
28877 			}
28878 		}
28879 
28880 		if (!have_get_ptr) {
28881 			zval *z = NULL;
28882 
28883 			Z_ADDREF_P(object);
28884 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28885 				if (Z_OBJ_HT_P(object)->read_property) {
28886 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28887 				}
28888 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28889 				if (Z_OBJ_HT_P(object)->read_dimension) {
28890 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
28891 				}
28892 			}
28893 			if (z) {
28894 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
28895 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
28896 
28897 					if (Z_REFCOUNT_P(z) == 0) {
28898 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
28899 						zval_dtor(z);
28900 						FREE_ZVAL(z);
28901 					}
28902 					z = value;
28903 				}
28904 				Z_ADDREF_P(z);
28905 				SEPARATE_ZVAL_IF_NOT_REF(&z);
28906 				binary_op(z, z, value TSRMLS_CC);
28907 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
28908 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
28909 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
28910 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
28911 				}
28912 				if (RETURN_VALUE_USED(opline)) {
28913 					PZVAL_LOCK(z);
28914 					EX_T(opline->result.var).var.ptr = z;
28915 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28916 				}
28917 				zval_ptr_dtor(&z);
28918 			} else {
28919 				zend_error(E_WARNING, "Attempt to assign property of non-object");
28920 				if (RETURN_VALUE_USED(opline)) {
28921 					PZVAL_LOCK(&EG(uninitialized_zval));
28922 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
28923 					EX_T(opline->result.var).var.ptr_ptr = NULL;
28924 				}
28925 			}
28926 			zval_ptr_dtor(&object);
28927 		}
28928 
28929 		if (0) {
28930 			zval_ptr_dtor(&property);
28931 		} else {
28932 
28933 		}
28934 		FREE_OP(free_op_data1);
28935 	}
28936 
28937 	/* assign_obj has two opcodes! */
28938 	CHECK_EXCEPTION();
28939 	ZEND_VM_INC_OPCODE();
28940 	ZEND_VM_NEXT_OPCODE();
28941 }
28942 
zend_binary_assign_op_helper_SPEC_UNUSED_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)28943 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_UNUSED_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
28944 {
28945 	USE_OPLINE
28946 	zend_free_op free_op_data2, free_op_data1;
28947 	zval **var_ptr;
28948 	zval *value;
28949 
28950 	SAVE_OPLINE();
28951 	switch (opline->extended_value) {
28952 		case ZEND_ASSIGN_OBJ:
28953 			return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28954 			break;
28955 		case ZEND_ASSIGN_DIM: {
28956 				zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
28957 
28958 				if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
28959 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
28960 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
28961 					if (IS_UNUSED == IS_VAR && !0) {
28962 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
28963 					}
28964 					return zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
28965 				} else {
28966 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
28967 
28968 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
28969 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
28970 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
28971 				}
28972 			}
28973 			break;
28974 		default:
28975 			value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
28976 			var_ptr = NULL;
28977 			/* do nothing */
28978 			break;
28979 	}
28980 
28981 	if (UNEXPECTED(var_ptr == NULL)) {
28982 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
28983 	}
28984 
28985 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
28986 		if (RETURN_VALUE_USED(opline)) {
28987 			PZVAL_LOCK(&EG(uninitialized_zval));
28988 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
28989 		}
28990 
28991 
28992 		CHECK_EXCEPTION();
28993 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
28994 			ZEND_VM_INC_OPCODE();
28995 		}
28996 		ZEND_VM_NEXT_OPCODE();
28997 	}
28998 
28999 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
29000 
29001 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
29002 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
29003 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
29004 		/* proxy object */
29005 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
29006 		Z_ADDREF_P(objval);
29007 		binary_op(objval, objval, value TSRMLS_CC);
29008 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
29009 		zval_ptr_dtor(&objval);
29010 	} else {
29011 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
29012 	}
29013 
29014 	if (RETURN_VALUE_USED(opline)) {
29015 		PZVAL_LOCK(*var_ptr);
29016 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
29017 	}
29018 
29019 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
29020 		FREE_OP(free_op_data1);
29021 		FREE_OP_VAR_PTR(free_op_data2);
29022 
29023 		CHECK_EXCEPTION();
29024 		ZEND_VM_INC_OPCODE();
29025 	} else {
29026 
29027 		CHECK_EXCEPTION();
29028 	}
29029 	ZEND_VM_NEXT_OPCODE();
29030 }
29031 
ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29032 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29033 {
29034 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29035 }
29036 
ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29037 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29038 {
29039 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29040 }
29041 
ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29042 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29043 {
29044 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29045 }
29046 
ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29047 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29048 {
29049 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29050 }
29051 
ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29052 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29053 {
29054 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29055 }
29056 
ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29057 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29058 {
29059 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29060 }
29061 
ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29062 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29063 {
29064 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29065 }
29066 
ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29067 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29068 {
29069 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29070 }
29071 
ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29072 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29073 {
29074 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29075 }
29076 
ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29077 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29078 {
29079 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29080 }
29081 
ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29082 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29083 {
29084 	return zend_binary_assign_op_helper_SPEC_UNUSED_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29085 }
29086 
zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)29087 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
29088 {
29089 	USE_OPLINE
29090 
29091 	zval **object_ptr;
29092 	zval *object;
29093 	zval *property;
29094 	zval **retval;
29095 	int have_get_ptr = 0;
29096 
29097 	SAVE_OPLINE();
29098 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29099 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29100 	retval = &EX_T(opline->result.var).var.ptr;
29101 
29102 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
29103 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
29104 	}
29105 
29106 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
29107 	object = *object_ptr;
29108 
29109 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
29110 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
29111 
29112 		if (RETURN_VALUE_USED(opline)) {
29113 			PZVAL_LOCK(&EG(uninitialized_zval));
29114 			*retval = &EG(uninitialized_zval);
29115 		}
29116 
29117 		CHECK_EXCEPTION();
29118 		ZEND_VM_NEXT_OPCODE();
29119 	}
29120 
29121 	/* here we are sure we are dealing with an object */
29122 
29123 	if (0) {
29124 		MAKE_REAL_ZVAL_PTR(property);
29125 	}
29126 
29127 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
29128 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29129 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
29130 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
29131 
29132 			have_get_ptr = 1;
29133 			incdec_op(*zptr);
29134 			if (RETURN_VALUE_USED(opline)) {
29135 				*retval = *zptr;
29136 				PZVAL_LOCK(*retval);
29137 			}
29138 		}
29139 	}
29140 
29141 	if (!have_get_ptr) {
29142 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
29143 			zval *z;
29144 
29145 			Z_ADDREF_P(object);
29146 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29147 
29148 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
29149 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
29150 
29151 				if (Z_REFCOUNT_P(z) == 0) {
29152 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
29153 					zval_dtor(z);
29154 					FREE_ZVAL(z);
29155 				}
29156 				z = value;
29157 			}
29158 			Z_ADDREF_P(z);
29159 			SEPARATE_ZVAL_IF_NOT_REF(&z);
29160 			incdec_op(z);
29161 			*retval = z;
29162 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29163 			zval_ptr_dtor(&object);
29164 			SELECTIVE_PZVAL_LOCK(*retval, opline);
29165 			zval_ptr_dtor(&z);
29166 		} else {
29167 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
29168 			if (RETURN_VALUE_USED(opline)) {
29169 				PZVAL_LOCK(&EG(uninitialized_zval));
29170 				*retval = &EG(uninitialized_zval);
29171 			}
29172 		}
29173 	}
29174 
29175 	if (0) {
29176 		zval_ptr_dtor(&property);
29177 	} else {
29178 
29179 	}
29180 
29181 	CHECK_EXCEPTION();
29182 	ZEND_VM_NEXT_OPCODE();
29183 }
29184 
ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29185 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29186 {
29187 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29188 }
29189 
ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29190 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29191 {
29192 	return zend_pre_incdec_property_helper_SPEC_UNUSED_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29193 }
29194 
zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)29195 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
29196 {
29197 	USE_OPLINE
29198 
29199 	zval **object_ptr;
29200 	zval *object;
29201 	zval *property;
29202 	zval *retval;
29203 	int have_get_ptr = 0;
29204 
29205 	SAVE_OPLINE();
29206 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29207 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29208 	retval = &EX_T(opline->result.var).tmp_var;
29209 
29210 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
29211 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
29212 	}
29213 
29214 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
29215 	object = *object_ptr;
29216 
29217 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
29218 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
29219 
29220 		ZVAL_NULL(retval);
29221 
29222 		CHECK_EXCEPTION();
29223 		ZEND_VM_NEXT_OPCODE();
29224 	}
29225 
29226 	/* here we are sure we are dealing with an object */
29227 
29228 	if (0) {
29229 		MAKE_REAL_ZVAL_PTR(property);
29230 	}
29231 
29232 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
29233 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29234 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
29235 			have_get_ptr = 1;
29236 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
29237 
29238 			ZVAL_COPY_VALUE(retval, *zptr);
29239 			zendi_zval_copy_ctor(*retval);
29240 
29241 			incdec_op(*zptr);
29242 
29243 		}
29244 	}
29245 
29246 	if (!have_get_ptr) {
29247 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
29248 			zval *z, *z_copy;
29249 
29250 			Z_ADDREF_P(object);
29251 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29252 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
29253 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
29254 
29255 				if (Z_REFCOUNT_P(z) == 0) {
29256 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
29257 					zval_dtor(z);
29258 					FREE_ZVAL(z);
29259 				}
29260 				z = value;
29261 			}
29262 			ZVAL_COPY_VALUE(retval, z);
29263 			zendi_zval_copy_ctor(*retval);
29264 			ALLOC_ZVAL(z_copy);
29265 			INIT_PZVAL_COPY(z_copy, z);
29266 			zendi_zval_copy_ctor(*z_copy);
29267 			incdec_op(z_copy);
29268 			Z_ADDREF_P(z);
29269 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29270 			zval_ptr_dtor(&object);
29271 			zval_ptr_dtor(&z_copy);
29272 			zval_ptr_dtor(&z);
29273 		} else {
29274 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
29275 			ZVAL_NULL(retval);
29276 		}
29277 	}
29278 
29279 	if (0) {
29280 		zval_ptr_dtor(&property);
29281 	} else {
29282 
29283 	}
29284 
29285 	CHECK_EXCEPTION();
29286 	ZEND_VM_NEXT_OPCODE();
29287 }
29288 
ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29289 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29290 {
29291 	return zend_post_incdec_property_helper_SPEC_UNUSED_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29292 }
29293 
ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29294 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29295 {
29296 	return zend_post_incdec_property_helper_SPEC_UNUSED_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29297 }
29298 
zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS)29299 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS)
29300 {
29301 	USE_OPLINE
29302 
29303 	zval *container;
29304 
29305 	zval *offset;
29306 
29307 	SAVE_OPLINE();
29308 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
29309 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29310 
29311 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
29312 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
29313 		zend_error(E_NOTICE, "Trying to get property of non-object");
29314 		PZVAL_LOCK(&EG(uninitialized_zval));
29315 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29316 
29317 	} else {
29318 		zval *retval;
29319 
29320 		if (0) {
29321 			MAKE_REAL_ZVAL_PTR(offset);
29322 		}
29323 
29324 		/* here we are sure we are dealing with an object */
29325 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29326 
29327 		PZVAL_LOCK(retval);
29328 		AI_SET_PTR(&EX_T(opline->result.var), retval);
29329 
29330 		if (0) {
29331 			zval_ptr_dtor(&offset);
29332 		} else {
29333 
29334 		}
29335 	}
29336 
29337 	CHECK_EXCEPTION();
29338 	ZEND_VM_NEXT_OPCODE();
29339 }
29340 
ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29341 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29342 {
29343 	return zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29344 }
29345 
ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29346 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29347 {
29348 	USE_OPLINE
29349 	zend_free_op free_op1;
29350 	zval *property;
29351 	zval **container;
29352 
29353 	SAVE_OPLINE();
29354 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29355 
29356 	if (0) {
29357 		MAKE_REAL_ZVAL_PTR(property);
29358 	}
29359 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29360 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
29361 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29362 	}
29363 
29364 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
29365 	if (0) {
29366 		zval_ptr_dtor(&property);
29367 	} else {
29368 
29369 	}
29370 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29371 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29372 	}
29373 
29374 	/* We are going to assign the result by reference */
29375 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
29376 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
29377 
29378 		Z_DELREF_PP(retval_ptr);
29379 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
29380 		Z_ADDREF_PP(retval_ptr);
29381 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
29382 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
29383 	}
29384 
29385 	CHECK_EXCEPTION();
29386 	ZEND_VM_NEXT_OPCODE();
29387 }
29388 
ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29389 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29390 {
29391 	USE_OPLINE
29392 	zend_free_op free_op1;
29393 	zval *property;
29394 	zval **container;
29395 
29396 	SAVE_OPLINE();
29397 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29398 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29399 
29400 	if (0) {
29401 		MAKE_REAL_ZVAL_PTR(property);
29402 	}
29403 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
29404 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29405 	}
29406 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
29407 	if (0) {
29408 		zval_ptr_dtor(&property);
29409 	} else {
29410 
29411 	}
29412 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29413 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29414 	}
29415 
29416 	CHECK_EXCEPTION();
29417 	ZEND_VM_NEXT_OPCODE();
29418 }
29419 
ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29420 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29421 {
29422 	USE_OPLINE
29423 
29424 	zval *container;
29425 
29426 	zval *offset;
29427 
29428 	SAVE_OPLINE();
29429 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
29430 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29431 
29432 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
29433 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
29434 		PZVAL_LOCK(&EG(uninitialized_zval));
29435 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
29436 
29437 	} else {
29438 		zval *retval;
29439 
29440 		if (0) {
29441 			MAKE_REAL_ZVAL_PTR(offset);
29442 		}
29443 
29444 		/* here we are sure we are dealing with an object */
29445 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29446 
29447 		PZVAL_LOCK(retval);
29448 		AI_SET_PTR(&EX_T(opline->result.var), retval);
29449 
29450 		if (0) {
29451 			zval_ptr_dtor(&offset);
29452 		} else {
29453 
29454 		}
29455 	}
29456 
29457 	CHECK_EXCEPTION();
29458 	ZEND_VM_NEXT_OPCODE();
29459 }
29460 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29461 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29462 {
29463 	USE_OPLINE
29464 
29465 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
29466 		/* Behave like FETCH_OBJ_W */
29467 		zend_free_op free_op1;
29468 		zval *property;
29469 		zval **container;
29470 
29471 		SAVE_OPLINE();
29472 		property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29473 		container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29474 
29475 		if (0) {
29476 			MAKE_REAL_ZVAL_PTR(property);
29477 		}
29478 		if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
29479 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29480 		}
29481 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
29482 		if (0) {
29483 			zval_ptr_dtor(&property);
29484 		} else {
29485 
29486 		}
29487 		if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29488 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29489 		}
29490 
29491 		CHECK_EXCEPTION();
29492 		ZEND_VM_NEXT_OPCODE();
29493 	} else {
29494 		return zend_fetch_property_address_read_helper_SPEC_UNUSED_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29495 	}
29496 }
29497 
ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29498 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29499 {
29500 	USE_OPLINE
29501 	zend_free_op free_op1, free_res;
29502 	zval **container;
29503 	zval *property;
29504 
29505 	SAVE_OPLINE();
29506 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29507 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29508 
29509 	if (IS_UNUSED == IS_CV) {
29510 		if (container != &EG(uninitialized_zval_ptr)) {
29511 			SEPARATE_ZVAL_IF_NOT_REF(container);
29512 		}
29513 	}
29514 	if (0) {
29515 		MAKE_REAL_ZVAL_PTR(property);
29516 	}
29517 	if (IS_UNUSED == IS_VAR && UNEXPECTED(container == NULL)) {
29518 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
29519 	}
29520 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
29521 	if (0) {
29522 		zval_ptr_dtor(&property);
29523 	} else {
29524 
29525 	}
29526 	if (IS_UNUSED == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
29527 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
29528 	}
29529 
29530 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
29531 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
29532 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
29533 	}
29534 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
29535 	FREE_OP_VAR_PTR(free_res);
29536 	CHECK_EXCEPTION();
29537 	ZEND_VM_NEXT_OPCODE();
29538 }
29539 
ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29540 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29541 {
29542 	USE_OPLINE
29543 
29544 	zval **object_ptr;
29545 	zval *property_name;
29546 
29547 	SAVE_OPLINE();
29548 	object_ptr = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29549 	property_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29550 
29551 	if (0) {
29552 		MAKE_REAL_ZVAL_PTR(property_name);
29553 	}
29554 	if (IS_UNUSED == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
29555 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
29556 	}
29557 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29558 	if (0) {
29559 		zval_ptr_dtor(&property_name);
29560 	} else {
29561 
29562 	}
29563 
29564 	/* assign_obj has two opcodes! */
29565 	CHECK_EXCEPTION();
29566 	ZEND_VM_INC_OPCODE();
29567 	ZEND_VM_NEXT_OPCODE();
29568 }
29569 
ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29570 static int ZEND_FASTCALL  ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29571 {
29572 	USE_OPLINE
29573 
29574 	zval *str = &EX_T(opline->result.var).tmp_var;
29575 	zval *var;
29576 	zval var_copy;
29577 	int use_copy = 0;
29578 
29579 	SAVE_OPLINE();
29580 	var = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29581 
29582 	if (IS_UNUSED == IS_UNUSED) {
29583 		/* Initialize for erealloc in add_string_to_string */
29584 		Z_STRVAL_P(str) = NULL;
29585 		Z_STRLEN_P(str) = 0;
29586 		Z_TYPE_P(str) = IS_STRING;
29587 
29588 		INIT_PZVAL(str);
29589 	}
29590 
29591 	if (Z_TYPE_P(var) != IS_STRING) {
29592 		zend_make_printable_zval(var, &var_copy, &use_copy);
29593 
29594 		if (use_copy) {
29595 			var = &var_copy;
29596 		}
29597 	}
29598 	add_string_to_string(str, str, var);
29599 
29600 	if (use_copy) {
29601 		zval_dtor(var);
29602 	}
29603 	/* original comment, possibly problematic:
29604 	 * FREE_OP is missing intentionally here - we're always working on the same temporary variable
29605 	 * (Zeev):  I don't think it's problematic, we only use variables
29606 	 * which aren't affected by FREE_OP(Ts, )'s anyway, unless they're
29607 	 * string offsets or overloaded objects
29608 	 */
29609 
29610 	CHECK_EXCEPTION();
29611 	ZEND_VM_NEXT_OPCODE();
29612 }
29613 
ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29614 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29615 {
29616 	USE_OPLINE
29617 	zval *function_name;
29618 	char *function_name_strval;
29619 	int function_name_strlen;
29620 
29621 	call_slot *call = EX(call_slots) + opline->result.num;
29622 
29623 	SAVE_OPLINE();
29624 
29625 	function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29626 
29627 	if (IS_CV != IS_CONST &&
29628 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
29629 		if (UNEXPECTED(EG(exception) != NULL)) {
29630 			HANDLE_EXCEPTION();
29631 		}
29632 		zend_error_noreturn(E_ERROR, "Method name must be a string");
29633 	}
29634 
29635 	function_name_strval = Z_STRVAL_P(function_name);
29636 	function_name_strlen = Z_STRLEN_P(function_name);
29637 
29638 	call->object = _get_obj_zval_ptr_unused(TSRMLS_C);
29639 
29640 	if (EXPECTED(call->object != NULL) &&
29641 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
29642 		call->called_scope = Z_OBJCE_P(call->object);
29643 
29644 		if (IS_CV != IS_CONST ||
29645 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
29646 		    zval *object = call->object;
29647 
29648 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
29649 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
29650 			}
29651 
29652 			/* First, locate the function. */
29653 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
29654 			if (UNEXPECTED(call->fbc == NULL)) {
29655 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
29656 			}
29657 			if (IS_CV == IS_CONST &&
29658 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
29659 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
29660 			    EXPECTED(call->object == object)) {
29661 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
29662 			}
29663 		}
29664 	} else {
29665 		if (UNEXPECTED(EG(exception) != NULL)) {
29666 
29667 			HANDLE_EXCEPTION();
29668 		}
29669 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
29670 	}
29671 
29672 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
29673 		call->object = NULL;
29674 	} else {
29675 		if (!PZVAL_IS_REF(call->object)) {
29676 			Z_ADDREF_P(call->object); /* For $this pointer */
29677 		} else {
29678 			zval *this_ptr;
29679 			ALLOC_ZVAL(this_ptr);
29680 			INIT_PZVAL_COPY(this_ptr, call->object);
29681 			zval_copy_ctor(this_ptr);
29682 			call->object = this_ptr;
29683 		}
29684 	}
29685 	call->is_ctor_call = 0;
29686 	EX(call) = call;
29687 
29688 
29689 	CHECK_EXCEPTION();
29690 	ZEND_VM_NEXT_OPCODE();
29691 }
29692 
ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29693 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29694 {
29695 	USE_OPLINE
29696 
29697 	array_init(&EX_T(opline->result.var).tmp_var);
29698 	if (IS_UNUSED == IS_UNUSED) {
29699 		ZEND_VM_NEXT_OPCODE();
29700 #if 0 || IS_UNUSED != IS_UNUSED
29701 	} else {
29702 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29703 #endif
29704 	}
29705 }
29706 
ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29707 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29708 {
29709 	USE_OPLINE
29710 
29711 	zval **container;
29712 	zval *offset;
29713 	ulong hval;
29714 
29715 	SAVE_OPLINE();
29716 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29717 	if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
29718 		SEPARATE_ZVAL_IF_NOT_REF(container);
29719 	}
29720 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29721 
29722 	if (IS_UNUSED != IS_VAR || container) {
29723 		switch (Z_TYPE_PP(container)) {
29724 			case IS_ARRAY: {
29725 				HashTable *ht = Z_ARRVAL_PP(container);
29726 
29727 				switch (Z_TYPE_P(offset)) {
29728 					case IS_DOUBLE:
29729 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
29730 						zend_hash_index_del(ht, hval);
29731 						break;
29732 					case IS_RESOURCE:
29733 					case IS_BOOL:
29734 					case IS_LONG:
29735 						hval = Z_LVAL_P(offset);
29736 						zend_hash_index_del(ht, hval);
29737 						break;
29738 					case IS_STRING:
29739 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
29740 							Z_ADDREF_P(offset);
29741 						}
29742 						if (IS_CV == IS_CONST) {
29743 							hval = Z_HASH_P(offset);
29744 						} else {
29745 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
29746 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
29747 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
29748 							} else {
29749 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
29750 							}
29751 						}
29752 						if (ht == &EG(symbol_table)) {
29753 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
29754 						} else {
29755 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
29756 						}
29757 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
29758 							zval_ptr_dtor(&offset);
29759 						}
29760 						break;
29761 num_index_dim:
29762 						zend_hash_index_del(ht, hval);
29763 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
29764 							zval_ptr_dtor(&offset);
29765 						}
29766 						break;
29767 					case IS_NULL:
29768 						zend_hash_del(ht, "", sizeof(""));
29769 						break;
29770 					default:
29771 						zend_error(E_WARNING, "Illegal offset type in unset");
29772 						break;
29773 				}
29774 
29775 				break;
29776 			}
29777 			case IS_OBJECT:
29778 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
29779 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
29780 				}
29781 				if (0) {
29782 					MAKE_REAL_ZVAL_PTR(offset);
29783 				}
29784 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
29785 				if (0) {
29786 					zval_ptr_dtor(&offset);
29787 				} else {
29788 
29789 				}
29790 				break;
29791 			case IS_STRING:
29792 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
29793 				ZEND_VM_CONTINUE(); /* bailed out before */
29794 			default:
29795 
29796 				break;
29797 		}
29798 	} else {
29799 
29800 	}
29801 
29802 	CHECK_EXCEPTION();
29803 	ZEND_VM_NEXT_OPCODE();
29804 }
29805 
ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29806 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29807 {
29808 	USE_OPLINE
29809 
29810 	zval **container;
29811 	zval *offset;
29812 
29813 	SAVE_OPLINE();
29814 	container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
29815 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29816 
29817 	if (IS_UNUSED != IS_VAR || container) {
29818 		if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
29819 			SEPARATE_ZVAL_IF_NOT_REF(container);
29820 		}
29821 		if (Z_TYPE_PP(container) == IS_OBJECT) {
29822 			if (0) {
29823 				MAKE_REAL_ZVAL_PTR(offset);
29824 			}
29825 			if (Z_OBJ_HT_P(*container)->unset_property) {
29826 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29827 			} else {
29828 				zend_error(E_NOTICE, "Trying to unset property of non-object");
29829 			}
29830 			if (0) {
29831 				zval_ptr_dtor(&offset);
29832 			} else {
29833 
29834 			}
29835 		} else {
29836 
29837 		}
29838 	} else {
29839 
29840 	}
29841 
29842 	CHECK_EXCEPTION();
29843 	ZEND_VM_NEXT_OPCODE();
29844 }
29845 
zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)29846 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
29847 {
29848 	USE_OPLINE
29849 
29850 	zval *container;
29851 	zval **value = NULL;
29852 	int result = 0;
29853 	ulong hval;
29854 	zval *offset;
29855 
29856 	SAVE_OPLINE();
29857 	container = _get_obj_zval_ptr_unused(TSRMLS_C);
29858 
29859 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
29860 
29861 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
29862 		HashTable *ht;
29863 		int isset = 0;
29864 
29865 		ht = Z_ARRVAL_P(container);
29866 
29867 		switch (Z_TYPE_P(offset)) {
29868 			case IS_DOUBLE:
29869 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
29870 				goto num_index_prop;
29871 			case IS_RESOURCE:
29872 			case IS_BOOL:
29873 			case IS_LONG:
29874 				hval = Z_LVAL_P(offset);
29875 num_index_prop:
29876 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
29877 					isset = 1;
29878 				}
29879 				break;
29880 			case IS_STRING:
29881 				if (IS_CV == IS_CONST) {
29882 					hval = Z_HASH_P(offset);
29883 				} else {
29884 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
29885 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
29886 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
29887 					} else {
29888 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
29889 					}
29890 				}
29891 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
29892 					isset = 1;
29893 				}
29894 				break;
29895 			case IS_NULL:
29896 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
29897 					isset = 1;
29898 				}
29899 				break;
29900 			default:
29901 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
29902 				break;
29903 		}
29904 
29905 		if (opline->extended_value & ZEND_ISSET) {
29906 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
29907 				result = 0;
29908 			} else {
29909 				result = isset;
29910 			}
29911 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
29912 			if (!isset || !i_zend_is_true(*value)) {
29913 				result = 0;
29914 			} else {
29915 				result = 1;
29916 			}
29917 		}
29918 
29919 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
29920 		if (0) {
29921 			MAKE_REAL_ZVAL_PTR(offset);
29922 		}
29923 		if (prop_dim) {
29924 			if (Z_OBJ_HT_P(container)->has_property) {
29925 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
29926 			} else {
29927 				zend_error(E_NOTICE, "Trying to check property of non-object");
29928 				result = 0;
29929 			}
29930 		} else {
29931 			if (Z_OBJ_HT_P(container)->has_dimension) {
29932 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
29933 			} else {
29934 				zend_error(E_NOTICE, "Trying to check element of non-array");
29935 				result = 0;
29936 			}
29937 		}
29938 		if (0) {
29939 			zval_ptr_dtor(&offset);
29940 		} else {
29941 
29942 		}
29943 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
29944 		zval tmp;
29945 
29946 		if (Z_TYPE_P(offset) != IS_LONG) {
29947 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
29948 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
29949 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
29950 				ZVAL_COPY_VALUE(&tmp, offset);
29951 				zval_copy_ctor(&tmp);
29952 				convert_to_long(&tmp);
29953 				offset = &tmp;
29954 			} else {
29955 				/* can not be converted to proper offset, return "not set" */
29956 				result = 0;
29957 			}
29958 		}
29959 		if (Z_TYPE_P(offset) == IS_LONG) {
29960 			if (opline->extended_value & ZEND_ISSET) {
29961 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
29962 					result = 1;
29963 				}
29964 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
29965 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
29966 					result = 1;
29967 				}
29968 			}
29969 		}
29970 
29971 	} else {
29972 
29973 	}
29974 
29975 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
29976 	if (opline->extended_value & ZEND_ISSET) {
29977 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
29978 	} else {
29979 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
29980 	}
29981 
29982 	CHECK_EXCEPTION();
29983 	ZEND_VM_NEXT_OPCODE();
29984 }
29985 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29986 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29987 {
29988 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29989 }
29990 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29991 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29992 {
29993 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
29994 }
29995 
ZEND_YIELD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)29996 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
29997 {
29998 	USE_OPLINE
29999 
30000 	/* The generator object is stored in return_value_ptr_ptr */
30001 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
30002 
30003 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
30004 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
30005 	}
30006 
30007 	/* Destroy the previously yielded value */
30008 	if (generator->value) {
30009 		zval_ptr_dtor(&generator->value);
30010 	}
30011 
30012 	/* Destroy the previously yielded key */
30013 	if (generator->key) {
30014 		zval_ptr_dtor(&generator->key);
30015 	}
30016 
30017 	/* Set the new yielded value */
30018 	if (IS_UNUSED != IS_UNUSED) {
30019 
30020 
30021 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
30022 			/* Constants and temporary variables aren't yieldable by reference,
30023 			 * but we still allow them with a notice. */
30024 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR) {
30025 				zval *value, *copy;
30026 
30027 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
30028 
30029 				value = NULL;
30030 				ALLOC_ZVAL(copy);
30031 				INIT_PZVAL_COPY(copy, value);
30032 
30033 				/* Temporary variables don't need ctor copying */
30034 				if (!0) {
30035 					zval_copy_ctor(copy);
30036 				}
30037 
30038 				generator->value = copy;
30039 			} else {
30040 				zval **value_ptr = NULL;
30041 
30042 				if (IS_UNUSED == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
30043 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
30044 				}
30045 
30046 				/* If a function call result is yielded and the function did
30047 				 * not return by reference we throw a notice. */
30048 				if (IS_UNUSED == IS_VAR && !Z_ISREF_PP(value_ptr)
30049 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
30050 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
30051 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
30052 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
30053 
30054 					Z_ADDREF_PP(value_ptr);
30055 					generator->value = *value_ptr;
30056 				} else {
30057 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
30058 					Z_ADDREF_PP(value_ptr);
30059 					generator->value = *value_ptr;
30060 				}
30061 
30062 			}
30063 		} else {
30064 			zval *value = NULL;
30065 
30066 			/* Consts, temporary variables and references need copying */
30067 			if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
30068 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
30069 			) {
30070 				zval *copy;
30071 
30072 				ALLOC_ZVAL(copy);
30073 				INIT_PZVAL_COPY(copy, value);
30074 
30075 				/* Temporary variables don't need ctor copying */
30076 				if (!0) {
30077 					zval_copy_ctor(copy);
30078 				}
30079 
30080 				generator->value = copy;
30081 			} else {
30082 				Z_ADDREF_P(value);
30083 				generator->value = value;
30084 			}
30085 
30086 		}
30087 	} else {
30088 		/* If no value was specified yield null */
30089 		Z_ADDREF(EG(uninitialized_zval));
30090 		generator->value = &EG(uninitialized_zval);
30091 	}
30092 
30093 	/* Set the new yielded key */
30094 	if (IS_CV != IS_UNUSED) {
30095 
30096 		zval *key = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
30097 
30098 		/* Consts, temporary variables and references need copying */
30099 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
30100 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
30101 		) {
30102 			zval *copy;
30103 
30104 			ALLOC_ZVAL(copy);
30105 			INIT_PZVAL_COPY(copy, key);
30106 
30107 			/* Temporary variables don't need ctor copying */
30108 			if (!0) {
30109 				zval_copy_ctor(copy);
30110 			}
30111 
30112 			generator->key = copy;
30113 		} else {
30114 			Z_ADDREF_P(key);
30115 			generator->key = key;
30116 		}
30117 
30118 		if (Z_TYPE_P(generator->key) == IS_LONG
30119 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
30120 		) {
30121 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
30122 		}
30123 
30124 	} else {
30125 		/* If no key was specified we use auto-increment keys */
30126 		generator->largest_used_integer_key++;
30127 
30128 		ALLOC_INIT_ZVAL(generator->key);
30129 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
30130 	}
30131 
30132 	if (RETURN_VALUE_USED(opline)) {
30133 		/* If the return value of yield is used set the send
30134 		 * target and initialize it to NULL */
30135 		generator->send_target = &EX_T(opline->result.var).var.ptr;
30136 		Z_ADDREF(EG(uninitialized_zval));
30137 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
30138 	} else {
30139 		generator->send_target = NULL;
30140 	}
30141 
30142 	/* We increment to the next op, so we are at the correct position when the
30143 	 * generator is resumed. */
30144 	ZEND_VM_INC_OPCODE();
30145 
30146 	/* The GOTO VM uses a local opline variable. We need to set the opline
30147 	 * variable in execute_data so we don't resume at an old position. */
30148 	SAVE_OPLINE();
30149 
30150 	ZEND_VM_RETURN();
30151 }
30152 
ZEND_BW_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30153 static int ZEND_FASTCALL  ZEND_BW_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30154 {
30155 	USE_OPLINE
30156 
30157 
30158 	SAVE_OPLINE();
30159 	bitwise_not_function(&EX_T(opline->result.var).tmp_var,
30160 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC) TSRMLS_CC);
30161 
30162 	CHECK_EXCEPTION();
30163 	ZEND_VM_NEXT_OPCODE();
30164 }
30165 
ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30166 static int ZEND_FASTCALL  ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30167 {
30168 	USE_OPLINE
30169 
30170 
30171 	SAVE_OPLINE();
30172 	boolean_not_function(&EX_T(opline->result.var).tmp_var,
30173 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC) TSRMLS_CC);
30174 
30175 	CHECK_EXCEPTION();
30176 	ZEND_VM_NEXT_OPCODE();
30177 }
30178 
ZEND_PRE_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30179 static int ZEND_FASTCALL  ZEND_PRE_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30180 {
30181 	USE_OPLINE
30182 
30183 	zval **var_ptr;
30184 
30185 	SAVE_OPLINE();
30186 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
30187 
30188 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
30189 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30190 	}
30191 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
30192 		if (RETURN_VALUE_USED(opline)) {
30193 			PZVAL_LOCK(&EG(uninitialized_zval));
30194 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
30195 		}
30196 
30197 		CHECK_EXCEPTION();
30198 		ZEND_VM_NEXT_OPCODE();
30199 	}
30200 
30201 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
30202 
30203 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
30204 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
30205 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
30206 		/* proxy object */
30207 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
30208 		Z_ADDREF_P(val);
30209 		fast_increment_function(val);
30210 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
30211 		zval_ptr_dtor(&val);
30212 	} else {
30213 		fast_increment_function(*var_ptr);
30214 	}
30215 
30216 	if (RETURN_VALUE_USED(opline)) {
30217 		PZVAL_LOCK(*var_ptr);
30218 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
30219 	}
30220 
30221 	CHECK_EXCEPTION();
30222 	ZEND_VM_NEXT_OPCODE();
30223 }
30224 
ZEND_PRE_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30225 static int ZEND_FASTCALL  ZEND_PRE_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30226 {
30227 	USE_OPLINE
30228 
30229 	zval **var_ptr;
30230 
30231 	SAVE_OPLINE();
30232 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
30233 
30234 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
30235 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30236 	}
30237 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
30238 		if (RETURN_VALUE_USED(opline)) {
30239 			PZVAL_LOCK(&EG(uninitialized_zval));
30240 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
30241 		}
30242 
30243 		CHECK_EXCEPTION();
30244 		ZEND_VM_NEXT_OPCODE();
30245 	}
30246 
30247 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
30248 
30249 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
30250 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
30251 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
30252 		/* proxy object */
30253 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
30254 		Z_ADDREF_P(val);
30255 		fast_decrement_function(val);
30256 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
30257 		zval_ptr_dtor(&val);
30258 	} else {
30259 		fast_decrement_function(*var_ptr);
30260 	}
30261 
30262 	if (RETURN_VALUE_USED(opline)) {
30263 		PZVAL_LOCK(*var_ptr);
30264 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
30265 	}
30266 
30267 	CHECK_EXCEPTION();
30268 	ZEND_VM_NEXT_OPCODE();
30269 }
30270 
ZEND_POST_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30271 static int ZEND_FASTCALL  ZEND_POST_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30272 {
30273 	USE_OPLINE
30274 
30275 	zval **var_ptr, *retval;
30276 
30277 	SAVE_OPLINE();
30278 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
30279 
30280 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
30281 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30282 	}
30283 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
30284 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
30285 
30286 		CHECK_EXCEPTION();
30287 		ZEND_VM_NEXT_OPCODE();
30288 	}
30289 
30290 	retval = &EX_T(opline->result.var).tmp_var;
30291 	ZVAL_COPY_VALUE(retval, *var_ptr);
30292 	zendi_zval_copy_ctor(*retval);
30293 
30294 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
30295 
30296 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
30297 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
30298 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
30299 		/* proxy object */
30300 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
30301 		Z_ADDREF_P(val);
30302 		fast_increment_function(val);
30303 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
30304 		zval_ptr_dtor(&val);
30305 	} else {
30306 		fast_increment_function(*var_ptr);
30307 	}
30308 
30309 	CHECK_EXCEPTION();
30310 	ZEND_VM_NEXT_OPCODE();
30311 }
30312 
ZEND_POST_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30313 static int ZEND_FASTCALL  ZEND_POST_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30314 {
30315 	USE_OPLINE
30316 
30317 	zval **var_ptr, *retval;
30318 
30319 	SAVE_OPLINE();
30320 	var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
30321 
30322 	if (IS_CV == IS_VAR && UNEXPECTED(var_ptr == NULL)) {
30323 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
30324 	}
30325 	if (IS_CV == IS_VAR && UNEXPECTED(*var_ptr == &EG(error_zval))) {
30326 		ZVAL_NULL(&EX_T(opline->result.var).tmp_var);
30327 
30328 		CHECK_EXCEPTION();
30329 		ZEND_VM_NEXT_OPCODE();
30330 	}
30331 
30332 	retval = &EX_T(opline->result.var).tmp_var;
30333 	ZVAL_COPY_VALUE(retval, *var_ptr);
30334 	zendi_zval_copy_ctor(*retval);
30335 
30336 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
30337 
30338 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
30339 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
30340 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
30341 		/* proxy object */
30342 		zval *val = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
30343 		Z_ADDREF_P(val);
30344 		fast_decrement_function(val);
30345 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, val TSRMLS_CC);
30346 		zval_ptr_dtor(&val);
30347 	} else {
30348 		fast_decrement_function(*var_ptr);
30349 	}
30350 
30351 	CHECK_EXCEPTION();
30352 	ZEND_VM_NEXT_OPCODE();
30353 }
30354 
ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30355 static int ZEND_FASTCALL  ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30356 {
30357 	USE_OPLINE
30358 
30359 	zval *z;
30360 
30361 	SAVE_OPLINE();
30362 	z = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30363 
30364 	if (IS_CV == IS_TMP_VAR && Z_TYPE_P(z) == IS_OBJECT) {
30365 		INIT_PZVAL(z);
30366 	}
30367 	zend_print_variable(z);
30368 
30369 	CHECK_EXCEPTION();
30370 	ZEND_VM_NEXT_OPCODE();
30371 }
30372 
ZEND_PRINT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30373 static int ZEND_FASTCALL  ZEND_PRINT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30374 {
30375 	USE_OPLINE
30376 
30377 	ZVAL_LONG(&EX_T(opline->result.var).tmp_var, 1);
30378 	return ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30379 }
30380 
ZEND_JMPZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30381 static int ZEND_FASTCALL  ZEND_JMPZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30382 {
30383 	USE_OPLINE
30384 
30385 	zval *val;
30386 	int ret;
30387 
30388 	SAVE_OPLINE();
30389 	val = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30390 
30391 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
30392 		ret = Z_LVAL_P(val);
30393 	} else {
30394 		ret = i_zend_is_true(val);
30395 
30396 		if (UNEXPECTED(EG(exception) != NULL)) {
30397 			HANDLE_EXCEPTION();
30398 		}
30399 	}
30400 	if (!ret) {
30401 #if DEBUG_ZEND>=2
30402 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
30403 #endif
30404 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
30405 		ZEND_VM_CONTINUE();
30406 	}
30407 
30408 	ZEND_VM_NEXT_OPCODE();
30409 }
30410 
ZEND_JMPNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30411 static int ZEND_FASTCALL  ZEND_JMPNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30412 {
30413 	USE_OPLINE
30414 
30415 	zval *val;
30416 	int ret;
30417 
30418 	SAVE_OPLINE();
30419 	val = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30420 
30421 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
30422 		ret = Z_LVAL_P(val);
30423 	} else {
30424 		ret = i_zend_is_true(val);
30425 
30426 		if (UNEXPECTED(EG(exception) != NULL)) {
30427 			HANDLE_EXCEPTION();
30428 		}
30429 	}
30430 	if (ret) {
30431 #if DEBUG_ZEND>=2
30432 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
30433 #endif
30434 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
30435 		ZEND_VM_CONTINUE();
30436 	}
30437 
30438 	ZEND_VM_NEXT_OPCODE();
30439 }
30440 
ZEND_JMPZNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30441 static int ZEND_FASTCALL  ZEND_JMPZNZ_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30442 {
30443 	USE_OPLINE
30444 
30445 	zval *val;
30446 	int retval;
30447 
30448 	SAVE_OPLINE();
30449 	val = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30450 
30451 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
30452 		retval = Z_LVAL_P(val);
30453 	} else {
30454 		retval = i_zend_is_true(val);
30455 
30456 		if (UNEXPECTED(EG(exception) != NULL)) {
30457 			HANDLE_EXCEPTION();
30458 		}
30459 	}
30460 	if (EXPECTED(retval != 0)) {
30461 #if DEBUG_ZEND>=2
30462 		printf("Conditional jmp on true to %d\n", opline->extended_value);
30463 #endif
30464 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->extended_value]);
30465 		ZEND_VM_CONTINUE(); /* CHECK_ME */
30466 	} else {
30467 #if DEBUG_ZEND>=2
30468 		printf("Conditional jmp on false to %d\n", opline->op2.opline_num);
30469 #endif
30470 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
30471 		ZEND_VM_CONTINUE(); /* CHECK_ME */
30472 	}
30473 }
30474 
ZEND_JMPZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30475 static int ZEND_FASTCALL  ZEND_JMPZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30476 {
30477 	USE_OPLINE
30478 
30479 	zval *val;
30480 	int retval;
30481 
30482 	SAVE_OPLINE();
30483 	val = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30484 
30485 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
30486 		retval = Z_LVAL_P(val);
30487 	} else {
30488 		retval = i_zend_is_true(val);
30489 
30490 		if (UNEXPECTED(EG(exception) != NULL)) {
30491 			HANDLE_EXCEPTION();
30492 		}
30493 	}
30494 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
30495 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
30496 	if (!retval) {
30497 #if DEBUG_ZEND>=2
30498 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
30499 #endif
30500 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
30501 		ZEND_VM_CONTINUE();
30502 	}
30503 	ZEND_VM_NEXT_OPCODE();
30504 }
30505 
ZEND_JMPNZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30506 static int ZEND_FASTCALL  ZEND_JMPNZ_EX_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30507 {
30508 	USE_OPLINE
30509 
30510 	zval *val;
30511 	int retval;
30512 
30513 	SAVE_OPLINE();
30514 	val = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30515 
30516 	if (IS_CV == IS_TMP_VAR && EXPECTED(Z_TYPE_P(val) == IS_BOOL)) {
30517 		retval = Z_LVAL_P(val);
30518 	} else {
30519 		retval = i_zend_is_true(val);
30520 
30521 		if (UNEXPECTED(EG(exception) != NULL)) {
30522 			HANDLE_EXCEPTION();
30523 		}
30524 	}
30525 	Z_LVAL(EX_T(opline->result.var).tmp_var) = retval;
30526 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
30527 	if (retval) {
30528 #if DEBUG_ZEND>=2
30529 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
30530 #endif
30531 		ZEND_VM_SET_OPCODE(opline->op2.jmp_addr);
30532 		ZEND_VM_CONTINUE();
30533 	}
30534 	ZEND_VM_NEXT_OPCODE();
30535 }
30536 
ZEND_RETURN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30537 static int ZEND_FASTCALL  ZEND_RETURN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30538 {
30539 	USE_OPLINE
30540 	zval *retval_ptr;
30541 
30542 
30543 	SAVE_OPLINE();
30544 	retval_ptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30545 
30546 	if (!EG(return_value_ptr_ptr)) {
30547 		if (IS_CV == IS_TMP_VAR) {
30548 
30549 		}
30550 	} else {
30551 		if (IS_CV == IS_CONST ||
30552 		    IS_CV == IS_TMP_VAR ||
30553 		    PZVAL_IS_REF(retval_ptr)) {
30554 			zval *ret;
30555 
30556 			ALLOC_ZVAL(ret);
30557 			INIT_PZVAL_COPY(ret, retval_ptr);
30558 			if (IS_CV != IS_TMP_VAR) {
30559 				zval_copy_ctor(ret);
30560 			}
30561 			*EG(return_value_ptr_ptr) = ret;
30562 		} else if ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
30563 		           retval_ptr == &EG(uninitialized_zval)) {
30564 			zval *ret;
30565 
30566 			ALLOC_INIT_ZVAL(ret);
30567 			*EG(return_value_ptr_ptr) = ret;
30568 		} else {
30569 			*EG(return_value_ptr_ptr) = retval_ptr;
30570 			Z_ADDREF_P(retval_ptr);
30571 		}
30572 	}
30573 
30574 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30575 }
30576 
ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30577 static int ZEND_FASTCALL  ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30578 {
30579 	USE_OPLINE
30580 	zval *retval_ptr;
30581 	zval **retval_ptr_ptr;
30582 
30583 
30584 	SAVE_OPLINE();
30585 
30586 	do {
30587 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
30588 			/* Not supposed to happen, but we'll allow it */
30589 			zend_error(E_NOTICE, "Only variable references should be returned by reference");
30590 
30591 			retval_ptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30592 			if (!EG(return_value_ptr_ptr)) {
30593 				if (IS_CV == IS_TMP_VAR) {
30594 
30595 				}
30596 			} else if (!0) { /* Not a temp var */
30597 				zval *ret;
30598 
30599 				ALLOC_ZVAL(ret);
30600 				INIT_PZVAL_COPY(ret, retval_ptr);
30601 				zval_copy_ctor(ret);
30602 				*EG(return_value_ptr_ptr) = ret;
30603 			} else {
30604 				zval *ret;
30605 
30606 				ALLOC_ZVAL(ret);
30607 				INIT_PZVAL_COPY(ret, retval_ptr);
30608 				*EG(return_value_ptr_ptr) = ret;
30609 			}
30610 			break;
30611 		}
30612 
30613 		retval_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
30614 
30615 		if (IS_CV == IS_VAR && UNEXPECTED(retval_ptr_ptr == NULL)) {
30616 			zend_error_noreturn(E_ERROR, "Cannot return string offsets by reference");
30617 		}
30618 
30619 		if (IS_CV == IS_VAR && !Z_ISREF_PP(retval_ptr_ptr)) {
30620 			if (opline->extended_value == ZEND_RETURNS_FUNCTION &&
30621 			    EX_T(opline->op1.var).var.fcall_returned_reference) {
30622 			} else if (EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
30623 				zend_error(E_NOTICE, "Only variable references should be returned by reference");
30624 				if (EG(return_value_ptr_ptr)) {
30625 					zval *ret;
30626 
30627 					ALLOC_ZVAL(ret);
30628 					INIT_PZVAL_COPY(ret, *retval_ptr_ptr);
30629 					zval_copy_ctor(ret);
30630 					*EG(return_value_ptr_ptr) = ret;
30631 				}
30632 				break;
30633 			}
30634 		}
30635 
30636 		if (EG(return_value_ptr_ptr)) {
30637 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
30638 			Z_ADDREF_PP(retval_ptr_ptr);
30639 
30640 			*EG(return_value_ptr_ptr) = *retval_ptr_ptr;
30641 		}
30642 	} while (0);
30643 
30644 	return zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30645 }
30646 
ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30647 static int ZEND_FASTCALL  ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30648 {
30649 	USE_OPLINE
30650 	zval *value;
30651 	zval *exception;
30652 
30653 
30654 	SAVE_OPLINE();
30655 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30656 
30657 	if (IS_CV == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
30658 		if (UNEXPECTED(EG(exception) != NULL)) {
30659 			HANDLE_EXCEPTION();
30660 		}
30661 		zend_error_noreturn(E_ERROR, "Can only throw objects");
30662 	}
30663 
30664 	zend_exception_save(TSRMLS_C);
30665 	/* Not sure if a complete copy is what we want here */
30666 	ALLOC_ZVAL(exception);
30667 	INIT_PZVAL_COPY(exception, value);
30668 	if (!0) {
30669 		zval_copy_ctor(exception);
30670 	}
30671 
30672 	zend_throw_exception_object(exception TSRMLS_CC);
30673 	zend_exception_restore(TSRMLS_C);
30674 
30675 	HANDLE_EXCEPTION();
30676 }
30677 
zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS)30678 static int ZEND_FASTCALL zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS)
30679 {
30680 	USE_OPLINE
30681 	zval *varptr;
30682 
30683 	varptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30684 
30685 	if (varptr == &EG(uninitialized_zval)) {
30686 		ALLOC_ZVAL(varptr);
30687 		INIT_ZVAL(*varptr);
30688 		Z_SET_REFCOUNT_P(varptr, 0);
30689 	} else if (PZVAL_IS_REF(varptr)) {
30690 		zval *original_var = varptr;
30691 
30692 		ALLOC_ZVAL(varptr);
30693 		ZVAL_COPY_VALUE(varptr, original_var);
30694 		Z_UNSET_ISREF_P(varptr);
30695 		Z_SET_REFCOUNT_P(varptr, 0);
30696 		zval_copy_ctor(varptr);
30697 	}
30698 	Z_ADDREF_P(varptr);
30699 	zend_vm_stack_push(varptr TSRMLS_CC);
30700 	;  /* for string offsets */
30701 
30702 	CHECK_EXCEPTION();
30703 	ZEND_VM_NEXT_OPCODE();
30704 }
30705 
ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30706 static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30707 {
30708 	USE_OPLINE
30709 	zend_free_op free_op1;
30710 	zval *varptr;
30711 
30712 	SAVE_OPLINE();
30713 	if (opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) { /* Had function_ptr at compile_time */
30714 		if (!(opline->extended_value & ZEND_ARG_SEND_BY_REF)) {
30715 			return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30716 		}
30717 	} else if (!ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
30718 		return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30719 	}
30720 
30721 	if (IS_CV == IS_VAR &&
30722 		(opline->extended_value & ZEND_ARG_SEND_FUNCTION) &&
30723 		EX_T(opline->op1.var).var.fcall_returned_reference &&
30724 		EX_T(opline->op1.var).var.ptr) {
30725 		varptr = EX_T(opline->op1.var).var.ptr;
30726 		PZVAL_UNLOCK_EX(varptr, &free_op1, 0);
30727 	} else {
30728 		varptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30729 	}
30730 	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
30731 	     EX_T(opline->op1.var).var.fcall_returned_reference) &&
30732 	    varptr != &EG(uninitialized_zval) &&
30733 	    (PZVAL_IS_REF(varptr) ||
30734 	     (Z_REFCOUNT_P(varptr) == 1 && (IS_CV == IS_CV || free_op1.var)))) {
30735 		Z_SET_ISREF_P(varptr);
30736 		Z_ADDREF_P(varptr);
30737 		zend_vm_stack_push(varptr TSRMLS_CC);
30738 	} else {
30739 		zval *valptr;
30740 
30741 		if ((opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) ?
30742 			!(opline->extended_value & ZEND_ARG_SEND_SILENT) :
30743 			!ARG_MAY_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
30744 			zend_error(E_STRICT, "Only variables should be passed by reference");
30745 		}
30746 		ALLOC_ZVAL(valptr);
30747 		INIT_PZVAL_COPY(valptr, varptr);
30748 		if (!0) {
30749 			zval_copy_ctor(valptr);
30750 		}
30751 		zend_vm_stack_push(valptr TSRMLS_CC);
30752 	}
30753 
30754 	CHECK_EXCEPTION();
30755 	ZEND_VM_NEXT_OPCODE();
30756 }
30757 
ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30758 static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30759 {
30760 	USE_OPLINE
30761 
30762 	zval **varptr_ptr;
30763 	zval *varptr;
30764 
30765 	SAVE_OPLINE();
30766 	varptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
30767 
30768 	if (IS_CV == IS_VAR && UNEXPECTED(varptr_ptr == NULL)) {
30769 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
30770 	}
30771 
30772 	if (IS_CV == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
30773 		ALLOC_INIT_ZVAL(varptr);
30774 		zend_vm_stack_push(varptr TSRMLS_CC);
30775 		CHECK_EXCEPTION();
30776 		ZEND_VM_NEXT_OPCODE();
30777 	}
30778 
30779 	if (opline->extended_value == ZEND_DO_FCALL_BY_NAME &&
30780 	    EX(function_state).function->type == ZEND_INTERNAL_FUNCTION &&
30781 	    !ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
30782 		return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30783 	}
30784 
30785 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
30786 	varptr = *varptr_ptr;
30787 	Z_ADDREF_P(varptr);
30788 	zend_vm_stack_push(varptr TSRMLS_CC);
30789 
30790 	CHECK_EXCEPTION();
30791 	ZEND_VM_NEXT_OPCODE();
30792 }
30793 
ZEND_SEND_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30794 static int ZEND_FASTCALL  ZEND_SEND_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30795 {
30796 	USE_OPLINE
30797 
30798 	if ((opline->extended_value == ZEND_DO_FCALL_BY_NAME)
30799 		&& ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, opline->op2.opline_num)) {
30800 		return ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30801 	}
30802 	SAVE_OPLINE();
30803 	return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
30804 }
30805 
ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30806 static int ZEND_FASTCALL  ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30807 {
30808 	USE_OPLINE
30809 
30810 	zval *retval = &EX_T(opline->result.var).tmp_var;
30811 
30812 	SAVE_OPLINE();
30813 	/* PHP 3.0 returned "" for false and 1 for true, here we use 0 and 1 for now */
30814 	ZVAL_BOOL(retval, i_zend_is_true(_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC)));
30815 
30816 	CHECK_EXCEPTION();
30817 	ZEND_VM_NEXT_OPCODE();
30818 }
30819 
ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30820 static int ZEND_FASTCALL  ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30821 {
30822 	USE_OPLINE
30823 
30824 	zval *obj;
30825 	zend_class_entry *ce;
30826 	zend_function *clone;
30827 	zend_object_clone_obj_t clone_call;
30828 
30829 	SAVE_OPLINE();
30830 	obj = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30831 
30832 	if (IS_CV == IS_CONST ||
30833 	    UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
30834 		if (UNEXPECTED(EG(exception) != NULL)) {
30835 			HANDLE_EXCEPTION();
30836 		}
30837 		zend_error_noreturn(E_ERROR, "__clone method called on non-object");
30838 	}
30839 
30840 	ce = Z_OBJCE_P(obj);
30841 	clone = ce ? ce->clone : NULL;
30842 	clone_call =  Z_OBJ_HT_P(obj)->clone_obj;
30843 	if (UNEXPECTED(clone_call == NULL)) {
30844 		if (ce) {
30845 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s", ce->name);
30846 		} else {
30847 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object");
30848 		}
30849 	}
30850 
30851 	if (ce && clone) {
30852 		if (clone->op_array.fn_flags & ZEND_ACC_PRIVATE) {
30853 			/* Ensure that if we're calling a private function, we're allowed to do so.
30854 			 */
30855 			if (UNEXPECTED(ce != EG(scope))) {
30856 				zend_error_noreturn(E_ERROR, "Call to private %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
30857 			}
30858 		} else if ((clone->common.fn_flags & ZEND_ACC_PROTECTED)) {
30859 			/* Ensure that if we're calling a protected function, we're allowed to do so.
30860 			 */
30861 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(clone), EG(scope)))) {
30862 				zend_error_noreturn(E_ERROR, "Call to protected %s::__clone() from context '%s'", ce->name, EG(scope) ? EG(scope)->name : "");
30863 			}
30864 		}
30865 	}
30866 
30867 	if (EXPECTED(EG(exception) == NULL)) {
30868 		zval *retval;
30869 
30870 		ALLOC_ZVAL(retval);
30871 		Z_OBJVAL_P(retval) = clone_call(obj TSRMLS_CC);
30872 		Z_TYPE_P(retval) = IS_OBJECT;
30873 		Z_SET_REFCOUNT_P(retval, 1);
30874 		Z_SET_ISREF_P(retval);
30875 		if (!RETURN_VALUE_USED(opline) || UNEXPECTED(EG(exception) != NULL)) {
30876 			zval_ptr_dtor(&retval);
30877 		} else {
30878 			AI_SET_PTR(&EX_T(opline->result.var), retval);
30879 		}
30880 	}
30881 
30882 	CHECK_EXCEPTION();
30883 	ZEND_VM_NEXT_OPCODE();
30884 }
30885 
ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30886 static int ZEND_FASTCALL  ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30887 {
30888 	USE_OPLINE
30889 
30890 	zval *expr;
30891 	zval *result = &EX_T(opline->result.var).tmp_var;
30892 
30893 	SAVE_OPLINE();
30894 	expr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30895 
30896 	if (opline->extended_value != IS_STRING) {
30897 		ZVAL_COPY_VALUE(result, expr);
30898 		if (!0) {
30899 			zendi_zval_copy_ctor(*result);
30900 		}
30901 	}
30902 	switch (opline->extended_value) {
30903 		case IS_NULL:
30904 			convert_to_null(result);
30905 			break;
30906 		case IS_BOOL:
30907 			convert_to_boolean(result);
30908 			break;
30909 		case IS_LONG:
30910 			convert_to_long(result);
30911 			break;
30912 		case IS_DOUBLE:
30913 			convert_to_double(result);
30914 			break;
30915 		case IS_STRING: {
30916 			zval var_copy;
30917 			int use_copy;
30918 
30919 			zend_make_printable_zval(expr, &var_copy, &use_copy);
30920 			if (use_copy) {
30921 				ZVAL_COPY_VALUE(result, &var_copy);
30922 				if (0) {
30923 
30924 				}
30925 			} else {
30926 				ZVAL_COPY_VALUE(result, expr);
30927 				if (!0) {
30928 					zendi_zval_copy_ctor(*result);
30929 				}
30930 			}
30931 			break;
30932 		}
30933 		case IS_ARRAY:
30934 			convert_to_array(result);
30935 			break;
30936 		case IS_OBJECT:
30937 			convert_to_object(result);
30938 			break;
30939 	}
30940 
30941 	CHECK_EXCEPTION();
30942 	ZEND_VM_NEXT_OPCODE();
30943 }
30944 
ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)30945 static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
30946 {
30947 	USE_OPLINE
30948 	zend_op_array *new_op_array=NULL;
30949 
30950 	zval *inc_filename;
30951 	zval *tmp_inc_filename = NULL;
30952 	zend_bool failure_retval=0;
30953 
30954 	SAVE_OPLINE();
30955 	inc_filename = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
30956 
30957 	if (inc_filename->type!=IS_STRING) {
30958 		MAKE_STD_ZVAL(tmp_inc_filename);
30959 		ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
30960 		zval_copy_ctor(tmp_inc_filename);
30961 		convert_to_string(tmp_inc_filename);
30962 		inc_filename = tmp_inc_filename;
30963 	}
30964 
30965 	if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
30966 		if (opline->extended_value == ZEND_INCLUDE_ONCE || opline->extended_value == ZEND_INCLUDE) {
30967 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
30968 		} else {
30969 			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
30970 		}
30971 	} else {
30972 		switch (opline->extended_value) {
30973 			case ZEND_INCLUDE_ONCE:
30974 			case ZEND_REQUIRE_ONCE: {
30975 					zend_file_handle file_handle;
30976 					char *resolved_path;
30977 
30978 					resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename) TSRMLS_CC);
30979 					if (resolved_path) {
30980 						failure_retval = zend_hash_exists(&EG(included_files), resolved_path, strlen(resolved_path)+1);
30981 					} else {
30982 						resolved_path = Z_STRVAL_P(inc_filename);
30983 					}
30984 
30985 					if (failure_retval) {
30986 						/* do nothing, file already included */
30987 					} else if (SUCCESS == zend_stream_open(resolved_path, &file_handle TSRMLS_CC)) {
30988 
30989 						if (!file_handle.opened_path) {
30990 							file_handle.opened_path = estrdup(resolved_path);
30991 						}
30992 
30993 						if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path, strlen(file_handle.opened_path)+1)==SUCCESS) {
30994 							new_op_array = zend_compile_file(&file_handle, (opline->extended_value==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE) TSRMLS_CC);
30995 							zend_destroy_file_handle(&file_handle TSRMLS_CC);
30996 						} else {
30997 							zend_file_handle_dtor(&file_handle TSRMLS_CC);
30998 							failure_retval=1;
30999 						}
31000 					} else {
31001 						if (opline->extended_value == ZEND_INCLUDE_ONCE) {
31002 							zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
31003 						} else {
31004 							zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, Z_STRVAL_P(inc_filename) TSRMLS_CC);
31005 						}
31006 					}
31007 					if (resolved_path != Z_STRVAL_P(inc_filename)) {
31008 						efree(resolved_path);
31009 					}
31010 				}
31011 				break;
31012 			case ZEND_INCLUDE:
31013 			case ZEND_REQUIRE:
31014 				new_op_array = compile_filename(opline->extended_value, inc_filename TSRMLS_CC);
31015 				break;
31016 			case ZEND_EVAL: {
31017 					char *eval_desc = zend_make_compiled_string_description("eval()'d code" TSRMLS_CC);
31018 
31019 					new_op_array = zend_compile_string(inc_filename, eval_desc TSRMLS_CC);
31020 					efree(eval_desc);
31021 				}
31022 				break;
31023 			EMPTY_SWITCH_DEFAULT_CASE()
31024 		}
31025 	}
31026 	if (tmp_inc_filename) {
31027 		zval_ptr_dtor(&tmp_inc_filename);
31028 	}
31029 
31030 	if (UNEXPECTED(EG(exception) != NULL)) {
31031 		HANDLE_EXCEPTION();
31032 	} else if (EXPECTED(new_op_array != NULL)) {
31033 		EX(original_return_value) = EG(return_value_ptr_ptr);
31034 		EG(active_op_array) = new_op_array;
31035 		if (RETURN_VALUE_USED(opline)) {
31036 			EX_T(opline->result.var).var.ptr = NULL;
31037 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
31038 			EG(return_value_ptr_ptr) = EX_T(opline->result.var).var.ptr_ptr;
31039 		} else {
31040 			EG(return_value_ptr_ptr) = NULL;
31041 		}
31042 
31043 		EX(function_state).function = (zend_function *) new_op_array;
31044 		EX(object) = NULL;
31045 
31046 		if (!EG(active_symbol_table)) {
31047 			zend_rebuild_symbol_table(TSRMLS_C);
31048 		}
31049 
31050 		if (EXPECTED(zend_execute_ex == execute_ex)) {
31051 			ZEND_VM_ENTER();
31052 		} else {
31053 			zend_execute(new_op_array TSRMLS_CC);
31054 		}
31055 
31056 		EX(function_state).function = (zend_function *) EX(op_array);
31057 
31058 		EG(opline_ptr) = &EX(opline);
31059 		EG(active_op_array) = EX(op_array);
31060 		EG(return_value_ptr_ptr) = EX(original_return_value);
31061 		destroy_op_array(new_op_array TSRMLS_CC);
31062 		efree(new_op_array);
31063 		if (UNEXPECTED(EG(exception) != NULL)) {
31064 			zend_throw_exception_internal(NULL TSRMLS_CC);
31065 			HANDLE_EXCEPTION();
31066 		}
31067 
31068 	} else if (RETURN_VALUE_USED(opline)) {
31069 		zval *retval;
31070 
31071 		ALLOC_ZVAL(retval);
31072 		ZVAL_BOOL(retval, failure_retval);
31073 		INIT_PZVAL(retval);
31074 		AI_SET_PTR(&EX_T(opline->result.var), retval);
31075 	}
31076 	ZEND_VM_NEXT_OPCODE();
31077 }
31078 
ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31079 static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31080 {
31081 	USE_OPLINE
31082 
31083 	zval *array_ptr, **array_ptr_ptr;
31084 	HashTable *fe_ht;
31085 	zend_object_iterator *iter = NULL;
31086 	zend_class_entry *ce = NULL;
31087 	zend_bool is_empty = 0;
31088 
31089 	SAVE_OPLINE();
31090 
31091 	if ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
31092 	    (opline->extended_value & ZEND_FE_RESET_VARIABLE)) {
31093 		array_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31094 		if (array_ptr_ptr == NULL || array_ptr_ptr == &EG(uninitialized_zval_ptr)) {
31095 			MAKE_STD_ZVAL(array_ptr);
31096 			ZVAL_NULL(array_ptr);
31097 		} else if (Z_TYPE_PP(array_ptr_ptr) == IS_OBJECT) {
31098 			if(Z_OBJ_HT_PP(array_ptr_ptr)->get_class_entry == NULL) {
31099 				zend_error(E_WARNING, "foreach() cannot iterate over objects without PHP class");
31100 				ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
31101 			}
31102 
31103 			ce = Z_OBJCE_PP(array_ptr_ptr);
31104 			if (!ce || ce->get_iterator == NULL) {
31105 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
31106 				Z_ADDREF_PP(array_ptr_ptr);
31107 			}
31108 			array_ptr = *array_ptr_ptr;
31109 		} else {
31110 			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
31111 				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
31112 				if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
31113 					Z_SET_ISREF_PP(array_ptr_ptr);
31114 				}
31115 			}
31116 			array_ptr = *array_ptr_ptr;
31117 			Z_ADDREF_P(array_ptr);
31118 		}
31119 	} else {
31120 		array_ptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31121 		if (0) { /* IS_TMP_VAR */
31122 			zval *tmp;
31123 
31124 			ALLOC_ZVAL(tmp);
31125 			INIT_PZVAL_COPY(tmp, array_ptr);
31126 			array_ptr = tmp;
31127 			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
31128 				ce = Z_OBJCE_P(array_ptr);
31129 				if (ce && ce->get_iterator) {
31130 					Z_DELREF_P(array_ptr);
31131 				}
31132 			}
31133 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
31134 			ce = Z_OBJCE_P(array_ptr);
31135 			if (!ce || !ce->get_iterator) {
31136 				Z_ADDREF_P(array_ptr);
31137 			}
31138 		} else if (IS_CV == IS_CONST ||
31139 		           ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
31140 		            !Z_ISREF_P(array_ptr) &&
31141 		            Z_REFCOUNT_P(array_ptr) > 1)) {
31142 			zval *tmp;
31143 
31144 			ALLOC_ZVAL(tmp);
31145 			INIT_PZVAL_COPY(tmp, array_ptr);
31146 			zval_copy_ctor(tmp);
31147 			array_ptr = tmp;
31148 		} else {
31149 			Z_ADDREF_P(array_ptr);
31150 		}
31151 	}
31152 
31153 	if (ce && ce->get_iterator) {
31154 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);
31155 
31156 		if (iter && EXPECTED(EG(exception) == NULL)) {
31157 			array_ptr = zend_iterator_wrap(iter TSRMLS_CC);
31158 		} else {
31159 
31160 			if (!EG(exception)) {
31161 				zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Object of type %s did not create an Iterator", ce->name);
31162 			}
31163 			zend_throw_exception_internal(NULL TSRMLS_CC);
31164 			HANDLE_EXCEPTION();
31165 		}
31166 	}
31167 
31168 	EX_T(opline->result.var).fe.ptr = array_ptr;
31169 
31170 	if (iter) {
31171 		iter->index = 0;
31172 		if (iter->funcs->rewind) {
31173 			iter->funcs->rewind(iter TSRMLS_CC);
31174 			if (UNEXPECTED(EG(exception) != NULL)) {
31175 				zval_ptr_dtor(&array_ptr);
31176 
31177 				HANDLE_EXCEPTION();
31178 			}
31179 		}
31180 		is_empty = iter->funcs->valid(iter TSRMLS_CC) != SUCCESS;
31181 		if (UNEXPECTED(EG(exception) != NULL)) {
31182 			zval_ptr_dtor(&array_ptr);
31183 
31184 			HANDLE_EXCEPTION();
31185 		}
31186 		iter->index = -1; /* will be set to 0 before using next handler */
31187 	} else if ((fe_ht = HASH_OF(array_ptr)) != NULL) {
31188 		zend_hash_internal_pointer_reset(fe_ht);
31189 		if (ce) {
31190 			zend_object *zobj = zend_objects_get_address(array_ptr TSRMLS_CC);
31191 			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {
31192 				char *str_key;
31193 				uint str_key_len;
31194 				ulong int_key;
31195 				zend_uchar key_type;
31196 
31197 				key_type = zend_hash_get_current_key_ex(fe_ht, &str_key, &str_key_len, &int_key, 0, NULL);
31198 				if (key_type != HASH_KEY_NON_EXISTENT &&
31199 					(key_type == HASH_KEY_IS_LONG ||
31200 				     zend_check_property_access(zobj, str_key, str_key_len-1 TSRMLS_CC) == SUCCESS)) {
31201 					break;
31202 				}
31203 				zend_hash_move_forward(fe_ht);
31204 			}
31205 		}
31206 		is_empty = zend_hash_has_more_elements(fe_ht) != SUCCESS;
31207 		zend_hash_get_pointer(fe_ht, &EX_T(opline->result.var).fe.fe_pos);
31208 	} else {
31209 		zend_error(E_WARNING, "Invalid argument supplied for foreach()");
31210 		is_empty = 1;
31211 	}
31212 
31213 	if (is_empty) {
31214 		ZEND_VM_JMP(EX(op_array)->opcodes+opline->op2.opline_num);
31215 	} else {
31216 		CHECK_EXCEPTION();
31217 		ZEND_VM_NEXT_OPCODE();
31218 	}
31219 }
31220 
ZEND_EXIT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31221 static int ZEND_FASTCALL  ZEND_EXIT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31222 {
31223 #if 0 || (IS_CV != IS_UNUSED)
31224 	USE_OPLINE
31225 
31226 	SAVE_OPLINE();
31227 	if (IS_CV != IS_UNUSED) {
31228 
31229 		zval *ptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31230 
31231 		if (Z_TYPE_P(ptr) == IS_LONG) {
31232 			EG(exit_status) = Z_LVAL_P(ptr);
31233 		} else {
31234 			zend_print_variable(ptr);
31235 		}
31236 
31237 	}
31238 #endif
31239 	zend_bailout();
31240 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
31241 }
31242 
ZEND_JMP_SET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31243 static int ZEND_FASTCALL  ZEND_JMP_SET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31244 {
31245 	USE_OPLINE
31246 
31247 	zval *value;
31248 
31249 	SAVE_OPLINE();
31250 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31251 
31252 	if (i_zend_is_true(value)) {
31253 		ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
31254 		if (!0) {
31255 			zendi_zval_copy_ctor(EX_T(opline->result.var).tmp_var);
31256 		}
31257 
31258 #if DEBUG_ZEND>=2
31259 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
31260 #endif
31261 		ZEND_VM_JMP(opline->op2.jmp_addr);
31262 	}
31263 
31264 	CHECK_EXCEPTION();
31265 	ZEND_VM_NEXT_OPCODE();
31266 }
31267 
ZEND_JMP_SET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31268 static int ZEND_FASTCALL  ZEND_JMP_SET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31269 {
31270 	USE_OPLINE
31271 
31272 	zval *value, *ret;
31273 
31274 	SAVE_OPLINE();
31275 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31276 
31277 	if (i_zend_is_true(value)) {
31278 		if (IS_CV == IS_VAR || IS_CV == IS_CV) {
31279 			Z_ADDREF_P(value);
31280 			EX_T(opline->result.var).var.ptr = value;
31281 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
31282 		} else {
31283 			ALLOC_ZVAL(ret);
31284 			INIT_PZVAL_COPY(ret, value);
31285 			EX_T(opline->result.var).var.ptr = ret;
31286 			EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
31287 			if (!0) {
31288 				zval_copy_ctor(EX_T(opline->result.var).var.ptr);
31289 			}
31290 		}
31291 
31292 #if DEBUG_ZEND>=2
31293 		printf("Conditional jmp to %d\n", opline->op2.opline_num);
31294 #endif
31295 		ZEND_VM_JMP(opline->op2.jmp_addr);
31296 	}
31297 
31298 	CHECK_EXCEPTION();
31299 	ZEND_VM_NEXT_OPCODE();
31300 }
31301 
ZEND_QM_ASSIGN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31302 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31303 {
31304 	USE_OPLINE
31305 
31306 	zval *value;
31307 
31308 	SAVE_OPLINE();
31309 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31310 
31311 	ZVAL_COPY_VALUE(&EX_T(opline->result.var).tmp_var, value);
31312 	if (!0) {
31313 		zval_copy_ctor(&EX_T(opline->result.var).tmp_var);
31314 	}
31315 
31316 	CHECK_EXCEPTION();
31317 	ZEND_VM_NEXT_OPCODE();
31318 }
31319 
ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31320 static int ZEND_FASTCALL  ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31321 {
31322 	USE_OPLINE
31323 
31324 	zval *value, *ret;
31325 
31326 	SAVE_OPLINE();
31327 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31328 
31329 	if (IS_CV == IS_VAR || IS_CV == IS_CV) {
31330 		Z_ADDREF_P(value);
31331 		EX_T(opline->result.var).var.ptr = value;
31332 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
31333 	} else {
31334 		ALLOC_ZVAL(ret);
31335 		INIT_PZVAL_COPY(ret, value);
31336 		EX_T(opline->result.var).var.ptr = ret;
31337 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
31338 		if (!0) {
31339 			zval_copy_ctor(EX_T(opline->result.var).var.ptr);
31340 		}
31341 	}
31342 
31343 	CHECK_EXCEPTION();
31344 	ZEND_VM_NEXT_OPCODE();
31345 }
31346 
ZEND_INSTANCEOF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31347 static int ZEND_FASTCALL  ZEND_INSTANCEOF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31348 {
31349 	USE_OPLINE
31350 
31351 	zval *expr;
31352 	zend_bool result;
31353 
31354 	SAVE_OPLINE();
31355 	expr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
31356 
31357 	if (Z_TYPE_P(expr) == IS_OBJECT && Z_OBJ_HT_P(expr)->get_class_entry) {
31358 		result = instanceof_function(Z_OBJCE_P(expr), EX_T(opline->op2.var).class_entry TSRMLS_CC);
31359 	} else {
31360 		result = 0;
31361 	}
31362 	ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, result);
31363 
31364 	CHECK_EXCEPTION();
31365 	ZEND_VM_NEXT_OPCODE();
31366 }
31367 
ZEND_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31368 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31369 {
31370 	USE_OPLINE
31371 
31372 
31373 	SAVE_OPLINE();
31374 	fast_add_function(&EX_T(opline->result.var).tmp_var,
31375 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31376 		opline->op2.zv TSRMLS_CC);
31377 
31378 
31379 	CHECK_EXCEPTION();
31380 	ZEND_VM_NEXT_OPCODE();
31381 }
31382 
ZEND_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31383 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31384 {
31385 	USE_OPLINE
31386 
31387 
31388 	SAVE_OPLINE();
31389 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
31390 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31391 		opline->op2.zv TSRMLS_CC);
31392 
31393 
31394 	CHECK_EXCEPTION();
31395 	ZEND_VM_NEXT_OPCODE();
31396 }
31397 
ZEND_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31398 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31399 {
31400 	USE_OPLINE
31401 
31402 
31403 	SAVE_OPLINE();
31404 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
31405 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31406 		opline->op2.zv TSRMLS_CC);
31407 
31408 
31409 	CHECK_EXCEPTION();
31410 	ZEND_VM_NEXT_OPCODE();
31411 }
31412 
ZEND_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31413 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31414 {
31415 	USE_OPLINE
31416 
31417 
31418 	SAVE_OPLINE();
31419 	fast_div_function(&EX_T(opline->result.var).tmp_var,
31420 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31421 		opline->op2.zv TSRMLS_CC);
31422 
31423 
31424 	CHECK_EXCEPTION();
31425 	ZEND_VM_NEXT_OPCODE();
31426 }
31427 
ZEND_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31428 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31429 {
31430 	USE_OPLINE
31431 
31432 
31433 	SAVE_OPLINE();
31434 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
31435 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31436 		opline->op2.zv TSRMLS_CC);
31437 
31438 
31439 	CHECK_EXCEPTION();
31440 	ZEND_VM_NEXT_OPCODE();
31441 }
31442 
ZEND_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31443 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31444 {
31445 	USE_OPLINE
31446 
31447 
31448 	SAVE_OPLINE();
31449 	shift_left_function(&EX_T(opline->result.var).tmp_var,
31450 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31451 		opline->op2.zv TSRMLS_CC);
31452 
31453 
31454 	CHECK_EXCEPTION();
31455 	ZEND_VM_NEXT_OPCODE();
31456 }
31457 
ZEND_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31458 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31459 {
31460 	USE_OPLINE
31461 
31462 
31463 	SAVE_OPLINE();
31464 	shift_right_function(&EX_T(opline->result.var).tmp_var,
31465 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31466 		opline->op2.zv TSRMLS_CC);
31467 
31468 
31469 	CHECK_EXCEPTION();
31470 	ZEND_VM_NEXT_OPCODE();
31471 }
31472 
ZEND_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31473 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31474 {
31475 	USE_OPLINE
31476 
31477 
31478 	SAVE_OPLINE();
31479 	concat_function(&EX_T(opline->result.var).tmp_var,
31480 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31481 		opline->op2.zv TSRMLS_CC);
31482 
31483 
31484 	CHECK_EXCEPTION();
31485 	ZEND_VM_NEXT_OPCODE();
31486 }
31487 
ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31488 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31489 {
31490 	USE_OPLINE
31491 
31492 
31493 	SAVE_OPLINE();
31494 	is_identical_function(&EX_T(opline->result.var).tmp_var,
31495 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31496 		opline->op2.zv TSRMLS_CC);
31497 
31498 
31499 	CHECK_EXCEPTION();
31500 	ZEND_VM_NEXT_OPCODE();
31501 }
31502 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31503 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31504 {
31505 	USE_OPLINE
31506 
31507 	zval *result = &EX_T(opline->result.var).tmp_var;
31508 
31509 	SAVE_OPLINE();
31510 	is_identical_function(result,
31511 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31512 		opline->op2.zv TSRMLS_CC);
31513 	Z_LVAL_P(result) = !Z_LVAL_P(result);
31514 
31515 
31516 	CHECK_EXCEPTION();
31517 	ZEND_VM_NEXT_OPCODE();
31518 }
31519 
ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31520 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31521 {
31522 	USE_OPLINE
31523 
31524 	zval *result = &EX_T(opline->result.var).tmp_var;
31525 
31526 	SAVE_OPLINE();
31527 	ZVAL_BOOL(result, fast_equal_function(result,
31528 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31529 		opline->op2.zv TSRMLS_CC));
31530 
31531 
31532 	CHECK_EXCEPTION();
31533 	ZEND_VM_NEXT_OPCODE();
31534 }
31535 
ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31536 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31537 {
31538 	USE_OPLINE
31539 
31540 	zval *result = &EX_T(opline->result.var).tmp_var;
31541 
31542 	SAVE_OPLINE();
31543 	ZVAL_BOOL(result, fast_not_equal_function(result,
31544 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31545 		opline->op2.zv TSRMLS_CC));
31546 
31547 
31548 	CHECK_EXCEPTION();
31549 	ZEND_VM_NEXT_OPCODE();
31550 }
31551 
ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31552 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31553 {
31554 	USE_OPLINE
31555 
31556 	zval *result = &EX_T(opline->result.var).tmp_var;
31557 
31558 	SAVE_OPLINE();
31559 	ZVAL_BOOL(result, fast_is_smaller_function(result,
31560 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31561 		opline->op2.zv TSRMLS_CC));
31562 
31563 
31564 	CHECK_EXCEPTION();
31565 	ZEND_VM_NEXT_OPCODE();
31566 }
31567 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31568 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31569 {
31570 	USE_OPLINE
31571 
31572 	zval *result = &EX_T(opline->result.var).tmp_var;
31573 
31574 	SAVE_OPLINE();
31575 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
31576 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31577 		opline->op2.zv TSRMLS_CC));
31578 
31579 
31580 	CHECK_EXCEPTION();
31581 	ZEND_VM_NEXT_OPCODE();
31582 }
31583 
ZEND_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31584 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31585 {
31586 	USE_OPLINE
31587 
31588 
31589 	SAVE_OPLINE();
31590 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
31591 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31592 		opline->op2.zv TSRMLS_CC);
31593 
31594 
31595 	CHECK_EXCEPTION();
31596 	ZEND_VM_NEXT_OPCODE();
31597 }
31598 
ZEND_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31599 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31600 {
31601 	USE_OPLINE
31602 
31603 
31604 	SAVE_OPLINE();
31605 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
31606 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31607 		opline->op2.zv TSRMLS_CC);
31608 
31609 
31610 	CHECK_EXCEPTION();
31611 	ZEND_VM_NEXT_OPCODE();
31612 }
31613 
ZEND_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31614 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31615 {
31616 	USE_OPLINE
31617 
31618 
31619 	SAVE_OPLINE();
31620 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
31621 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31622 		opline->op2.zv TSRMLS_CC);
31623 
31624 
31625 	CHECK_EXCEPTION();
31626 	ZEND_VM_NEXT_OPCODE();
31627 }
31628 
ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31629 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31630 {
31631 	USE_OPLINE
31632 
31633 
31634 	SAVE_OPLINE();
31635 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
31636 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
31637 		opline->op2.zv TSRMLS_CC);
31638 
31639 
31640 	CHECK_EXCEPTION();
31641 	ZEND_VM_NEXT_OPCODE();
31642 }
31643 
zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)31644 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
31645 {
31646 	USE_OPLINE
31647 	zend_free_op free_op_data1;
31648 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
31649 	zval *object;
31650 	zval *property = opline->op2.zv;
31651 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
31652 	int have_get_ptr = 0;
31653 
31654 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
31655 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
31656 	}
31657 
31658 	make_real_object(object_ptr TSRMLS_CC);
31659 	object = *object_ptr;
31660 
31661 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
31662 		zend_error(E_WARNING, "Attempt to assign property of non-object");
31663 
31664 		FREE_OP(free_op_data1);
31665 
31666 		if (RETURN_VALUE_USED(opline)) {
31667 			PZVAL_LOCK(&EG(uninitialized_zval));
31668 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
31669 			EX_T(opline->result.var).var.ptr_ptr = NULL;
31670 		}
31671 	} else {
31672 		/* here we are sure we are dealing with an object */
31673 		if (0) {
31674 			MAKE_REAL_ZVAL_PTR(property);
31675 		}
31676 
31677 		/* here property is a string */
31678 		if (opline->extended_value == ZEND_ASSIGN_OBJ
31679 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
31680 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31681 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
31682 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
31683 
31684 				have_get_ptr = 1;
31685 				binary_op(*zptr, *zptr, value TSRMLS_CC);
31686 				if (RETURN_VALUE_USED(opline)) {
31687 					PZVAL_LOCK(*zptr);
31688 					EX_T(opline->result.var).var.ptr = *zptr;
31689 					EX_T(opline->result.var).var.ptr_ptr = NULL;
31690 				}
31691 			}
31692 		}
31693 
31694 		if (!have_get_ptr) {
31695 			zval *z = NULL;
31696 
31697 			Z_ADDREF_P(object);
31698 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
31699 				if (Z_OBJ_HT_P(object)->read_property) {
31700 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31701 				}
31702 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
31703 				if (Z_OBJ_HT_P(object)->read_dimension) {
31704 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
31705 				}
31706 			}
31707 			if (z) {
31708 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
31709 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
31710 
31711 					if (Z_REFCOUNT_P(z) == 0) {
31712 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
31713 						zval_dtor(z);
31714 						FREE_ZVAL(z);
31715 					}
31716 					z = value;
31717 				}
31718 				Z_ADDREF_P(z);
31719 				SEPARATE_ZVAL_IF_NOT_REF(&z);
31720 				binary_op(z, z, value TSRMLS_CC);
31721 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
31722 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31723 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
31724 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
31725 				}
31726 				if (RETURN_VALUE_USED(opline)) {
31727 					PZVAL_LOCK(z);
31728 					EX_T(opline->result.var).var.ptr = z;
31729 					EX_T(opline->result.var).var.ptr_ptr = NULL;
31730 				}
31731 				zval_ptr_dtor(&z);
31732 			} else {
31733 				zend_error(E_WARNING, "Attempt to assign property of non-object");
31734 				if (RETURN_VALUE_USED(opline)) {
31735 					PZVAL_LOCK(&EG(uninitialized_zval));
31736 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
31737 					EX_T(opline->result.var).var.ptr_ptr = NULL;
31738 				}
31739 			}
31740 			zval_ptr_dtor(&object);
31741 		}
31742 
31743 		if (0) {
31744 			zval_ptr_dtor(&property);
31745 		} else {
31746 
31747 		}
31748 		FREE_OP(free_op_data1);
31749 	}
31750 
31751 	/* assign_obj has two opcodes! */
31752 	CHECK_EXCEPTION();
31753 	ZEND_VM_INC_OPCODE();
31754 	ZEND_VM_NEXT_OPCODE();
31755 }
31756 
zend_binary_assign_op_helper_SPEC_CV_CONST(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)31757 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_CONST(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
31758 {
31759 	USE_OPLINE
31760 	zend_free_op free_op_data2, free_op_data1;
31761 	zval **var_ptr;
31762 	zval *value;
31763 
31764 	SAVE_OPLINE();
31765 	switch (opline->extended_value) {
31766 		case ZEND_ASSIGN_OBJ:
31767 			return zend_binary_assign_op_obj_helper_SPEC_CV_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31768 			break;
31769 		case ZEND_ASSIGN_DIM: {
31770 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
31771 
31772 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
31773 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
31774 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
31775 					if (IS_CV == IS_VAR && !0) {
31776 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
31777 					}
31778 					return zend_binary_assign_op_obj_helper_SPEC_CV_CONST(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31779 				} else {
31780 					zval *dim = opline->op2.zv;
31781 
31782 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CONST, BP_VAR_RW TSRMLS_CC);
31783 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
31784 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
31785 				}
31786 			}
31787 			break;
31788 		default:
31789 			value = opline->op2.zv;
31790 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
31791 			/* do nothing */
31792 			break;
31793 	}
31794 
31795 	if (UNEXPECTED(var_ptr == NULL)) {
31796 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
31797 	}
31798 
31799 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
31800 		if (RETURN_VALUE_USED(opline)) {
31801 			PZVAL_LOCK(&EG(uninitialized_zval));
31802 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
31803 		}
31804 
31805 
31806 		CHECK_EXCEPTION();
31807 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
31808 			ZEND_VM_INC_OPCODE();
31809 		}
31810 		ZEND_VM_NEXT_OPCODE();
31811 	}
31812 
31813 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
31814 
31815 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
31816 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
31817 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
31818 		/* proxy object */
31819 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
31820 		Z_ADDREF_P(objval);
31821 		binary_op(objval, objval, value TSRMLS_CC);
31822 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
31823 		zval_ptr_dtor(&objval);
31824 	} else {
31825 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
31826 	}
31827 
31828 	if (RETURN_VALUE_USED(opline)) {
31829 		PZVAL_LOCK(*var_ptr);
31830 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
31831 	}
31832 
31833 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
31834 		FREE_OP(free_op_data1);
31835 		FREE_OP_VAR_PTR(free_op_data2);
31836 
31837 		CHECK_EXCEPTION();
31838 		ZEND_VM_INC_OPCODE();
31839 	} else {
31840 
31841 		CHECK_EXCEPTION();
31842 	}
31843 	ZEND_VM_NEXT_OPCODE();
31844 }
31845 
ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31846 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31847 {
31848 	return zend_binary_assign_op_helper_SPEC_CV_CONST(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31849 }
31850 
ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31851 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31852 {
31853 	return zend_binary_assign_op_helper_SPEC_CV_CONST(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31854 }
31855 
ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31856 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31857 {
31858 	return zend_binary_assign_op_helper_SPEC_CV_CONST(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31859 }
31860 
ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31861 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31862 {
31863 	return zend_binary_assign_op_helper_SPEC_CV_CONST(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31864 }
31865 
ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31866 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31867 {
31868 	return zend_binary_assign_op_helper_SPEC_CV_CONST(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31869 }
31870 
ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31871 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31872 {
31873 	return zend_binary_assign_op_helper_SPEC_CV_CONST(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31874 }
31875 
ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31876 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31877 {
31878 	return zend_binary_assign_op_helper_SPEC_CV_CONST(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31879 }
31880 
ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31881 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31882 {
31883 	return zend_binary_assign_op_helper_SPEC_CV_CONST(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31884 }
31885 
ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31886 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31887 {
31888 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31889 }
31890 
ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31891 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31892 {
31893 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31894 }
31895 
ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31896 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
31897 {
31898 	return zend_binary_assign_op_helper_SPEC_CV_CONST(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
31899 }
31900 
zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)31901 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
31902 {
31903 	USE_OPLINE
31904 
31905 	zval **object_ptr;
31906 	zval *object;
31907 	zval *property;
31908 	zval **retval;
31909 	int have_get_ptr = 0;
31910 
31911 	SAVE_OPLINE();
31912 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
31913 	property = opline->op2.zv;
31914 	retval = &EX_T(opline->result.var).var.ptr;
31915 
31916 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
31917 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
31918 	}
31919 
31920 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
31921 	object = *object_ptr;
31922 
31923 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
31924 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
31925 
31926 		if (RETURN_VALUE_USED(opline)) {
31927 			PZVAL_LOCK(&EG(uninitialized_zval));
31928 			*retval = &EG(uninitialized_zval);
31929 		}
31930 
31931 		CHECK_EXCEPTION();
31932 		ZEND_VM_NEXT_OPCODE();
31933 	}
31934 
31935 	/* here we are sure we are dealing with an object */
31936 
31937 	if (0) {
31938 		MAKE_REAL_ZVAL_PTR(property);
31939 	}
31940 
31941 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
31942 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31943 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
31944 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
31945 
31946 			have_get_ptr = 1;
31947 			incdec_op(*zptr);
31948 			if (RETURN_VALUE_USED(opline)) {
31949 				*retval = *zptr;
31950 				PZVAL_LOCK(*retval);
31951 			}
31952 		}
31953 	}
31954 
31955 	if (!have_get_ptr) {
31956 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
31957 			zval *z;
31958 
31959 			Z_ADDREF_P(object);
31960 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31961 
31962 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
31963 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
31964 
31965 				if (Z_REFCOUNT_P(z) == 0) {
31966 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
31967 					zval_dtor(z);
31968 					FREE_ZVAL(z);
31969 				}
31970 				z = value;
31971 			}
31972 			Z_ADDREF_P(z);
31973 			SEPARATE_ZVAL_IF_NOT_REF(&z);
31974 			incdec_op(z);
31975 			*retval = z;
31976 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
31977 			zval_ptr_dtor(&object);
31978 			SELECTIVE_PZVAL_LOCK(*retval, opline);
31979 			zval_ptr_dtor(&z);
31980 		} else {
31981 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
31982 			if (RETURN_VALUE_USED(opline)) {
31983 				PZVAL_LOCK(&EG(uninitialized_zval));
31984 				*retval = &EG(uninitialized_zval);
31985 			}
31986 		}
31987 	}
31988 
31989 	if (0) {
31990 		zval_ptr_dtor(&property);
31991 	} else {
31992 
31993 	}
31994 
31995 	CHECK_EXCEPTION();
31996 	ZEND_VM_NEXT_OPCODE();
31997 }
31998 
ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)31999 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32000 {
32001 	return zend_pre_incdec_property_helper_SPEC_CV_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32002 }
32003 
ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32004 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32005 {
32006 	return zend_pre_incdec_property_helper_SPEC_CV_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32007 }
32008 
zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)32009 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
32010 {
32011 	USE_OPLINE
32012 
32013 	zval **object_ptr;
32014 	zval *object;
32015 	zval *property;
32016 	zval *retval;
32017 	int have_get_ptr = 0;
32018 
32019 	SAVE_OPLINE();
32020 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
32021 	property = opline->op2.zv;
32022 	retval = &EX_T(opline->result.var).tmp_var;
32023 
32024 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32025 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
32026 	}
32027 
32028 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
32029 	object = *object_ptr;
32030 
32031 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
32032 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32033 
32034 		ZVAL_NULL(retval);
32035 
32036 		CHECK_EXCEPTION();
32037 		ZEND_VM_NEXT_OPCODE();
32038 	}
32039 
32040 	/* here we are sure we are dealing with an object */
32041 
32042 	if (0) {
32043 		MAKE_REAL_ZVAL_PTR(property);
32044 	}
32045 
32046 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
32047 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32048 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
32049 			have_get_ptr = 1;
32050 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
32051 
32052 			ZVAL_COPY_VALUE(retval, *zptr);
32053 			zendi_zval_copy_ctor(*retval);
32054 
32055 			incdec_op(*zptr);
32056 
32057 		}
32058 	}
32059 
32060 	if (!have_get_ptr) {
32061 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
32062 			zval *z, *z_copy;
32063 
32064 			Z_ADDREF_P(object);
32065 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32066 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
32067 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
32068 
32069 				if (Z_REFCOUNT_P(z) == 0) {
32070 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
32071 					zval_dtor(z);
32072 					FREE_ZVAL(z);
32073 				}
32074 				z = value;
32075 			}
32076 			ZVAL_COPY_VALUE(retval, z);
32077 			zendi_zval_copy_ctor(*retval);
32078 			ALLOC_ZVAL(z_copy);
32079 			INIT_PZVAL_COPY(z_copy, z);
32080 			zendi_zval_copy_ctor(*z_copy);
32081 			incdec_op(z_copy);
32082 			Z_ADDREF_P(z);
32083 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32084 			zval_ptr_dtor(&object);
32085 			zval_ptr_dtor(&z_copy);
32086 			zval_ptr_dtor(&z);
32087 		} else {
32088 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
32089 			ZVAL_NULL(retval);
32090 		}
32091 	}
32092 
32093 	if (0) {
32094 		zval_ptr_dtor(&property);
32095 	} else {
32096 
32097 	}
32098 
32099 	CHECK_EXCEPTION();
32100 	ZEND_VM_NEXT_OPCODE();
32101 }
32102 
ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32103 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32104 {
32105 	return zend_post_incdec_property_helper_SPEC_CV_CONST(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32106 }
32107 
ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32108 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32109 {
32110 	return zend_post_incdec_property_helper_SPEC_CV_CONST(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32111 }
32112 
zend_fetch_var_address_helper_SPEC_CV_CONST(int type,ZEND_OPCODE_HANDLER_ARGS)32113 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_CONST(int type, ZEND_OPCODE_HANDLER_ARGS)
32114 {
32115 	USE_OPLINE
32116 	zend_free_op free_op1;
32117 	zval *varname;
32118 	zval **retval;
32119 	zval tmp_varname;
32120 	HashTable *target_symbol_table;
32121 	ulong hash_value;
32122 
32123 	SAVE_OPLINE();
32124 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32125 
32126  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
32127 		ZVAL_COPY_VALUE(&tmp_varname, varname);
32128 		zval_copy_ctor(&tmp_varname);
32129 		Z_SET_REFCOUNT(tmp_varname, 1);
32130 		Z_UNSET_ISREF(tmp_varname);
32131 		convert_to_string(&tmp_varname);
32132 		varname = &tmp_varname;
32133 	}
32134 
32135 	if (IS_CONST != IS_UNUSED) {
32136 		zend_class_entry *ce;
32137 
32138 		if (IS_CONST == IS_CONST) {
32139 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
32140 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
32141 			} else {
32142 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
32143 				if (UNEXPECTED(ce == NULL)) {
32144 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
32145 						zval_dtor(&tmp_varname);
32146 					}
32147 
32148 					CHECK_EXCEPTION();
32149 					ZEND_VM_NEXT_OPCODE();
32150 				}
32151 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
32152 			}
32153 		} else {
32154 			ce = EX_T(opline->op2.var).class_entry;
32155 		}
32156 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
32157 
32158 	} else {
32159 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
32160 /*
32161 		if (!target_symbol_table) {
32162 			CHECK_EXCEPTION();
32163 			ZEND_VM_NEXT_OPCODE();
32164 		}
32165 */
32166 		if (IS_CV == IS_CONST) {
32167 			hash_value = Z_HASH_P(varname);
32168 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
32169 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
32170 		} else {
32171 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
32172 		}
32173 
32174 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
32175 			switch (type) {
32176 				case BP_VAR_R:
32177 				case BP_VAR_UNSET:
32178 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
32179 					/* break missing intentionally */
32180 				case BP_VAR_IS:
32181 					retval = &EG(uninitialized_zval_ptr);
32182 					break;
32183 				case BP_VAR_RW:
32184 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
32185 					/* break missing intentionally */
32186 				case BP_VAR_W:
32187 					Z_ADDREF_P(&EG(uninitialized_zval));
32188 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
32189 					break;
32190 				EMPTY_SWITCH_DEFAULT_CASE()
32191 			}
32192 		}
32193 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
32194 			case ZEND_FETCH_GLOBAL:
32195 				if (IS_CV != IS_TMP_VAR) {
32196 
32197 				}
32198 				break;
32199 			case ZEND_FETCH_LOCAL:
32200 
32201 				break;
32202 			case ZEND_FETCH_STATIC:
32203 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
32204 				break;
32205 			case ZEND_FETCH_GLOBAL_LOCK:
32206 				if (IS_CV == IS_VAR && !free_op1.var) {
32207 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
32208 				}
32209 				break;
32210 		}
32211 	}
32212 
32213 
32214 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
32215 		zval_dtor(&tmp_varname);
32216 	}
32217 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
32218 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
32219 	}
32220 	PZVAL_LOCK(*retval);
32221 	switch (type) {
32222 		case BP_VAR_R:
32223 		case BP_VAR_IS:
32224 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
32225 			break;
32226 		case BP_VAR_UNSET: {
32227 			zend_free_op free_res;
32228 
32229 			PZVAL_UNLOCK(*retval, &free_res);
32230 			if (retval != &EG(uninitialized_zval_ptr)) {
32231 				SEPARATE_ZVAL_IF_NOT_REF(retval);
32232 			}
32233 			PZVAL_LOCK(*retval);
32234 			FREE_OP_VAR_PTR(free_res);
32235 		}
32236 		/* break missing intentionally */
32237 		default:
32238 			EX_T(opline->result.var).var.ptr_ptr = retval;
32239 			break;
32240 	}
32241 	CHECK_EXCEPTION();
32242 	ZEND_VM_NEXT_OPCODE();
32243 }
32244 
ZEND_FETCH_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32245 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32246 {
32247 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32248 }
32249 
ZEND_FETCH_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32250 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32251 {
32252 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32253 }
32254 
ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32255 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32256 {
32257 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32258 }
32259 
ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32260 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32261 {
32262 	USE_OPLINE
32263 
32264 	return zend_fetch_var_address_helper_SPEC_CV_CONST(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32265 }
32266 
ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32267 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32268 {
32269 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32270 }
32271 
ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32272 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32273 {
32274 	return zend_fetch_var_address_helper_SPEC_CV_CONST(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32275 }
32276 
ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32277 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32278 {
32279 	USE_OPLINE
32280 
32281 	zval *container;
32282 
32283 	SAVE_OPLINE();
32284 
32285 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
32286 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
32287 	}
32288 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32289 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
32290 
32291 
32292 	CHECK_EXCEPTION();
32293 	ZEND_VM_NEXT_OPCODE();
32294 }
32295 
ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32296 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32297 {
32298 	USE_OPLINE
32299 	zend_free_op free_op1;
32300 	zval **container;
32301 
32302 	SAVE_OPLINE();
32303 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32304 
32305 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32306 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32307 	}
32308 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
32309 
32310 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32311 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32312 	}
32313 
32314 	/* We are going to assign the result by reference */
32315 	if (UNEXPECTED(opline->extended_value != 0)) {
32316 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32317 
32318 		if (retval_ptr) {
32319 			Z_DELREF_PP(retval_ptr);
32320 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
32321 			Z_ADDREF_PP(retval_ptr);
32322 		}
32323 	}
32324 
32325 	CHECK_EXCEPTION();
32326 	ZEND_VM_NEXT_OPCODE();
32327 }
32328 
ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32329 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32330 {
32331 	USE_OPLINE
32332 	zend_free_op free_op1;
32333 	zval **container;
32334 
32335 	SAVE_OPLINE();
32336 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
32337 
32338 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32339 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32340 	}
32341 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_RW TSRMLS_CC);
32342 
32343 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32344 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32345 	}
32346 
32347 	CHECK_EXCEPTION();
32348 	ZEND_VM_NEXT_OPCODE();
32349 }
32350 
ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32351 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32352 {
32353 	USE_OPLINE
32354 
32355 	zval *container;
32356 
32357 	SAVE_OPLINE();
32358 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
32359 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_IS TSRMLS_CC);
32360 
32361 
32362 	CHECK_EXCEPTION();
32363 	ZEND_VM_NEXT_OPCODE();
32364 }
32365 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32366 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32367 {
32368 	USE_OPLINE
32369 	zend_free_op free_op1;
32370 
32371 	SAVE_OPLINE();
32372 
32373 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
32374 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32375 
32376 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32377 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32378 		}
32379 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_W TSRMLS_CC);
32380 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32381 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32382 		}
32383 
32384 
32385 	} else {
32386 		zval *container;
32387 
32388 		if (IS_CONST == IS_UNUSED) {
32389 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
32390 		}
32391 		container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32392 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_R TSRMLS_CC);
32393 
32394 
32395 	}
32396 	CHECK_EXCEPTION();
32397 	ZEND_VM_NEXT_OPCODE();
32398 }
32399 
ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32400 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32401 {
32402 	USE_OPLINE
32403 	zend_free_op free_op1;
32404 	zval **container;
32405 
32406 	SAVE_OPLINE();
32407 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
32408 
32409 	if (IS_CV == IS_CV) {
32410 		if (container != &EG(uninitialized_zval_ptr)) {
32411 			SEPARATE_ZVAL_IF_NOT_REF(container);
32412 		}
32413 	}
32414 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32415 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32416 	}
32417 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, opline->op2.zv, IS_CONST, BP_VAR_UNSET TSRMLS_CC);
32418 
32419 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32420 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32421 	}
32422 
32423 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
32424 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
32425 		ZEND_VM_NEXT_OPCODE();
32426 	} else {
32427 		zend_free_op free_res;
32428 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32429 
32430 		PZVAL_UNLOCK(*retval_ptr, &free_res);
32431 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
32432 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
32433 		}
32434 		PZVAL_LOCK(*retval_ptr);
32435 		FREE_OP_VAR_PTR(free_res);
32436 		CHECK_EXCEPTION();
32437 		ZEND_VM_NEXT_OPCODE();
32438 	}
32439 }
32440 
zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS)32441 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS)
32442 {
32443 	USE_OPLINE
32444 
32445 	zval *container;
32446 
32447 	zval *offset;
32448 
32449 	SAVE_OPLINE();
32450 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32451 	offset  = opline->op2.zv;
32452 
32453 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
32454 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
32455 		zend_error(E_NOTICE, "Trying to get property of non-object");
32456 		PZVAL_LOCK(&EG(uninitialized_zval));
32457 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32458 
32459 	} else {
32460 		zval *retval;
32461 
32462 		if (0) {
32463 			MAKE_REAL_ZVAL_PTR(offset);
32464 		}
32465 
32466 		/* here we are sure we are dealing with an object */
32467 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32468 
32469 		PZVAL_LOCK(retval);
32470 		AI_SET_PTR(&EX_T(opline->result.var), retval);
32471 
32472 		if (0) {
32473 			zval_ptr_dtor(&offset);
32474 		} else {
32475 
32476 		}
32477 	}
32478 
32479 	CHECK_EXCEPTION();
32480 	ZEND_VM_NEXT_OPCODE();
32481 }
32482 
ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32483 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32484 {
32485 	return zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32486 }
32487 
ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32488 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32489 {
32490 	USE_OPLINE
32491 	zend_free_op free_op1;
32492 	zval *property;
32493 	zval **container;
32494 
32495 	SAVE_OPLINE();
32496 	property = opline->op2.zv;
32497 
32498 	if (0) {
32499 		MAKE_REAL_ZVAL_PTR(property);
32500 	}
32501 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32502 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32503 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32504 	}
32505 
32506 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
32507 	if (0) {
32508 		zval_ptr_dtor(&property);
32509 	} else {
32510 
32511 	}
32512 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32513 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32514 	}
32515 
32516 	/* We are going to assign the result by reference */
32517 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
32518 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
32519 
32520 		Z_DELREF_PP(retval_ptr);
32521 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
32522 		Z_ADDREF_PP(retval_ptr);
32523 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
32524 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
32525 	}
32526 
32527 	CHECK_EXCEPTION();
32528 	ZEND_VM_NEXT_OPCODE();
32529 }
32530 
ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32531 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32532 {
32533 	USE_OPLINE
32534 	zend_free_op free_op1;
32535 	zval *property;
32536 	zval **container;
32537 
32538 	SAVE_OPLINE();
32539 	property = opline->op2.zv;
32540 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
32541 
32542 	if (0) {
32543 		MAKE_REAL_ZVAL_PTR(property);
32544 	}
32545 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32546 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32547 	}
32548 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
32549 	if (0) {
32550 		zval_ptr_dtor(&property);
32551 	} else {
32552 
32553 	}
32554 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32555 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32556 	}
32557 
32558 	CHECK_EXCEPTION();
32559 	ZEND_VM_NEXT_OPCODE();
32560 }
32561 
ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32562 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32563 {
32564 	USE_OPLINE
32565 
32566 	zval *container;
32567 
32568 	zval *offset;
32569 
32570 	SAVE_OPLINE();
32571 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
32572 	offset  = opline->op2.zv;
32573 
32574 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
32575 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
32576 		PZVAL_LOCK(&EG(uninitialized_zval));
32577 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32578 
32579 	} else {
32580 		zval *retval;
32581 
32582 		if (0) {
32583 			MAKE_REAL_ZVAL_PTR(offset);
32584 		}
32585 
32586 		/* here we are sure we are dealing with an object */
32587 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32588 
32589 		PZVAL_LOCK(retval);
32590 		AI_SET_PTR(&EX_T(opline->result.var), retval);
32591 
32592 		if (0) {
32593 			zval_ptr_dtor(&offset);
32594 		} else {
32595 
32596 		}
32597 	}
32598 
32599 	CHECK_EXCEPTION();
32600 	ZEND_VM_NEXT_OPCODE();
32601 }
32602 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32603 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32604 {
32605 	USE_OPLINE
32606 
32607 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
32608 		/* Behave like FETCH_OBJ_W */
32609 		zend_free_op free_op1;
32610 		zval *property;
32611 		zval **container;
32612 
32613 		SAVE_OPLINE();
32614 		property = opline->op2.zv;
32615 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32616 
32617 		if (0) {
32618 			MAKE_REAL_ZVAL_PTR(property);
32619 		}
32620 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32621 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32622 		}
32623 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
32624 		if (0) {
32625 			zval_ptr_dtor(&property);
32626 		} else {
32627 
32628 		}
32629 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32630 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32631 		}
32632 
32633 		CHECK_EXCEPTION();
32634 		ZEND_VM_NEXT_OPCODE();
32635 	} else {
32636 		return zend_fetch_property_address_read_helper_SPEC_CV_CONST(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
32637 	}
32638 }
32639 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32640 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32641 {
32642 	USE_OPLINE
32643 	zend_free_op free_op1, free_res;
32644 	zval **container;
32645 	zval *property;
32646 
32647 	SAVE_OPLINE();
32648 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
32649 	property = opline->op2.zv;
32650 
32651 	if (IS_CV == IS_CV) {
32652 		if (container != &EG(uninitialized_zval_ptr)) {
32653 			SEPARATE_ZVAL_IF_NOT_REF(container);
32654 		}
32655 	}
32656 	if (0) {
32657 		MAKE_REAL_ZVAL_PTR(property);
32658 	}
32659 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
32660 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
32661 	}
32662 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
32663 	if (0) {
32664 		zval_ptr_dtor(&property);
32665 	} else {
32666 
32667 	}
32668 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
32669 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
32670 	}
32671 
32672 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
32673 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
32674 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
32675 	}
32676 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
32677 	FREE_OP_VAR_PTR(free_res);
32678 	CHECK_EXCEPTION();
32679 	ZEND_VM_NEXT_OPCODE();
32680 }
32681 
ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32682 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32683 {
32684 	USE_OPLINE
32685 
32686 	zval **object_ptr;
32687 	zval *property_name;
32688 
32689 	SAVE_OPLINE();
32690 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32691 	property_name = opline->op2.zv;
32692 
32693 	if (0) {
32694 		MAKE_REAL_ZVAL_PTR(property_name);
32695 	}
32696 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32697 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32698 	}
32699 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32700 	if (0) {
32701 		zval_ptr_dtor(&property_name);
32702 	} else {
32703 
32704 	}
32705 
32706 	/* assign_obj has two opcodes! */
32707 	CHECK_EXCEPTION();
32708 	ZEND_VM_INC_OPCODE();
32709 	ZEND_VM_NEXT_OPCODE();
32710 }
32711 
ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32712 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32713 {
32714 	USE_OPLINE
32715 
32716 	zval **object_ptr;
32717 
32718 	SAVE_OPLINE();
32719 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32720 
32721 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
32722 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
32723 	}
32724 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
32725 
32726 		zval *property_name = opline->op2.zv;
32727 
32728 		if (0) {
32729 			MAKE_REAL_ZVAL_PTR(property_name);
32730 		}
32731 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
32732 		if (0) {
32733 			zval_ptr_dtor(&property_name);
32734 		} else {
32735 
32736 		}
32737 	} else {
32738 		zend_free_op free_op_data1, free_op_data2;
32739 		zval *value;
32740 		zval *dim = opline->op2.zv;
32741 		zval **variable_ptr_ptr;
32742 
32743 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CONST, BP_VAR_W TSRMLS_CC);
32744 
32745 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
32746 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
32747 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
32748 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
32749 				if (RETURN_VALUE_USED(opline)) {
32750 					zval *retval;
32751 
32752 					ALLOC_ZVAL(retval);
32753 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
32754 					INIT_PZVAL(retval);
32755 					AI_SET_PTR(&EX_T(opline->result.var), retval);
32756 				}
32757 			} else if (RETURN_VALUE_USED(opline)) {
32758 				PZVAL_LOCK(&EG(uninitialized_zval));
32759 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32760 			}
32761 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
32762 			if (IS_TMP_FREE(free_op_data1)) {
32763 				zval_dtor(value);
32764 			}
32765 			if (RETURN_VALUE_USED(opline)) {
32766 				PZVAL_LOCK(&EG(uninitialized_zval));
32767 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32768 			}
32769 		} else {
32770 			if ((opline+1)->op1_type == IS_TMP_VAR) {
32771 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32772 			} else if ((opline+1)->op1_type == IS_CONST) {
32773 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32774 			} else {
32775 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32776 			}
32777 			if (RETURN_VALUE_USED(opline)) {
32778 				PZVAL_LOCK(value);
32779 				AI_SET_PTR(&EX_T(opline->result.var), value);
32780 			}
32781 		}
32782 		FREE_OP_VAR_PTR(free_op_data2);
32783 	 	FREE_OP_IF_VAR(free_op_data1);
32784 	}
32785 
32786 	/* assign_dim has two opcodes! */
32787 	CHECK_EXCEPTION();
32788 	ZEND_VM_INC_OPCODE();
32789 	ZEND_VM_NEXT_OPCODE();
32790 }
32791 
ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32792 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32793 {
32794 	USE_OPLINE
32795 
32796 	zval *value;
32797 	zval **variable_ptr_ptr;
32798 
32799 	SAVE_OPLINE();
32800 	value = opline->op2.zv;
32801 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32802 
32803 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
32804 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CONST TSRMLS_CC)) {
32805 			if (RETURN_VALUE_USED(opline)) {
32806 				zval *retval;
32807 
32808 				ALLOC_ZVAL(retval);
32809 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
32810 				INIT_PZVAL(retval);
32811 				AI_SET_PTR(&EX_T(opline->result.var), retval);
32812 			}
32813 		} else if (RETURN_VALUE_USED(opline)) {
32814 			PZVAL_LOCK(&EG(uninitialized_zval));
32815 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32816 		}
32817 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
32818 		if (0) {
32819 			zval_dtor(value);
32820 		}
32821 		if (RETURN_VALUE_USED(opline)) {
32822 			PZVAL_LOCK(&EG(uninitialized_zval));
32823 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
32824 		}
32825 	} else {
32826 		if (IS_CONST == IS_TMP_VAR) {
32827 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32828 		} else if (IS_CONST == IS_CONST) {
32829 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32830 		} else {
32831 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
32832 		}
32833 		if (RETURN_VALUE_USED(opline)) {
32834 			PZVAL_LOCK(value);
32835 			AI_SET_PTR(&EX_T(opline->result.var), value);
32836 		}
32837 	}
32838 
32839 	if (IS_CV == IS_VAR && 0) {
32840 		zval_ptr_dtor(&value);
32841 	}
32842 
32843 	/* zend_assign_to_variable() always takes care of op2, never free it! */
32844 
32845 	CHECK_EXCEPTION();
32846 	ZEND_VM_NEXT_OPCODE();
32847 }
32848 
ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32849 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32850 {
32851 	USE_OPLINE
32852 	zval *function_name;
32853 	char *function_name_strval;
32854 	int function_name_strlen;
32855 
32856 	call_slot *call = EX(call_slots) + opline->result.num;
32857 
32858 	SAVE_OPLINE();
32859 
32860 	function_name = opline->op2.zv;
32861 
32862 	if (IS_CONST != IS_CONST &&
32863 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
32864 		if (UNEXPECTED(EG(exception) != NULL)) {
32865 			HANDLE_EXCEPTION();
32866 		}
32867 		zend_error_noreturn(E_ERROR, "Method name must be a string");
32868 	}
32869 
32870 	function_name_strval = Z_STRVAL_P(function_name);
32871 	function_name_strlen = Z_STRLEN_P(function_name);
32872 
32873 	call->object = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32874 
32875 	if (EXPECTED(call->object != NULL) &&
32876 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
32877 		call->called_scope = Z_OBJCE_P(call->object);
32878 
32879 		if (IS_CONST != IS_CONST ||
32880 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
32881 		    zval *object = call->object;
32882 
32883 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
32884 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
32885 			}
32886 
32887 			/* First, locate the function. */
32888 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CONST == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
32889 			if (UNEXPECTED(call->fbc == NULL)) {
32890 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
32891 			}
32892 			if (IS_CONST == IS_CONST &&
32893 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
32894 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
32895 			    EXPECTED(call->object == object)) {
32896 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
32897 			}
32898 		}
32899 	} else {
32900 		if (UNEXPECTED(EG(exception) != NULL)) {
32901 
32902 			HANDLE_EXCEPTION();
32903 		}
32904 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
32905 	}
32906 
32907 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
32908 		call->object = NULL;
32909 	} else {
32910 		if (!PZVAL_IS_REF(call->object)) {
32911 			Z_ADDREF_P(call->object); /* For $this pointer */
32912 		} else {
32913 			zval *this_ptr;
32914 			ALLOC_ZVAL(this_ptr);
32915 			INIT_PZVAL_COPY(this_ptr, call->object);
32916 			zval_copy_ctor(this_ptr);
32917 			call->object = this_ptr;
32918 		}
32919 	}
32920 	call->is_ctor_call = 0;
32921 	EX(call) = call;
32922 
32923 
32924 	CHECK_EXCEPTION();
32925 	ZEND_VM_NEXT_OPCODE();
32926 }
32927 
ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32928 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32929 {
32930 	USE_OPLINE
32931 
32932 
32933 	SAVE_OPLINE();
32934 	if (IS_CV==IS_VAR) {
32935 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
32936 	}
32937 	is_equal_function(&EX_T(opline->result.var).tmp_var,
32938 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
32939 				 opline->op2.zv TSRMLS_CC);
32940 
32941 	CHECK_EXCEPTION();
32942 	ZEND_VM_NEXT_OPCODE();
32943 }
32944 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)32945 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
32946 {
32947 	USE_OPLINE
32948 
32949 	zval *expr_ptr;
32950 
32951 	SAVE_OPLINE();
32952 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
32953 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
32954 
32955 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
32956 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
32957 		}
32958 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
32959 		expr_ptr = *expr_ptr_ptr;
32960 		Z_ADDREF_P(expr_ptr);
32961 	} else {
32962 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
32963 		if (0) { /* temporary variable */
32964 			zval *new_expr;
32965 
32966 			ALLOC_ZVAL(new_expr);
32967 			INIT_PZVAL_COPY(new_expr, expr_ptr);
32968 			expr_ptr = new_expr;
32969 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
32970 			zval *new_expr;
32971 
32972 			ALLOC_ZVAL(new_expr);
32973 			INIT_PZVAL_COPY(new_expr, expr_ptr);
32974 			expr_ptr = new_expr;
32975 			zendi_zval_copy_ctor(*expr_ptr);
32976 		} else {
32977 			Z_ADDREF_P(expr_ptr);
32978 		}
32979 	}
32980 
32981 	if (IS_CONST != IS_UNUSED) {
32982 
32983 		zval *offset = opline->op2.zv;
32984 		ulong hval;
32985 
32986 		switch (Z_TYPE_P(offset)) {
32987 			case IS_DOUBLE:
32988 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
32989 				goto num_index;
32990 			case IS_LONG:
32991 			case IS_BOOL:
32992 				hval = Z_LVAL_P(offset);
32993 num_index:
32994 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
32995 				break;
32996 			case IS_STRING:
32997 				if (IS_CONST == IS_CONST) {
32998 					hval = Z_HASH_P(offset);
32999 				} else {
33000 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
33001 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
33002 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
33003 					} else {
33004 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33005 					}
33006 				}
33007 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
33008 				break;
33009 			case IS_NULL:
33010 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
33011 				break;
33012 			default:
33013 				zend_error(E_WARNING, "Illegal offset type");
33014 				zval_ptr_dtor(&expr_ptr);
33015 				/* do nothing */
33016 				break;
33017 		}
33018 
33019 	} else {
33020 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
33021 	}
33022 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
33023 
33024 	} else {
33025 
33026 	}
33027 	CHECK_EXCEPTION();
33028 	ZEND_VM_NEXT_OPCODE();
33029 }
33030 
ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33031 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33032 {
33033 	USE_OPLINE
33034 
33035 	array_init(&EX_T(opline->result.var).tmp_var);
33036 	if (IS_CV == IS_UNUSED) {
33037 		ZEND_VM_NEXT_OPCODE();
33038 #if 0 || IS_CV != IS_UNUSED
33039 	} else {
33040 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33041 #endif
33042 	}
33043 }
33044 
ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33045 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33046 {
33047 	USE_OPLINE
33048 	zval tmp, *varname;
33049 	HashTable *target_symbol_table;
33050 
33051 
33052 	SAVE_OPLINE();
33053 	if (IS_CV == IS_CV &&
33054 	    IS_CONST == IS_UNUSED &&
33055 	    (opline->extended_value & ZEND_QUICK_SET)) {
33056 		if (EG(active_symbol_table)) {
33057 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
33058 
33059 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
33060 			EX_CV(opline->op1.var) = NULL;
33061 		} else if (EX_CV(opline->op1.var)) {
33062 			zval_ptr_dtor(EX_CV(opline->op1.var));
33063 			EX_CV(opline->op1.var) = NULL;
33064 		}
33065 		CHECK_EXCEPTION();
33066 		ZEND_VM_NEXT_OPCODE();
33067 	}
33068 
33069 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
33070 
33071 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
33072 		ZVAL_COPY_VALUE(&tmp, varname);
33073 		zval_copy_ctor(&tmp);
33074 		convert_to_string(&tmp);
33075 		varname = &tmp;
33076 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33077 		Z_ADDREF_P(varname);
33078 	}
33079 
33080 	if (IS_CONST != IS_UNUSED) {
33081 		zend_class_entry *ce;
33082 
33083 		if (IS_CONST == IS_CONST) {
33084 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
33085 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
33086 			} else {
33087 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
33088 				if (UNEXPECTED(EG(exception) != NULL)) {
33089 					if (IS_CV != IS_CONST && varname == &tmp) {
33090 						zval_dtor(&tmp);
33091 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33092 						zval_ptr_dtor(&varname);
33093 					}
33094 
33095 					HANDLE_EXCEPTION();
33096 				}
33097 				if (UNEXPECTED(ce == NULL)) {
33098 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
33099 				}
33100 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
33101 			}
33102 		} else {
33103 			ce = EX_T(opline->op2.var).class_entry;
33104 		}
33105 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
33106 	} else {
33107 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
33108 
33109 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
33110 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
33111 	}
33112 
33113 	if (IS_CV != IS_CONST && varname == &tmp) {
33114 		zval_dtor(&tmp);
33115 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
33116 		zval_ptr_dtor(&varname);
33117 	}
33118 
33119 	CHECK_EXCEPTION();
33120 	ZEND_VM_NEXT_OPCODE();
33121 }
33122 
ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33123 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33124 {
33125 	USE_OPLINE
33126 
33127 	zval **container;
33128 	zval *offset;
33129 	ulong hval;
33130 
33131 	SAVE_OPLINE();
33132 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
33133 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
33134 		SEPARATE_ZVAL_IF_NOT_REF(container);
33135 	}
33136 	offset = opline->op2.zv;
33137 
33138 	if (IS_CV != IS_VAR || container) {
33139 		switch (Z_TYPE_PP(container)) {
33140 			case IS_ARRAY: {
33141 				HashTable *ht = Z_ARRVAL_PP(container);
33142 
33143 				switch (Z_TYPE_P(offset)) {
33144 					case IS_DOUBLE:
33145 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
33146 						zend_hash_index_del(ht, hval);
33147 						break;
33148 					case IS_RESOURCE:
33149 					case IS_BOOL:
33150 					case IS_LONG:
33151 						hval = Z_LVAL_P(offset);
33152 						zend_hash_index_del(ht, hval);
33153 						break;
33154 					case IS_STRING:
33155 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
33156 							Z_ADDREF_P(offset);
33157 						}
33158 						if (IS_CONST == IS_CONST) {
33159 							hval = Z_HASH_P(offset);
33160 						} else {
33161 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
33162 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
33163 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
33164 							} else {
33165 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33166 							}
33167 						}
33168 						if (ht == &EG(symbol_table)) {
33169 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
33170 						} else {
33171 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
33172 						}
33173 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
33174 							zval_ptr_dtor(&offset);
33175 						}
33176 						break;
33177 num_index_dim:
33178 						zend_hash_index_del(ht, hval);
33179 						if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
33180 							zval_ptr_dtor(&offset);
33181 						}
33182 						break;
33183 					case IS_NULL:
33184 						zend_hash_del(ht, "", sizeof(""));
33185 						break;
33186 					default:
33187 						zend_error(E_WARNING, "Illegal offset type in unset");
33188 						break;
33189 				}
33190 
33191 				break;
33192 			}
33193 			case IS_OBJECT:
33194 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
33195 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
33196 				}
33197 				if (0) {
33198 					MAKE_REAL_ZVAL_PTR(offset);
33199 				}
33200 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
33201 				if (0) {
33202 					zval_ptr_dtor(&offset);
33203 				} else {
33204 
33205 				}
33206 				break;
33207 			case IS_STRING:
33208 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
33209 				ZEND_VM_CONTINUE(); /* bailed out before */
33210 			default:
33211 
33212 				break;
33213 		}
33214 	} else {
33215 
33216 	}
33217 
33218 	CHECK_EXCEPTION();
33219 	ZEND_VM_NEXT_OPCODE();
33220 }
33221 
ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33222 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33223 {
33224 	USE_OPLINE
33225 
33226 	zval **container;
33227 	zval *offset;
33228 
33229 	SAVE_OPLINE();
33230 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
33231 	offset = opline->op2.zv;
33232 
33233 	if (IS_CV != IS_VAR || container) {
33234 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
33235 			SEPARATE_ZVAL_IF_NOT_REF(container);
33236 		}
33237 		if (Z_TYPE_PP(container) == IS_OBJECT) {
33238 			if (0) {
33239 				MAKE_REAL_ZVAL_PTR(offset);
33240 			}
33241 			if (Z_OBJ_HT_P(*container)->unset_property) {
33242 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33243 			} else {
33244 				zend_error(E_NOTICE, "Trying to unset property of non-object");
33245 			}
33246 			if (0) {
33247 				zval_ptr_dtor(&offset);
33248 			} else {
33249 
33250 			}
33251 		} else {
33252 
33253 		}
33254 	} else {
33255 
33256 	}
33257 
33258 	CHECK_EXCEPTION();
33259 	ZEND_VM_NEXT_OPCODE();
33260 }
33261 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33262 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33263 {
33264 	USE_OPLINE
33265 	zval **value;
33266 	zend_bool isset = 1;
33267 
33268 	SAVE_OPLINE();
33269 	if (IS_CV == IS_CV &&
33270 	    IS_CONST == IS_UNUSED &&
33271 	    (opline->extended_value & ZEND_QUICK_SET)) {
33272 		if (EX_CV(opline->op1.var)) {
33273 			value = EX_CV(opline->op1.var);
33274 		} else if (EG(active_symbol_table)) {
33275 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
33276 
33277 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
33278 				isset = 0;
33279 			}
33280 		} else {
33281 			isset = 0;
33282 		}
33283 	} else {
33284 		HashTable *target_symbol_table;
33285 
33286 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
33287 
33288 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
33289 			ZVAL_COPY_VALUE(&tmp, varname);
33290 			zval_copy_ctor(&tmp);
33291 			convert_to_string(&tmp);
33292 			varname = &tmp;
33293 		}
33294 
33295 		if (IS_CONST != IS_UNUSED) {
33296 			zend_class_entry *ce;
33297 
33298 			if (IS_CONST == IS_CONST) {
33299 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
33300 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
33301 				} else {
33302 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
33303 					if (UNEXPECTED(ce == NULL)) {
33304 						CHECK_EXCEPTION();
33305 						ZEND_VM_NEXT_OPCODE();
33306 					}
33307 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
33308 				}
33309 			} else {
33310 				ce = EX_T(opline->op2.var).class_entry;
33311 			}
33312 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
33313 			if (!value) {
33314 				isset = 0;
33315 			}
33316 		} else {
33317 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
33318 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
33319 				isset = 0;
33320 			}
33321 		}
33322 
33323 		if (IS_CV != IS_CONST && varname == &tmp) {
33324 			zval_dtor(&tmp);
33325 		}
33326 
33327 	}
33328 
33329 	if (opline->extended_value & ZEND_ISSET) {
33330 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
33331 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
33332 		} else {
33333 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
33334 		}
33335 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33336 		if (!isset || !i_zend_is_true(*value)) {
33337 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
33338 		} else {
33339 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
33340 		}
33341 	}
33342 
33343 	CHECK_EXCEPTION();
33344 	ZEND_VM_NEXT_OPCODE();
33345 }
33346 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)33347 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
33348 {
33349 	USE_OPLINE
33350 
33351 	zval *container;
33352 	zval **value = NULL;
33353 	int result = 0;
33354 	ulong hval;
33355 	zval *offset;
33356 
33357 	SAVE_OPLINE();
33358 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
33359 
33360 	offset = opline->op2.zv;
33361 
33362 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
33363 		HashTable *ht;
33364 		int isset = 0;
33365 
33366 		ht = Z_ARRVAL_P(container);
33367 
33368 		switch (Z_TYPE_P(offset)) {
33369 			case IS_DOUBLE:
33370 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
33371 				goto num_index_prop;
33372 			case IS_RESOURCE:
33373 			case IS_BOOL:
33374 			case IS_LONG:
33375 				hval = Z_LVAL_P(offset);
33376 num_index_prop:
33377 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
33378 					isset = 1;
33379 				}
33380 				break;
33381 			case IS_STRING:
33382 				if (IS_CONST == IS_CONST) {
33383 					hval = Z_HASH_P(offset);
33384 				} else {
33385 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
33386 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
33387 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
33388 					} else {
33389 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
33390 					}
33391 				}
33392 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
33393 					isset = 1;
33394 				}
33395 				break;
33396 			case IS_NULL:
33397 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
33398 					isset = 1;
33399 				}
33400 				break;
33401 			default:
33402 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
33403 				break;
33404 		}
33405 
33406 		if (opline->extended_value & ZEND_ISSET) {
33407 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
33408 				result = 0;
33409 			} else {
33410 				result = isset;
33411 			}
33412 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33413 			if (!isset || !i_zend_is_true(*value)) {
33414 				result = 0;
33415 			} else {
33416 				result = 1;
33417 			}
33418 		}
33419 
33420 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
33421 		if (0) {
33422 			MAKE_REAL_ZVAL_PTR(offset);
33423 		}
33424 		if (prop_dim) {
33425 			if (Z_OBJ_HT_P(container)->has_property) {
33426 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33427 			} else {
33428 				zend_error(E_NOTICE, "Trying to check property of non-object");
33429 				result = 0;
33430 			}
33431 		} else {
33432 			if (Z_OBJ_HT_P(container)->has_dimension) {
33433 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
33434 			} else {
33435 				zend_error(E_NOTICE, "Trying to check element of non-array");
33436 				result = 0;
33437 			}
33438 		}
33439 		if (0) {
33440 			zval_ptr_dtor(&offset);
33441 		} else {
33442 
33443 		}
33444 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
33445 		zval tmp;
33446 
33447 		if (Z_TYPE_P(offset) != IS_LONG) {
33448 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
33449 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
33450 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
33451 				ZVAL_COPY_VALUE(&tmp, offset);
33452 				zval_copy_ctor(&tmp);
33453 				convert_to_long(&tmp);
33454 				offset = &tmp;
33455 			} else {
33456 				/* can not be converted to proper offset, return "not set" */
33457 				result = 0;
33458 			}
33459 		}
33460 		if (Z_TYPE_P(offset) == IS_LONG) {
33461 			if (opline->extended_value & ZEND_ISSET) {
33462 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
33463 					result = 1;
33464 				}
33465 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
33466 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
33467 					result = 1;
33468 				}
33469 			}
33470 		}
33471 
33472 	} else {
33473 
33474 	}
33475 
33476 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
33477 	if (opline->extended_value & ZEND_ISSET) {
33478 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
33479 	} else {
33480 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
33481 	}
33482 
33483 	CHECK_EXCEPTION();
33484 	ZEND_VM_NEXT_OPCODE();
33485 }
33486 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33487 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33488 {
33489 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33490 }
33491 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33492 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33493 {
33494 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
33495 }
33496 
ZEND_YIELD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33497 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33498 {
33499 	USE_OPLINE
33500 
33501 	/* The generator object is stored in return_value_ptr_ptr */
33502 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
33503 
33504 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
33505 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
33506 	}
33507 
33508 	/* Destroy the previously yielded value */
33509 	if (generator->value) {
33510 		zval_ptr_dtor(&generator->value);
33511 	}
33512 
33513 	/* Destroy the previously yielded key */
33514 	if (generator->key) {
33515 		zval_ptr_dtor(&generator->key);
33516 	}
33517 
33518 	/* Set the new yielded value */
33519 	if (IS_CV != IS_UNUSED) {
33520 
33521 
33522 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
33523 			/* Constants and temporary variables aren't yieldable by reference,
33524 			 * but we still allow them with a notice. */
33525 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
33526 				zval *value, *copy;
33527 
33528 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
33529 
33530 				value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
33531 				ALLOC_ZVAL(copy);
33532 				INIT_PZVAL_COPY(copy, value);
33533 
33534 				/* Temporary variables don't need ctor copying */
33535 				if (!0) {
33536 					zval_copy_ctor(copy);
33537 				}
33538 
33539 				generator->value = copy;
33540 			} else {
33541 				zval **value_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
33542 
33543 				if (IS_CV == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
33544 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
33545 				}
33546 
33547 				/* If a function call result is yielded and the function did
33548 				 * not return by reference we throw a notice. */
33549 				if (IS_CV == IS_VAR && !Z_ISREF_PP(value_ptr)
33550 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
33551 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
33552 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
33553 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
33554 
33555 					Z_ADDREF_PP(value_ptr);
33556 					generator->value = *value_ptr;
33557 				} else {
33558 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
33559 					Z_ADDREF_PP(value_ptr);
33560 					generator->value = *value_ptr;
33561 				}
33562 
33563 			}
33564 		} else {
33565 			zval *value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
33566 
33567 			/* Consts, temporary variables and references need copying */
33568 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
33569 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
33570 			) {
33571 				zval *copy;
33572 
33573 				ALLOC_ZVAL(copy);
33574 				INIT_PZVAL_COPY(copy, value);
33575 
33576 				/* Temporary variables don't need ctor copying */
33577 				if (!0) {
33578 					zval_copy_ctor(copy);
33579 				}
33580 
33581 				generator->value = copy;
33582 			} else {
33583 				Z_ADDREF_P(value);
33584 				generator->value = value;
33585 			}
33586 
33587 		}
33588 	} else {
33589 		/* If no value was specified yield null */
33590 		Z_ADDREF(EG(uninitialized_zval));
33591 		generator->value = &EG(uninitialized_zval);
33592 	}
33593 
33594 	/* Set the new yielded key */
33595 	if (IS_CONST != IS_UNUSED) {
33596 
33597 		zval *key = opline->op2.zv;
33598 
33599 		/* Consts, temporary variables and references need copying */
33600 		if (IS_CONST == IS_CONST || IS_CONST == IS_TMP_VAR
33601 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
33602 		) {
33603 			zval *copy;
33604 
33605 			ALLOC_ZVAL(copy);
33606 			INIT_PZVAL_COPY(copy, key);
33607 
33608 			/* Temporary variables don't need ctor copying */
33609 			if (!0) {
33610 				zval_copy_ctor(copy);
33611 			}
33612 
33613 			generator->key = copy;
33614 		} else {
33615 			Z_ADDREF_P(key);
33616 			generator->key = key;
33617 		}
33618 
33619 		if (Z_TYPE_P(generator->key) == IS_LONG
33620 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
33621 		) {
33622 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
33623 		}
33624 
33625 	} else {
33626 		/* If no key was specified we use auto-increment keys */
33627 		generator->largest_used_integer_key++;
33628 
33629 		ALLOC_INIT_ZVAL(generator->key);
33630 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
33631 	}
33632 
33633 	if (RETURN_VALUE_USED(opline)) {
33634 		/* If the return value of yield is used set the send
33635 		 * target and initialize it to NULL */
33636 		generator->send_target = &EX_T(opline->result.var).var.ptr;
33637 		Z_ADDREF(EG(uninitialized_zval));
33638 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
33639 	} else {
33640 		generator->send_target = NULL;
33641 	}
33642 
33643 	/* We increment to the next op, so we are at the correct position when the
33644 	 * generator is resumed. */
33645 	ZEND_VM_INC_OPCODE();
33646 
33647 	/* The GOTO VM uses a local opline variable. We need to set the opline
33648 	 * variable in execute_data so we don't resume at an old position. */
33649 	SAVE_OPLINE();
33650 
33651 	ZEND_VM_RETURN();
33652 }
33653 
ZEND_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33654 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33655 {
33656 	USE_OPLINE
33657 	zend_free_op free_op2;
33658 
33659 	SAVE_OPLINE();
33660 	fast_add_function(&EX_T(opline->result.var).tmp_var,
33661 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33662 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33663 
33664 	zval_dtor(free_op2.var);
33665 	CHECK_EXCEPTION();
33666 	ZEND_VM_NEXT_OPCODE();
33667 }
33668 
ZEND_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33669 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33670 {
33671 	USE_OPLINE
33672 	zend_free_op free_op2;
33673 
33674 	SAVE_OPLINE();
33675 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
33676 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33677 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33678 
33679 	zval_dtor(free_op2.var);
33680 	CHECK_EXCEPTION();
33681 	ZEND_VM_NEXT_OPCODE();
33682 }
33683 
ZEND_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33684 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33685 {
33686 	USE_OPLINE
33687 	zend_free_op free_op2;
33688 
33689 	SAVE_OPLINE();
33690 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
33691 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33692 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33693 
33694 	zval_dtor(free_op2.var);
33695 	CHECK_EXCEPTION();
33696 	ZEND_VM_NEXT_OPCODE();
33697 }
33698 
ZEND_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33699 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33700 {
33701 	USE_OPLINE
33702 	zend_free_op free_op2;
33703 
33704 	SAVE_OPLINE();
33705 	fast_div_function(&EX_T(opline->result.var).tmp_var,
33706 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33707 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33708 
33709 	zval_dtor(free_op2.var);
33710 	CHECK_EXCEPTION();
33711 	ZEND_VM_NEXT_OPCODE();
33712 }
33713 
ZEND_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33714 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33715 {
33716 	USE_OPLINE
33717 	zend_free_op free_op2;
33718 
33719 	SAVE_OPLINE();
33720 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
33721 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33722 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33723 
33724 	zval_dtor(free_op2.var);
33725 	CHECK_EXCEPTION();
33726 	ZEND_VM_NEXT_OPCODE();
33727 }
33728 
ZEND_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33729 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33730 {
33731 	USE_OPLINE
33732 	zend_free_op free_op2;
33733 
33734 	SAVE_OPLINE();
33735 	shift_left_function(&EX_T(opline->result.var).tmp_var,
33736 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33737 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33738 
33739 	zval_dtor(free_op2.var);
33740 	CHECK_EXCEPTION();
33741 	ZEND_VM_NEXT_OPCODE();
33742 }
33743 
ZEND_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33744 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33745 {
33746 	USE_OPLINE
33747 	zend_free_op free_op2;
33748 
33749 	SAVE_OPLINE();
33750 	shift_right_function(&EX_T(opline->result.var).tmp_var,
33751 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33752 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33753 
33754 	zval_dtor(free_op2.var);
33755 	CHECK_EXCEPTION();
33756 	ZEND_VM_NEXT_OPCODE();
33757 }
33758 
ZEND_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33759 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33760 {
33761 	USE_OPLINE
33762 	zend_free_op free_op2;
33763 
33764 	SAVE_OPLINE();
33765 	concat_function(&EX_T(opline->result.var).tmp_var,
33766 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33767 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33768 
33769 	zval_dtor(free_op2.var);
33770 	CHECK_EXCEPTION();
33771 	ZEND_VM_NEXT_OPCODE();
33772 }
33773 
ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33774 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33775 {
33776 	USE_OPLINE
33777 	zend_free_op free_op2;
33778 
33779 	SAVE_OPLINE();
33780 	is_identical_function(&EX_T(opline->result.var).tmp_var,
33781 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33782 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33783 
33784 	zval_dtor(free_op2.var);
33785 	CHECK_EXCEPTION();
33786 	ZEND_VM_NEXT_OPCODE();
33787 }
33788 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33789 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33790 {
33791 	USE_OPLINE
33792 	zend_free_op free_op2;
33793 	zval *result = &EX_T(opline->result.var).tmp_var;
33794 
33795 	SAVE_OPLINE();
33796 	is_identical_function(result,
33797 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33798 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33799 	Z_LVAL_P(result) = !Z_LVAL_P(result);
33800 
33801 	zval_dtor(free_op2.var);
33802 	CHECK_EXCEPTION();
33803 	ZEND_VM_NEXT_OPCODE();
33804 }
33805 
ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33806 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33807 {
33808 	USE_OPLINE
33809 	zend_free_op free_op2;
33810 	zval *result = &EX_T(opline->result.var).tmp_var;
33811 
33812 	SAVE_OPLINE();
33813 	ZVAL_BOOL(result, fast_equal_function(result,
33814 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33815 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
33816 
33817 	zval_dtor(free_op2.var);
33818 	CHECK_EXCEPTION();
33819 	ZEND_VM_NEXT_OPCODE();
33820 }
33821 
ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33822 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33823 {
33824 	USE_OPLINE
33825 	zend_free_op free_op2;
33826 	zval *result = &EX_T(opline->result.var).tmp_var;
33827 
33828 	SAVE_OPLINE();
33829 	ZVAL_BOOL(result, fast_not_equal_function(result,
33830 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33831 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
33832 
33833 	zval_dtor(free_op2.var);
33834 	CHECK_EXCEPTION();
33835 	ZEND_VM_NEXT_OPCODE();
33836 }
33837 
ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33838 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33839 {
33840 	USE_OPLINE
33841 	zend_free_op free_op2;
33842 	zval *result = &EX_T(opline->result.var).tmp_var;
33843 
33844 	SAVE_OPLINE();
33845 	ZVAL_BOOL(result, fast_is_smaller_function(result,
33846 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33847 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
33848 
33849 	zval_dtor(free_op2.var);
33850 	CHECK_EXCEPTION();
33851 	ZEND_VM_NEXT_OPCODE();
33852 }
33853 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33854 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33855 {
33856 	USE_OPLINE
33857 	zend_free_op free_op2;
33858 	zval *result = &EX_T(opline->result.var).tmp_var;
33859 
33860 	SAVE_OPLINE();
33861 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
33862 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33863 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
33864 
33865 	zval_dtor(free_op2.var);
33866 	CHECK_EXCEPTION();
33867 	ZEND_VM_NEXT_OPCODE();
33868 }
33869 
ZEND_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33870 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33871 {
33872 	USE_OPLINE
33873 	zend_free_op free_op2;
33874 
33875 	SAVE_OPLINE();
33876 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
33877 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33878 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33879 
33880 	zval_dtor(free_op2.var);
33881 	CHECK_EXCEPTION();
33882 	ZEND_VM_NEXT_OPCODE();
33883 }
33884 
ZEND_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33885 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33886 {
33887 	USE_OPLINE
33888 	zend_free_op free_op2;
33889 
33890 	SAVE_OPLINE();
33891 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
33892 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33893 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33894 
33895 	zval_dtor(free_op2.var);
33896 	CHECK_EXCEPTION();
33897 	ZEND_VM_NEXT_OPCODE();
33898 }
33899 
ZEND_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33900 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33901 {
33902 	USE_OPLINE
33903 	zend_free_op free_op2;
33904 
33905 	SAVE_OPLINE();
33906 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
33907 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33908 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33909 
33910 	zval_dtor(free_op2.var);
33911 	CHECK_EXCEPTION();
33912 	ZEND_VM_NEXT_OPCODE();
33913 }
33914 
ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)33915 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
33916 {
33917 	USE_OPLINE
33918 	zend_free_op free_op2;
33919 
33920 	SAVE_OPLINE();
33921 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
33922 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
33923 		_get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
33924 
33925 	zval_dtor(free_op2.var);
33926 	CHECK_EXCEPTION();
33927 	ZEND_VM_NEXT_OPCODE();
33928 }
33929 
zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)33930 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
33931 {
33932 	USE_OPLINE
33933 	zend_free_op free_op2, free_op_data1;
33934 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
33935 	zval *object;
33936 	zval *property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
33937 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
33938 	int have_get_ptr = 0;
33939 
33940 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
33941 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
33942 	}
33943 
33944 	make_real_object(object_ptr TSRMLS_CC);
33945 	object = *object_ptr;
33946 
33947 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
33948 		zend_error(E_WARNING, "Attempt to assign property of non-object");
33949 		zval_dtor(free_op2.var);
33950 		FREE_OP(free_op_data1);
33951 
33952 		if (RETURN_VALUE_USED(opline)) {
33953 			PZVAL_LOCK(&EG(uninitialized_zval));
33954 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
33955 			EX_T(opline->result.var).var.ptr_ptr = NULL;
33956 		}
33957 	} else {
33958 		/* here we are sure we are dealing with an object */
33959 		if (1) {
33960 			MAKE_REAL_ZVAL_PTR(property);
33961 		}
33962 
33963 		/* here property is a string */
33964 		if (opline->extended_value == ZEND_ASSIGN_OBJ
33965 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
33966 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33967 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
33968 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
33969 
33970 				have_get_ptr = 1;
33971 				binary_op(*zptr, *zptr, value TSRMLS_CC);
33972 				if (RETURN_VALUE_USED(opline)) {
33973 					PZVAL_LOCK(*zptr);
33974 					EX_T(opline->result.var).var.ptr = *zptr;
33975 					EX_T(opline->result.var).var.ptr_ptr = NULL;
33976 				}
33977 			}
33978 		}
33979 
33980 		if (!have_get_ptr) {
33981 			zval *z = NULL;
33982 
33983 			Z_ADDREF_P(object);
33984 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
33985 				if (Z_OBJ_HT_P(object)->read_property) {
33986 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
33987 				}
33988 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
33989 				if (Z_OBJ_HT_P(object)->read_dimension) {
33990 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
33991 				}
33992 			}
33993 			if (z) {
33994 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
33995 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
33996 
33997 					if (Z_REFCOUNT_P(z) == 0) {
33998 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
33999 						zval_dtor(z);
34000 						FREE_ZVAL(z);
34001 					}
34002 					z = value;
34003 				}
34004 				Z_ADDREF_P(z);
34005 				SEPARATE_ZVAL_IF_NOT_REF(&z);
34006 				binary_op(z, z, value TSRMLS_CC);
34007 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
34008 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34009 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
34010 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
34011 				}
34012 				if (RETURN_VALUE_USED(opline)) {
34013 					PZVAL_LOCK(z);
34014 					EX_T(opline->result.var).var.ptr = z;
34015 					EX_T(opline->result.var).var.ptr_ptr = NULL;
34016 				}
34017 				zval_ptr_dtor(&z);
34018 			} else {
34019 				zend_error(E_WARNING, "Attempt to assign property of non-object");
34020 				if (RETURN_VALUE_USED(opline)) {
34021 					PZVAL_LOCK(&EG(uninitialized_zval));
34022 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
34023 					EX_T(opline->result.var).var.ptr_ptr = NULL;
34024 				}
34025 			}
34026 			zval_ptr_dtor(&object);
34027 		}
34028 
34029 		if (1) {
34030 			zval_ptr_dtor(&property);
34031 		} else {
34032 			zval_dtor(free_op2.var);
34033 		}
34034 		FREE_OP(free_op_data1);
34035 	}
34036 
34037 	/* assign_obj has two opcodes! */
34038 	CHECK_EXCEPTION();
34039 	ZEND_VM_INC_OPCODE();
34040 	ZEND_VM_NEXT_OPCODE();
34041 }
34042 
zend_binary_assign_op_helper_SPEC_CV_TMP(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)34043 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_TMP(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
34044 {
34045 	USE_OPLINE
34046 	zend_free_op free_op2, free_op_data2, free_op_data1;
34047 	zval **var_ptr;
34048 	zval *value;
34049 
34050 	SAVE_OPLINE();
34051 	switch (opline->extended_value) {
34052 		case ZEND_ASSIGN_OBJ:
34053 			return zend_binary_assign_op_obj_helper_SPEC_CV_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34054 			break;
34055 		case ZEND_ASSIGN_DIM: {
34056 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34057 
34058 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34059 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34060 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
34061 					if (IS_CV == IS_VAR && !0) {
34062 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
34063 					}
34064 					return zend_binary_assign_op_obj_helper_SPEC_CV_TMP(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34065 				} else {
34066 					zval *dim = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34067 
34068 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
34069 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
34070 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
34071 				}
34072 			}
34073 			break;
34074 		default:
34075 			value = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34076 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34077 			/* do nothing */
34078 			break;
34079 	}
34080 
34081 	if (UNEXPECTED(var_ptr == NULL)) {
34082 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
34083 	}
34084 
34085 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
34086 		if (RETURN_VALUE_USED(opline)) {
34087 			PZVAL_LOCK(&EG(uninitialized_zval));
34088 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34089 		}
34090 		zval_dtor(free_op2.var);
34091 
34092 		CHECK_EXCEPTION();
34093 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
34094 			ZEND_VM_INC_OPCODE();
34095 		}
34096 		ZEND_VM_NEXT_OPCODE();
34097 	}
34098 
34099 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
34100 
34101 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
34102 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
34103 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
34104 		/* proxy object */
34105 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
34106 		Z_ADDREF_P(objval);
34107 		binary_op(objval, objval, value TSRMLS_CC);
34108 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
34109 		zval_ptr_dtor(&objval);
34110 	} else {
34111 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
34112 	}
34113 
34114 	if (RETURN_VALUE_USED(opline)) {
34115 		PZVAL_LOCK(*var_ptr);
34116 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
34117 	}
34118 	zval_dtor(free_op2.var);
34119 
34120 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
34121 		FREE_OP(free_op_data1);
34122 		FREE_OP_VAR_PTR(free_op_data2);
34123 
34124 		CHECK_EXCEPTION();
34125 		ZEND_VM_INC_OPCODE();
34126 	} else {
34127 
34128 		CHECK_EXCEPTION();
34129 	}
34130 	ZEND_VM_NEXT_OPCODE();
34131 }
34132 
ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34133 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34134 {
34135 	return zend_binary_assign_op_helper_SPEC_CV_TMP(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34136 }
34137 
ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34138 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34139 {
34140 	return zend_binary_assign_op_helper_SPEC_CV_TMP(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34141 }
34142 
ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34143 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34144 {
34145 	return zend_binary_assign_op_helper_SPEC_CV_TMP(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34146 }
34147 
ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34148 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34149 {
34150 	return zend_binary_assign_op_helper_SPEC_CV_TMP(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34151 }
34152 
ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34153 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34154 {
34155 	return zend_binary_assign_op_helper_SPEC_CV_TMP(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34156 }
34157 
ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34158 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34159 {
34160 	return zend_binary_assign_op_helper_SPEC_CV_TMP(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34161 }
34162 
ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34163 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34164 {
34165 	return zend_binary_assign_op_helper_SPEC_CV_TMP(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34166 }
34167 
ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34168 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34169 {
34170 	return zend_binary_assign_op_helper_SPEC_CV_TMP(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34171 }
34172 
ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34173 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34174 {
34175 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34176 }
34177 
ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34178 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34179 {
34180 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34181 }
34182 
ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34183 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34184 {
34185 	return zend_binary_assign_op_helper_SPEC_CV_TMP(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34186 }
34187 
zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)34188 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
34189 {
34190 	USE_OPLINE
34191 	zend_free_op free_op2;
34192 	zval **object_ptr;
34193 	zval *object;
34194 	zval *property;
34195 	zval **retval;
34196 	int have_get_ptr = 0;
34197 
34198 	SAVE_OPLINE();
34199 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34200 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34201 	retval = &EX_T(opline->result.var).var.ptr;
34202 
34203 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
34204 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
34205 	}
34206 
34207 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
34208 	object = *object_ptr;
34209 
34210 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
34211 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
34212 		zval_dtor(free_op2.var);
34213 		if (RETURN_VALUE_USED(opline)) {
34214 			PZVAL_LOCK(&EG(uninitialized_zval));
34215 			*retval = &EG(uninitialized_zval);
34216 		}
34217 
34218 		CHECK_EXCEPTION();
34219 		ZEND_VM_NEXT_OPCODE();
34220 	}
34221 
34222 	/* here we are sure we are dealing with an object */
34223 
34224 	if (1) {
34225 		MAKE_REAL_ZVAL_PTR(property);
34226 	}
34227 
34228 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
34229 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34230 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
34231 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
34232 
34233 			have_get_ptr = 1;
34234 			incdec_op(*zptr);
34235 			if (RETURN_VALUE_USED(opline)) {
34236 				*retval = *zptr;
34237 				PZVAL_LOCK(*retval);
34238 			}
34239 		}
34240 	}
34241 
34242 	if (!have_get_ptr) {
34243 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
34244 			zval *z;
34245 
34246 			Z_ADDREF_P(object);
34247 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34248 
34249 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
34250 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
34251 
34252 				if (Z_REFCOUNT_P(z) == 0) {
34253 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
34254 					zval_dtor(z);
34255 					FREE_ZVAL(z);
34256 				}
34257 				z = value;
34258 			}
34259 			Z_ADDREF_P(z);
34260 			SEPARATE_ZVAL_IF_NOT_REF(&z);
34261 			incdec_op(z);
34262 			*retval = z;
34263 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34264 			zval_ptr_dtor(&object);
34265 			SELECTIVE_PZVAL_LOCK(*retval, opline);
34266 			zval_ptr_dtor(&z);
34267 		} else {
34268 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
34269 			if (RETURN_VALUE_USED(opline)) {
34270 				PZVAL_LOCK(&EG(uninitialized_zval));
34271 				*retval = &EG(uninitialized_zval);
34272 			}
34273 		}
34274 	}
34275 
34276 	if (1) {
34277 		zval_ptr_dtor(&property);
34278 	} else {
34279 		zval_dtor(free_op2.var);
34280 	}
34281 
34282 	CHECK_EXCEPTION();
34283 	ZEND_VM_NEXT_OPCODE();
34284 }
34285 
ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34286 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34287 {
34288 	return zend_pre_incdec_property_helper_SPEC_CV_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34289 }
34290 
ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34291 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34292 {
34293 	return zend_pre_incdec_property_helper_SPEC_CV_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34294 }
34295 
zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)34296 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
34297 {
34298 	USE_OPLINE
34299 	zend_free_op free_op2;
34300 	zval **object_ptr;
34301 	zval *object;
34302 	zval *property;
34303 	zval *retval;
34304 	int have_get_ptr = 0;
34305 
34306 	SAVE_OPLINE();
34307 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34308 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34309 	retval = &EX_T(opline->result.var).tmp_var;
34310 
34311 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
34312 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
34313 	}
34314 
34315 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
34316 	object = *object_ptr;
34317 
34318 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
34319 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
34320 		zval_dtor(free_op2.var);
34321 		ZVAL_NULL(retval);
34322 
34323 		CHECK_EXCEPTION();
34324 		ZEND_VM_NEXT_OPCODE();
34325 	}
34326 
34327 	/* here we are sure we are dealing with an object */
34328 
34329 	if (1) {
34330 		MAKE_REAL_ZVAL_PTR(property);
34331 	}
34332 
34333 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
34334 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34335 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
34336 			have_get_ptr = 1;
34337 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
34338 
34339 			ZVAL_COPY_VALUE(retval, *zptr);
34340 			zendi_zval_copy_ctor(*retval);
34341 
34342 			incdec_op(*zptr);
34343 
34344 		}
34345 	}
34346 
34347 	if (!have_get_ptr) {
34348 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
34349 			zval *z, *z_copy;
34350 
34351 			Z_ADDREF_P(object);
34352 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34353 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
34354 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
34355 
34356 				if (Z_REFCOUNT_P(z) == 0) {
34357 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
34358 					zval_dtor(z);
34359 					FREE_ZVAL(z);
34360 				}
34361 				z = value;
34362 			}
34363 			ZVAL_COPY_VALUE(retval, z);
34364 			zendi_zval_copy_ctor(*retval);
34365 			ALLOC_ZVAL(z_copy);
34366 			INIT_PZVAL_COPY(z_copy, z);
34367 			zendi_zval_copy_ctor(*z_copy);
34368 			incdec_op(z_copy);
34369 			Z_ADDREF_P(z);
34370 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34371 			zval_ptr_dtor(&object);
34372 			zval_ptr_dtor(&z_copy);
34373 			zval_ptr_dtor(&z);
34374 		} else {
34375 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
34376 			ZVAL_NULL(retval);
34377 		}
34378 	}
34379 
34380 	if (1) {
34381 		zval_ptr_dtor(&property);
34382 	} else {
34383 		zval_dtor(free_op2.var);
34384 	}
34385 
34386 	CHECK_EXCEPTION();
34387 	ZEND_VM_NEXT_OPCODE();
34388 }
34389 
ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34390 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34391 {
34392 	return zend_post_incdec_property_helper_SPEC_CV_TMP(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34393 }
34394 
ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34395 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34396 {
34397 	return zend_post_incdec_property_helper_SPEC_CV_TMP(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34398 }
34399 
ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34400 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34401 {
34402 	USE_OPLINE
34403 	zend_free_op free_op2;
34404 	zval *container;
34405 
34406 	SAVE_OPLINE();
34407 
34408 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
34409 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
34410 	}
34411 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
34412 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
34413 	zval_dtor(free_op2.var);
34414 
34415 	CHECK_EXCEPTION();
34416 	ZEND_VM_NEXT_OPCODE();
34417 }
34418 
ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34419 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34420 {
34421 	USE_OPLINE
34422 	zend_free_op free_op1, free_op2;
34423 	zval **container;
34424 
34425 	SAVE_OPLINE();
34426 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34427 
34428 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34429 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34430 	}
34431 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
34432 	zval_dtor(free_op2.var);
34433 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34434 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34435 	}
34436 
34437 	/* We are going to assign the result by reference */
34438 	if (UNEXPECTED(opline->extended_value != 0)) {
34439 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
34440 
34441 		if (retval_ptr) {
34442 			Z_DELREF_PP(retval_ptr);
34443 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
34444 			Z_ADDREF_PP(retval_ptr);
34445 		}
34446 	}
34447 
34448 	CHECK_EXCEPTION();
34449 	ZEND_VM_NEXT_OPCODE();
34450 }
34451 
ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34452 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34453 {
34454 	USE_OPLINE
34455 	zend_free_op free_op1, free_op2;
34456 	zval **container;
34457 
34458 	SAVE_OPLINE();
34459 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34460 
34461 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34462 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34463 	}
34464 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_RW TSRMLS_CC);
34465 	zval_dtor(free_op2.var);
34466 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34467 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34468 	}
34469 
34470 	CHECK_EXCEPTION();
34471 	ZEND_VM_NEXT_OPCODE();
34472 }
34473 
ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34474 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34475 {
34476 	USE_OPLINE
34477 	zend_free_op free_op2;
34478 	zval *container;
34479 
34480 	SAVE_OPLINE();
34481 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
34482 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_IS TSRMLS_CC);
34483 	zval_dtor(free_op2.var);
34484 
34485 	CHECK_EXCEPTION();
34486 	ZEND_VM_NEXT_OPCODE();
34487 }
34488 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34489 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34490 {
34491 	USE_OPLINE
34492 	zend_free_op free_op1, free_op2;
34493 
34494 	SAVE_OPLINE();
34495 
34496 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
34497 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34498 
34499 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34500 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34501 		}
34502 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
34503 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34504 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34505 		}
34506 		zval_dtor(free_op2.var);
34507 
34508 	} else {
34509 		zval *container;
34510 
34511 		if (IS_TMP_VAR == IS_UNUSED) {
34512 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
34513 		}
34514 		container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
34515 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_R TSRMLS_CC);
34516 		zval_dtor(free_op2.var);
34517 
34518 	}
34519 	CHECK_EXCEPTION();
34520 	ZEND_VM_NEXT_OPCODE();
34521 }
34522 
ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34523 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34524 {
34525 	USE_OPLINE
34526 	zend_free_op free_op1, free_op2;
34527 	zval **container;
34528 
34529 	SAVE_OPLINE();
34530 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
34531 
34532 	if (IS_CV == IS_CV) {
34533 		if (container != &EG(uninitialized_zval_ptr)) {
34534 			SEPARATE_ZVAL_IF_NOT_REF(container);
34535 		}
34536 	}
34537 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34538 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34539 	}
34540 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_TMP_VAR, BP_VAR_UNSET TSRMLS_CC);
34541 	zval_dtor(free_op2.var);
34542 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34543 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34544 	}
34545 
34546 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
34547 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
34548 		ZEND_VM_NEXT_OPCODE();
34549 	} else {
34550 		zend_free_op free_res;
34551 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
34552 
34553 		PZVAL_UNLOCK(*retval_ptr, &free_res);
34554 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
34555 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
34556 		}
34557 		PZVAL_LOCK(*retval_ptr);
34558 		FREE_OP_VAR_PTR(free_res);
34559 		CHECK_EXCEPTION();
34560 		ZEND_VM_NEXT_OPCODE();
34561 	}
34562 }
34563 
zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS)34564 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS)
34565 {
34566 	USE_OPLINE
34567 
34568 	zval *container;
34569 	zend_free_op free_op2;
34570 	zval *offset;
34571 
34572 	SAVE_OPLINE();
34573 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
34574 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34575 
34576 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
34577 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
34578 		zend_error(E_NOTICE, "Trying to get property of non-object");
34579 		PZVAL_LOCK(&EG(uninitialized_zval));
34580 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34581 		zval_dtor(free_op2.var);
34582 	} else {
34583 		zval *retval;
34584 
34585 		if (1) {
34586 			MAKE_REAL_ZVAL_PTR(offset);
34587 		}
34588 
34589 		/* here we are sure we are dealing with an object */
34590 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34591 
34592 		PZVAL_LOCK(retval);
34593 		AI_SET_PTR(&EX_T(opline->result.var), retval);
34594 
34595 		if (1) {
34596 			zval_ptr_dtor(&offset);
34597 		} else {
34598 			zval_dtor(free_op2.var);
34599 		}
34600 	}
34601 
34602 	CHECK_EXCEPTION();
34603 	ZEND_VM_NEXT_OPCODE();
34604 }
34605 
ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34606 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34607 {
34608 	return zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34609 }
34610 
ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34611 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34612 {
34613 	USE_OPLINE
34614 	zend_free_op free_op1, free_op2;
34615 	zval *property;
34616 	zval **container;
34617 
34618 	SAVE_OPLINE();
34619 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34620 
34621 	if (1) {
34622 		MAKE_REAL_ZVAL_PTR(property);
34623 	}
34624 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34625 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34626 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
34627 	}
34628 
34629 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
34630 	if (1) {
34631 		zval_ptr_dtor(&property);
34632 	} else {
34633 		zval_dtor(free_op2.var);
34634 	}
34635 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34636 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34637 	}
34638 
34639 	/* We are going to assign the result by reference */
34640 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
34641 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
34642 
34643 		Z_DELREF_PP(retval_ptr);
34644 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
34645 		Z_ADDREF_PP(retval_ptr);
34646 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
34647 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
34648 	}
34649 
34650 	CHECK_EXCEPTION();
34651 	ZEND_VM_NEXT_OPCODE();
34652 }
34653 
ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34654 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34655 {
34656 	USE_OPLINE
34657 	zend_free_op free_op1, free_op2;
34658 	zval *property;
34659 	zval **container;
34660 
34661 	SAVE_OPLINE();
34662 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34663 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
34664 
34665 	if (1) {
34666 		MAKE_REAL_ZVAL_PTR(property);
34667 	}
34668 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34669 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
34670 	}
34671 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
34672 	if (1) {
34673 		zval_ptr_dtor(&property);
34674 	} else {
34675 		zval_dtor(free_op2.var);
34676 	}
34677 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34678 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34679 	}
34680 
34681 	CHECK_EXCEPTION();
34682 	ZEND_VM_NEXT_OPCODE();
34683 }
34684 
ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34685 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34686 {
34687 	USE_OPLINE
34688 
34689 	zval *container;
34690 	zend_free_op free_op2;
34691 	zval *offset;
34692 
34693 	SAVE_OPLINE();
34694 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
34695 	offset  = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34696 
34697 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
34698 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
34699 		PZVAL_LOCK(&EG(uninitialized_zval));
34700 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34701 		zval_dtor(free_op2.var);
34702 	} else {
34703 		zval *retval;
34704 
34705 		if (1) {
34706 			MAKE_REAL_ZVAL_PTR(offset);
34707 		}
34708 
34709 		/* here we are sure we are dealing with an object */
34710 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34711 
34712 		PZVAL_LOCK(retval);
34713 		AI_SET_PTR(&EX_T(opline->result.var), retval);
34714 
34715 		if (1) {
34716 			zval_ptr_dtor(&offset);
34717 		} else {
34718 			zval_dtor(free_op2.var);
34719 		}
34720 	}
34721 
34722 	CHECK_EXCEPTION();
34723 	ZEND_VM_NEXT_OPCODE();
34724 }
34725 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34726 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34727 {
34728 	USE_OPLINE
34729 
34730 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
34731 		/* Behave like FETCH_OBJ_W */
34732 		zend_free_op free_op1, free_op2;
34733 		zval *property;
34734 		zval **container;
34735 
34736 		SAVE_OPLINE();
34737 		property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34738 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34739 
34740 		if (1) {
34741 			MAKE_REAL_ZVAL_PTR(property);
34742 		}
34743 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34744 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
34745 		}
34746 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
34747 		if (1) {
34748 			zval_ptr_dtor(&property);
34749 		} else {
34750 			zval_dtor(free_op2.var);
34751 		}
34752 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34753 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34754 		}
34755 
34756 		CHECK_EXCEPTION();
34757 		ZEND_VM_NEXT_OPCODE();
34758 	} else {
34759 		return zend_fetch_property_address_read_helper_SPEC_CV_TMP(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
34760 	}
34761 }
34762 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34763 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34764 {
34765 	USE_OPLINE
34766 	zend_free_op free_op1, free_op2, free_res;
34767 	zval **container;
34768 	zval *property;
34769 
34770 	SAVE_OPLINE();
34771 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
34772 	property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34773 
34774 	if (IS_CV == IS_CV) {
34775 		if (container != &EG(uninitialized_zval_ptr)) {
34776 			SEPARATE_ZVAL_IF_NOT_REF(container);
34777 		}
34778 	}
34779 	if (1) {
34780 		MAKE_REAL_ZVAL_PTR(property);
34781 	}
34782 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
34783 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
34784 	}
34785 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
34786 	if (1) {
34787 		zval_ptr_dtor(&property);
34788 	} else {
34789 		zval_dtor(free_op2.var);
34790 	}
34791 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
34792 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
34793 	}
34794 
34795 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
34796 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
34797 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
34798 	}
34799 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
34800 	FREE_OP_VAR_PTR(free_res);
34801 	CHECK_EXCEPTION();
34802 	ZEND_VM_NEXT_OPCODE();
34803 }
34804 
ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34805 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34806 {
34807 	USE_OPLINE
34808 	zend_free_op free_op2;
34809 	zval **object_ptr;
34810 	zval *property_name;
34811 
34812 	SAVE_OPLINE();
34813 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34814 	property_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34815 
34816 	if (1) {
34817 		MAKE_REAL_ZVAL_PTR(property_name);
34818 	}
34819 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
34820 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34821 	}
34822 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34823 	if (1) {
34824 		zval_ptr_dtor(&property_name);
34825 	} else {
34826 		zval_dtor(free_op2.var);
34827 	}
34828 
34829 	/* assign_obj has two opcodes! */
34830 	CHECK_EXCEPTION();
34831 	ZEND_VM_INC_OPCODE();
34832 	ZEND_VM_NEXT_OPCODE();
34833 }
34834 
ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34835 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34836 {
34837 	USE_OPLINE
34838 
34839 	zval **object_ptr;
34840 
34841 	SAVE_OPLINE();
34842 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34843 
34844 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
34845 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
34846 	}
34847 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
34848 		zend_free_op free_op2;
34849 		zval *property_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34850 
34851 		if (1) {
34852 			MAKE_REAL_ZVAL_PTR(property_name);
34853 		}
34854 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
34855 		if (1) {
34856 			zval_ptr_dtor(&property_name);
34857 		} else {
34858 			zval_dtor(free_op2.var);
34859 		}
34860 	} else {
34861 		zend_free_op free_op2, free_op_data1, free_op_data2;
34862 		zval *value;
34863 		zval *dim = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34864 		zval **variable_ptr_ptr;
34865 
34866 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_TMP_VAR, BP_VAR_W TSRMLS_CC);
34867 		zval_dtor(free_op2.var);
34868 
34869 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
34870 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
34871 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
34872 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
34873 				if (RETURN_VALUE_USED(opline)) {
34874 					zval *retval;
34875 
34876 					ALLOC_ZVAL(retval);
34877 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
34878 					INIT_PZVAL(retval);
34879 					AI_SET_PTR(&EX_T(opline->result.var), retval);
34880 				}
34881 			} else if (RETURN_VALUE_USED(opline)) {
34882 				PZVAL_LOCK(&EG(uninitialized_zval));
34883 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34884 			}
34885 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
34886 			if (IS_TMP_FREE(free_op_data1)) {
34887 				zval_dtor(value);
34888 			}
34889 			if (RETURN_VALUE_USED(opline)) {
34890 				PZVAL_LOCK(&EG(uninitialized_zval));
34891 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34892 			}
34893 		} else {
34894 			if ((opline+1)->op1_type == IS_TMP_VAR) {
34895 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34896 			} else if ((opline+1)->op1_type == IS_CONST) {
34897 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34898 			} else {
34899 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34900 			}
34901 			if (RETURN_VALUE_USED(opline)) {
34902 				PZVAL_LOCK(value);
34903 				AI_SET_PTR(&EX_T(opline->result.var), value);
34904 			}
34905 		}
34906 		FREE_OP_VAR_PTR(free_op_data2);
34907 	 	FREE_OP_IF_VAR(free_op_data1);
34908 	}
34909 
34910 	/* assign_dim has two opcodes! */
34911 	CHECK_EXCEPTION();
34912 	ZEND_VM_INC_OPCODE();
34913 	ZEND_VM_NEXT_OPCODE();
34914 }
34915 
ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34916 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34917 {
34918 	USE_OPLINE
34919 	zend_free_op free_op2;
34920 	zval *value;
34921 	zval **variable_ptr_ptr;
34922 
34923 	SAVE_OPLINE();
34924 	value = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34925 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
34926 
34927 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
34928 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_TMP_VAR TSRMLS_CC)) {
34929 			if (RETURN_VALUE_USED(opline)) {
34930 				zval *retval;
34931 
34932 				ALLOC_ZVAL(retval);
34933 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
34934 				INIT_PZVAL(retval);
34935 				AI_SET_PTR(&EX_T(opline->result.var), retval);
34936 			}
34937 		} else if (RETURN_VALUE_USED(opline)) {
34938 			PZVAL_LOCK(&EG(uninitialized_zval));
34939 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34940 		}
34941 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
34942 		if (1) {
34943 			zval_dtor(value);
34944 		}
34945 		if (RETURN_VALUE_USED(opline)) {
34946 			PZVAL_LOCK(&EG(uninitialized_zval));
34947 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
34948 		}
34949 	} else {
34950 		if (IS_TMP_VAR == IS_TMP_VAR) {
34951 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34952 		} else if (IS_TMP_VAR == IS_CONST) {
34953 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34954 		} else {
34955 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
34956 		}
34957 		if (RETURN_VALUE_USED(opline)) {
34958 			PZVAL_LOCK(value);
34959 			AI_SET_PTR(&EX_T(opline->result.var), value);
34960 		}
34961 	}
34962 
34963 	if (IS_CV == IS_VAR && 0) {
34964 		zval_ptr_dtor(&value);
34965 	}
34966 
34967 	/* zend_assign_to_variable() always takes care of op2, never free it! */
34968 
34969 	CHECK_EXCEPTION();
34970 	ZEND_VM_NEXT_OPCODE();
34971 }
34972 
ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)34973 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
34974 {
34975 	USE_OPLINE
34976 	zval *function_name;
34977 	char *function_name_strval;
34978 	int function_name_strlen;
34979 	zend_free_op free_op2;
34980 	call_slot *call = EX(call_slots) + opline->result.num;
34981 
34982 	SAVE_OPLINE();
34983 
34984 	function_name = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
34985 
34986 	if (IS_TMP_VAR != IS_CONST &&
34987 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
34988 		if (UNEXPECTED(EG(exception) != NULL)) {
34989 			HANDLE_EXCEPTION();
34990 		}
34991 		zend_error_noreturn(E_ERROR, "Method name must be a string");
34992 	}
34993 
34994 	function_name_strval = Z_STRVAL_P(function_name);
34995 	function_name_strlen = Z_STRLEN_P(function_name);
34996 
34997 	call->object = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
34998 
34999 	if (EXPECTED(call->object != NULL) &&
35000 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
35001 		call->called_scope = Z_OBJCE_P(call->object);
35002 
35003 		if (IS_TMP_VAR != IS_CONST ||
35004 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
35005 		    zval *object = call->object;
35006 
35007 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
35008 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
35009 			}
35010 
35011 			/* First, locate the function. */
35012 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_TMP_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
35013 			if (UNEXPECTED(call->fbc == NULL)) {
35014 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
35015 			}
35016 			if (IS_TMP_VAR == IS_CONST &&
35017 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
35018 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
35019 			    EXPECTED(call->object == object)) {
35020 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
35021 			}
35022 		}
35023 	} else {
35024 		if (UNEXPECTED(EG(exception) != NULL)) {
35025 			zval_dtor(free_op2.var);
35026 			HANDLE_EXCEPTION();
35027 		}
35028 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
35029 	}
35030 
35031 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
35032 		call->object = NULL;
35033 	} else {
35034 		if (!PZVAL_IS_REF(call->object)) {
35035 			Z_ADDREF_P(call->object); /* For $this pointer */
35036 		} else {
35037 			zval *this_ptr;
35038 			ALLOC_ZVAL(this_ptr);
35039 			INIT_PZVAL_COPY(this_ptr, call->object);
35040 			zval_copy_ctor(this_ptr);
35041 			call->object = this_ptr;
35042 		}
35043 	}
35044 	call->is_ctor_call = 0;
35045 	EX(call) = call;
35046 
35047 	zval_dtor(free_op2.var);
35048 
35049 	CHECK_EXCEPTION();
35050 	ZEND_VM_NEXT_OPCODE();
35051 }
35052 
ZEND_CASE_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35053 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35054 {
35055 	USE_OPLINE
35056 	zend_free_op free_op2;
35057 
35058 	SAVE_OPLINE();
35059 	if (IS_CV==IS_VAR) {
35060 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
35061 	}
35062 	is_equal_function(&EX_T(opline->result.var).tmp_var,
35063 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35064 				 _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35065 
35066 	zval_dtor(free_op2.var);
35067 	CHECK_EXCEPTION();
35068 	ZEND_VM_NEXT_OPCODE();
35069 }
35070 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35071 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35072 {
35073 	USE_OPLINE
35074 
35075 	zval *expr_ptr;
35076 
35077 	SAVE_OPLINE();
35078 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
35079 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
35080 
35081 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
35082 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
35083 		}
35084 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
35085 		expr_ptr = *expr_ptr_ptr;
35086 		Z_ADDREF_P(expr_ptr);
35087 	} else {
35088 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
35089 		if (0) { /* temporary variable */
35090 			zval *new_expr;
35091 
35092 			ALLOC_ZVAL(new_expr);
35093 			INIT_PZVAL_COPY(new_expr, expr_ptr);
35094 			expr_ptr = new_expr;
35095 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
35096 			zval *new_expr;
35097 
35098 			ALLOC_ZVAL(new_expr);
35099 			INIT_PZVAL_COPY(new_expr, expr_ptr);
35100 			expr_ptr = new_expr;
35101 			zendi_zval_copy_ctor(*expr_ptr);
35102 		} else {
35103 			Z_ADDREF_P(expr_ptr);
35104 		}
35105 	}
35106 
35107 	if (IS_TMP_VAR != IS_UNUSED) {
35108 		zend_free_op free_op2;
35109 		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35110 		ulong hval;
35111 
35112 		switch (Z_TYPE_P(offset)) {
35113 			case IS_DOUBLE:
35114 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
35115 				goto num_index;
35116 			case IS_LONG:
35117 			case IS_BOOL:
35118 				hval = Z_LVAL_P(offset);
35119 num_index:
35120 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
35121 				break;
35122 			case IS_STRING:
35123 				if (IS_TMP_VAR == IS_CONST) {
35124 					hval = Z_HASH_P(offset);
35125 				} else {
35126 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
35127 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
35128 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
35129 					} else {
35130 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
35131 					}
35132 				}
35133 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
35134 				break;
35135 			case IS_NULL:
35136 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
35137 				break;
35138 			default:
35139 				zend_error(E_WARNING, "Illegal offset type");
35140 				zval_ptr_dtor(&expr_ptr);
35141 				/* do nothing */
35142 				break;
35143 		}
35144 		zval_dtor(free_op2.var);
35145 	} else {
35146 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
35147 	}
35148 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
35149 
35150 	} else {
35151 
35152 	}
35153 	CHECK_EXCEPTION();
35154 	ZEND_VM_NEXT_OPCODE();
35155 }
35156 
ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35157 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35158 {
35159 	USE_OPLINE
35160 
35161 	array_init(&EX_T(opline->result.var).tmp_var);
35162 	if (IS_CV == IS_UNUSED) {
35163 		ZEND_VM_NEXT_OPCODE();
35164 #if 0 || IS_CV != IS_UNUSED
35165 	} else {
35166 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35167 #endif
35168 	}
35169 }
35170 
ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35171 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35172 {
35173 	USE_OPLINE
35174 	zend_free_op free_op2;
35175 	zval **container;
35176 	zval *offset;
35177 	ulong hval;
35178 
35179 	SAVE_OPLINE();
35180 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
35181 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
35182 		SEPARATE_ZVAL_IF_NOT_REF(container);
35183 	}
35184 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35185 
35186 	if (IS_CV != IS_VAR || container) {
35187 		switch (Z_TYPE_PP(container)) {
35188 			case IS_ARRAY: {
35189 				HashTable *ht = Z_ARRVAL_PP(container);
35190 
35191 				switch (Z_TYPE_P(offset)) {
35192 					case IS_DOUBLE:
35193 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
35194 						zend_hash_index_del(ht, hval);
35195 						break;
35196 					case IS_RESOURCE:
35197 					case IS_BOOL:
35198 					case IS_LONG:
35199 						hval = Z_LVAL_P(offset);
35200 						zend_hash_index_del(ht, hval);
35201 						break;
35202 					case IS_STRING:
35203 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
35204 							Z_ADDREF_P(offset);
35205 						}
35206 						if (IS_TMP_VAR == IS_CONST) {
35207 							hval = Z_HASH_P(offset);
35208 						} else {
35209 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
35210 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
35211 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
35212 							} else {
35213 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
35214 							}
35215 						}
35216 						if (ht == &EG(symbol_table)) {
35217 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
35218 						} else {
35219 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
35220 						}
35221 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
35222 							zval_ptr_dtor(&offset);
35223 						}
35224 						break;
35225 num_index_dim:
35226 						zend_hash_index_del(ht, hval);
35227 						if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
35228 							zval_ptr_dtor(&offset);
35229 						}
35230 						break;
35231 					case IS_NULL:
35232 						zend_hash_del(ht, "", sizeof(""));
35233 						break;
35234 					default:
35235 						zend_error(E_WARNING, "Illegal offset type in unset");
35236 						break;
35237 				}
35238 				zval_dtor(free_op2.var);
35239 				break;
35240 			}
35241 			case IS_OBJECT:
35242 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
35243 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
35244 				}
35245 				if (1) {
35246 					MAKE_REAL_ZVAL_PTR(offset);
35247 				}
35248 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
35249 				if (1) {
35250 					zval_ptr_dtor(&offset);
35251 				} else {
35252 					zval_dtor(free_op2.var);
35253 				}
35254 				break;
35255 			case IS_STRING:
35256 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
35257 				ZEND_VM_CONTINUE(); /* bailed out before */
35258 			default:
35259 				zval_dtor(free_op2.var);
35260 				break;
35261 		}
35262 	} else {
35263 		zval_dtor(free_op2.var);
35264 	}
35265 
35266 	CHECK_EXCEPTION();
35267 	ZEND_VM_NEXT_OPCODE();
35268 }
35269 
ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35270 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35271 {
35272 	USE_OPLINE
35273 	zend_free_op free_op2;
35274 	zval **container;
35275 	zval *offset;
35276 
35277 	SAVE_OPLINE();
35278 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
35279 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35280 
35281 	if (IS_CV != IS_VAR || container) {
35282 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
35283 			SEPARATE_ZVAL_IF_NOT_REF(container);
35284 		}
35285 		if (Z_TYPE_PP(container) == IS_OBJECT) {
35286 			if (1) {
35287 				MAKE_REAL_ZVAL_PTR(offset);
35288 			}
35289 			if (Z_OBJ_HT_P(*container)->unset_property) {
35290 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35291 			} else {
35292 				zend_error(E_NOTICE, "Trying to unset property of non-object");
35293 			}
35294 			if (1) {
35295 				zval_ptr_dtor(&offset);
35296 			} else {
35297 				zval_dtor(free_op2.var);
35298 			}
35299 		} else {
35300 			zval_dtor(free_op2.var);
35301 		}
35302 	} else {
35303 		zval_dtor(free_op2.var);
35304 	}
35305 
35306 	CHECK_EXCEPTION();
35307 	ZEND_VM_NEXT_OPCODE();
35308 }
35309 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)35310 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
35311 {
35312 	USE_OPLINE
35313 	zend_free_op free_op2;
35314 	zval *container;
35315 	zval **value = NULL;
35316 	int result = 0;
35317 	ulong hval;
35318 	zval *offset;
35319 
35320 	SAVE_OPLINE();
35321 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
35322 
35323 	offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35324 
35325 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
35326 		HashTable *ht;
35327 		int isset = 0;
35328 
35329 		ht = Z_ARRVAL_P(container);
35330 
35331 		switch (Z_TYPE_P(offset)) {
35332 			case IS_DOUBLE:
35333 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
35334 				goto num_index_prop;
35335 			case IS_RESOURCE:
35336 			case IS_BOOL:
35337 			case IS_LONG:
35338 				hval = Z_LVAL_P(offset);
35339 num_index_prop:
35340 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
35341 					isset = 1;
35342 				}
35343 				break;
35344 			case IS_STRING:
35345 				if (IS_TMP_VAR == IS_CONST) {
35346 					hval = Z_HASH_P(offset);
35347 				} else {
35348 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
35349 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
35350 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
35351 					} else {
35352 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
35353 					}
35354 				}
35355 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
35356 					isset = 1;
35357 				}
35358 				break;
35359 			case IS_NULL:
35360 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
35361 					isset = 1;
35362 				}
35363 				break;
35364 			default:
35365 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
35366 				break;
35367 		}
35368 
35369 		if (opline->extended_value & ZEND_ISSET) {
35370 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
35371 				result = 0;
35372 			} else {
35373 				result = isset;
35374 			}
35375 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
35376 			if (!isset || !i_zend_is_true(*value)) {
35377 				result = 0;
35378 			} else {
35379 				result = 1;
35380 			}
35381 		}
35382 		zval_dtor(free_op2.var);
35383 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
35384 		if (1) {
35385 			MAKE_REAL_ZVAL_PTR(offset);
35386 		}
35387 		if (prop_dim) {
35388 			if (Z_OBJ_HT_P(container)->has_property) {
35389 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35390 			} else {
35391 				zend_error(E_NOTICE, "Trying to check property of non-object");
35392 				result = 0;
35393 			}
35394 		} else {
35395 			if (Z_OBJ_HT_P(container)->has_dimension) {
35396 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
35397 			} else {
35398 				zend_error(E_NOTICE, "Trying to check element of non-array");
35399 				result = 0;
35400 			}
35401 		}
35402 		if (1) {
35403 			zval_ptr_dtor(&offset);
35404 		} else {
35405 			zval_dtor(free_op2.var);
35406 		}
35407 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
35408 		zval tmp;
35409 
35410 		if (Z_TYPE_P(offset) != IS_LONG) {
35411 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
35412 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
35413 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
35414 				ZVAL_COPY_VALUE(&tmp, offset);
35415 				zval_copy_ctor(&tmp);
35416 				convert_to_long(&tmp);
35417 				offset = &tmp;
35418 			} else {
35419 				/* can not be converted to proper offset, return "not set" */
35420 				result = 0;
35421 			}
35422 		}
35423 		if (Z_TYPE_P(offset) == IS_LONG) {
35424 			if (opline->extended_value & ZEND_ISSET) {
35425 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
35426 					result = 1;
35427 				}
35428 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
35429 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
35430 					result = 1;
35431 				}
35432 			}
35433 		}
35434 		zval_dtor(free_op2.var);
35435 	} else {
35436 		zval_dtor(free_op2.var);
35437 	}
35438 
35439 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
35440 	if (opline->extended_value & ZEND_ISSET) {
35441 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
35442 	} else {
35443 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
35444 	}
35445 
35446 	CHECK_EXCEPTION();
35447 	ZEND_VM_NEXT_OPCODE();
35448 }
35449 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35450 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35451 {
35452 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35453 }
35454 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35455 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35456 {
35457 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
35458 }
35459 
ZEND_YIELD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35460 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35461 {
35462 	USE_OPLINE
35463 
35464 	/* The generator object is stored in return_value_ptr_ptr */
35465 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
35466 
35467 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
35468 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
35469 	}
35470 
35471 	/* Destroy the previously yielded value */
35472 	if (generator->value) {
35473 		zval_ptr_dtor(&generator->value);
35474 	}
35475 
35476 	/* Destroy the previously yielded key */
35477 	if (generator->key) {
35478 		zval_ptr_dtor(&generator->key);
35479 	}
35480 
35481 	/* Set the new yielded value */
35482 	if (IS_CV != IS_UNUSED) {
35483 
35484 
35485 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
35486 			/* Constants and temporary variables aren't yieldable by reference,
35487 			 * but we still allow them with a notice. */
35488 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
35489 				zval *value, *copy;
35490 
35491 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
35492 
35493 				value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
35494 				ALLOC_ZVAL(copy);
35495 				INIT_PZVAL_COPY(copy, value);
35496 
35497 				/* Temporary variables don't need ctor copying */
35498 				if (!0) {
35499 					zval_copy_ctor(copy);
35500 				}
35501 
35502 				generator->value = copy;
35503 			} else {
35504 				zval **value_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
35505 
35506 				if (IS_CV == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
35507 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
35508 				}
35509 
35510 				/* If a function call result is yielded and the function did
35511 				 * not return by reference we throw a notice. */
35512 				if (IS_CV == IS_VAR && !Z_ISREF_PP(value_ptr)
35513 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
35514 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
35515 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
35516 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
35517 
35518 					Z_ADDREF_PP(value_ptr);
35519 					generator->value = *value_ptr;
35520 				} else {
35521 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
35522 					Z_ADDREF_PP(value_ptr);
35523 					generator->value = *value_ptr;
35524 				}
35525 
35526 			}
35527 		} else {
35528 			zval *value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
35529 
35530 			/* Consts, temporary variables and references need copying */
35531 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
35532 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
35533 			) {
35534 				zval *copy;
35535 
35536 				ALLOC_ZVAL(copy);
35537 				INIT_PZVAL_COPY(copy, value);
35538 
35539 				/* Temporary variables don't need ctor copying */
35540 				if (!0) {
35541 					zval_copy_ctor(copy);
35542 				}
35543 
35544 				generator->value = copy;
35545 			} else {
35546 				Z_ADDREF_P(value);
35547 				generator->value = value;
35548 			}
35549 
35550 		}
35551 	} else {
35552 		/* If no value was specified yield null */
35553 		Z_ADDREF(EG(uninitialized_zval));
35554 		generator->value = &EG(uninitialized_zval);
35555 	}
35556 
35557 	/* Set the new yielded key */
35558 	if (IS_TMP_VAR != IS_UNUSED) {
35559 		zend_free_op free_op2;
35560 		zval *key = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35561 
35562 		/* Consts, temporary variables and references need copying */
35563 		if (IS_TMP_VAR == IS_CONST || IS_TMP_VAR == IS_TMP_VAR
35564 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
35565 		) {
35566 			zval *copy;
35567 
35568 			ALLOC_ZVAL(copy);
35569 			INIT_PZVAL_COPY(copy, key);
35570 
35571 			/* Temporary variables don't need ctor copying */
35572 			if (!1) {
35573 				zval_copy_ctor(copy);
35574 			}
35575 
35576 			generator->key = copy;
35577 		} else {
35578 			Z_ADDREF_P(key);
35579 			generator->key = key;
35580 		}
35581 
35582 		if (Z_TYPE_P(generator->key) == IS_LONG
35583 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
35584 		) {
35585 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
35586 		}
35587 
35588 	} else {
35589 		/* If no key was specified we use auto-increment keys */
35590 		generator->largest_used_integer_key++;
35591 
35592 		ALLOC_INIT_ZVAL(generator->key);
35593 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
35594 	}
35595 
35596 	if (RETURN_VALUE_USED(opline)) {
35597 		/* If the return value of yield is used set the send
35598 		 * target and initialize it to NULL */
35599 		generator->send_target = &EX_T(opline->result.var).var.ptr;
35600 		Z_ADDREF(EG(uninitialized_zval));
35601 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
35602 	} else {
35603 		generator->send_target = NULL;
35604 	}
35605 
35606 	/* We increment to the next op, so we are at the correct position when the
35607 	 * generator is resumed. */
35608 	ZEND_VM_INC_OPCODE();
35609 
35610 	/* The GOTO VM uses a local opline variable. We need to set the opline
35611 	 * variable in execute_data so we don't resume at an old position. */
35612 	SAVE_OPLINE();
35613 
35614 	ZEND_VM_RETURN();
35615 }
35616 
ZEND_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35617 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35618 {
35619 	USE_OPLINE
35620 	zend_free_op free_op2;
35621 
35622 	SAVE_OPLINE();
35623 	fast_add_function(&EX_T(opline->result.var).tmp_var,
35624 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35625 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35626 
35627 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35628 	CHECK_EXCEPTION();
35629 	ZEND_VM_NEXT_OPCODE();
35630 }
35631 
ZEND_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35632 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35633 {
35634 	USE_OPLINE
35635 	zend_free_op free_op2;
35636 
35637 	SAVE_OPLINE();
35638 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
35639 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35640 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35641 
35642 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35643 	CHECK_EXCEPTION();
35644 	ZEND_VM_NEXT_OPCODE();
35645 }
35646 
ZEND_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35647 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35648 {
35649 	USE_OPLINE
35650 	zend_free_op free_op2;
35651 
35652 	SAVE_OPLINE();
35653 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
35654 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35655 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35656 
35657 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35658 	CHECK_EXCEPTION();
35659 	ZEND_VM_NEXT_OPCODE();
35660 }
35661 
ZEND_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35662 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35663 {
35664 	USE_OPLINE
35665 	zend_free_op free_op2;
35666 
35667 	SAVE_OPLINE();
35668 	fast_div_function(&EX_T(opline->result.var).tmp_var,
35669 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35670 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35671 
35672 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35673 	CHECK_EXCEPTION();
35674 	ZEND_VM_NEXT_OPCODE();
35675 }
35676 
ZEND_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35677 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35678 {
35679 	USE_OPLINE
35680 	zend_free_op free_op2;
35681 
35682 	SAVE_OPLINE();
35683 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
35684 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35685 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35686 
35687 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35688 	CHECK_EXCEPTION();
35689 	ZEND_VM_NEXT_OPCODE();
35690 }
35691 
ZEND_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35692 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35693 {
35694 	USE_OPLINE
35695 	zend_free_op free_op2;
35696 
35697 	SAVE_OPLINE();
35698 	shift_left_function(&EX_T(opline->result.var).tmp_var,
35699 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35700 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35701 
35702 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35703 	CHECK_EXCEPTION();
35704 	ZEND_VM_NEXT_OPCODE();
35705 }
35706 
ZEND_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35707 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35708 {
35709 	USE_OPLINE
35710 	zend_free_op free_op2;
35711 
35712 	SAVE_OPLINE();
35713 	shift_right_function(&EX_T(opline->result.var).tmp_var,
35714 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35715 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35716 
35717 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35718 	CHECK_EXCEPTION();
35719 	ZEND_VM_NEXT_OPCODE();
35720 }
35721 
ZEND_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35722 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35723 {
35724 	USE_OPLINE
35725 	zend_free_op free_op2;
35726 
35727 	SAVE_OPLINE();
35728 	concat_function(&EX_T(opline->result.var).tmp_var,
35729 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35730 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35731 
35732 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35733 	CHECK_EXCEPTION();
35734 	ZEND_VM_NEXT_OPCODE();
35735 }
35736 
ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35737 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35738 {
35739 	USE_OPLINE
35740 	zend_free_op free_op2;
35741 
35742 	SAVE_OPLINE();
35743 	is_identical_function(&EX_T(opline->result.var).tmp_var,
35744 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35745 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35746 
35747 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35748 	CHECK_EXCEPTION();
35749 	ZEND_VM_NEXT_OPCODE();
35750 }
35751 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35752 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35753 {
35754 	USE_OPLINE
35755 	zend_free_op free_op2;
35756 	zval *result = &EX_T(opline->result.var).tmp_var;
35757 
35758 	SAVE_OPLINE();
35759 	is_identical_function(result,
35760 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35761 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35762 	Z_LVAL_P(result) = !Z_LVAL_P(result);
35763 
35764 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35765 	CHECK_EXCEPTION();
35766 	ZEND_VM_NEXT_OPCODE();
35767 }
35768 
ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35769 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35770 {
35771 	USE_OPLINE
35772 	zend_free_op free_op2;
35773 	zval *result = &EX_T(opline->result.var).tmp_var;
35774 
35775 	SAVE_OPLINE();
35776 	ZVAL_BOOL(result, fast_equal_function(result,
35777 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35778 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
35779 
35780 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35781 	CHECK_EXCEPTION();
35782 	ZEND_VM_NEXT_OPCODE();
35783 }
35784 
ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35785 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35786 {
35787 	USE_OPLINE
35788 	zend_free_op free_op2;
35789 	zval *result = &EX_T(opline->result.var).tmp_var;
35790 
35791 	SAVE_OPLINE();
35792 	ZVAL_BOOL(result, fast_not_equal_function(result,
35793 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35794 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
35795 
35796 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35797 	CHECK_EXCEPTION();
35798 	ZEND_VM_NEXT_OPCODE();
35799 }
35800 
ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35801 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35802 {
35803 	USE_OPLINE
35804 	zend_free_op free_op2;
35805 	zval *result = &EX_T(opline->result.var).tmp_var;
35806 
35807 	SAVE_OPLINE();
35808 	ZVAL_BOOL(result, fast_is_smaller_function(result,
35809 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35810 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
35811 
35812 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35813 	CHECK_EXCEPTION();
35814 	ZEND_VM_NEXT_OPCODE();
35815 }
35816 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35817 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35818 {
35819 	USE_OPLINE
35820 	zend_free_op free_op2;
35821 	zval *result = &EX_T(opline->result.var).tmp_var;
35822 
35823 	SAVE_OPLINE();
35824 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
35825 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35826 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC));
35827 
35828 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35829 	CHECK_EXCEPTION();
35830 	ZEND_VM_NEXT_OPCODE();
35831 }
35832 
ZEND_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35833 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35834 {
35835 	USE_OPLINE
35836 	zend_free_op free_op2;
35837 
35838 	SAVE_OPLINE();
35839 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
35840 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35841 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35842 
35843 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35844 	CHECK_EXCEPTION();
35845 	ZEND_VM_NEXT_OPCODE();
35846 }
35847 
ZEND_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35848 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35849 {
35850 	USE_OPLINE
35851 	zend_free_op free_op2;
35852 
35853 	SAVE_OPLINE();
35854 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
35855 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35856 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35857 
35858 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35859 	CHECK_EXCEPTION();
35860 	ZEND_VM_NEXT_OPCODE();
35861 }
35862 
ZEND_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35863 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35864 {
35865 	USE_OPLINE
35866 	zend_free_op free_op2;
35867 
35868 	SAVE_OPLINE();
35869 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
35870 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35871 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35872 
35873 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35874 	CHECK_EXCEPTION();
35875 	ZEND_VM_NEXT_OPCODE();
35876 }
35877 
ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)35878 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
35879 {
35880 	USE_OPLINE
35881 	zend_free_op free_op2;
35882 
35883 	SAVE_OPLINE();
35884 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
35885 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
35886 		_get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
35887 
35888 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35889 	CHECK_EXCEPTION();
35890 	ZEND_VM_NEXT_OPCODE();
35891 }
35892 
zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)35893 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
35894 {
35895 	USE_OPLINE
35896 	zend_free_op free_op2, free_op_data1;
35897 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
35898 	zval *object;
35899 	zval *property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
35900 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
35901 	int have_get_ptr = 0;
35902 
35903 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
35904 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
35905 	}
35906 
35907 	make_real_object(object_ptr TSRMLS_CC);
35908 	object = *object_ptr;
35909 
35910 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
35911 		zend_error(E_WARNING, "Attempt to assign property of non-object");
35912 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35913 		FREE_OP(free_op_data1);
35914 
35915 		if (RETURN_VALUE_USED(opline)) {
35916 			PZVAL_LOCK(&EG(uninitialized_zval));
35917 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
35918 			EX_T(opline->result.var).var.ptr_ptr = NULL;
35919 		}
35920 	} else {
35921 		/* here we are sure we are dealing with an object */
35922 		if (0) {
35923 			MAKE_REAL_ZVAL_PTR(property);
35924 		}
35925 
35926 		/* here property is a string */
35927 		if (opline->extended_value == ZEND_ASSIGN_OBJ
35928 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
35929 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35930 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
35931 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
35932 
35933 				have_get_ptr = 1;
35934 				binary_op(*zptr, *zptr, value TSRMLS_CC);
35935 				if (RETURN_VALUE_USED(opline)) {
35936 					PZVAL_LOCK(*zptr);
35937 					EX_T(opline->result.var).var.ptr = *zptr;
35938 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35939 				}
35940 			}
35941 		}
35942 
35943 		if (!have_get_ptr) {
35944 			zval *z = NULL;
35945 
35946 			Z_ADDREF_P(object);
35947 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
35948 				if (Z_OBJ_HT_P(object)->read_property) {
35949 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35950 				}
35951 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
35952 				if (Z_OBJ_HT_P(object)->read_dimension) {
35953 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
35954 				}
35955 			}
35956 			if (z) {
35957 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
35958 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
35959 
35960 					if (Z_REFCOUNT_P(z) == 0) {
35961 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
35962 						zval_dtor(z);
35963 						FREE_ZVAL(z);
35964 					}
35965 					z = value;
35966 				}
35967 				Z_ADDREF_P(z);
35968 				SEPARATE_ZVAL_IF_NOT_REF(&z);
35969 				binary_op(z, z, value TSRMLS_CC);
35970 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
35971 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
35972 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
35973 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
35974 				}
35975 				if (RETURN_VALUE_USED(opline)) {
35976 					PZVAL_LOCK(z);
35977 					EX_T(opline->result.var).var.ptr = z;
35978 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35979 				}
35980 				zval_ptr_dtor(&z);
35981 			} else {
35982 				zend_error(E_WARNING, "Attempt to assign property of non-object");
35983 				if (RETURN_VALUE_USED(opline)) {
35984 					PZVAL_LOCK(&EG(uninitialized_zval));
35985 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
35986 					EX_T(opline->result.var).var.ptr_ptr = NULL;
35987 				}
35988 			}
35989 			zval_ptr_dtor(&object);
35990 		}
35991 
35992 		if (0) {
35993 			zval_ptr_dtor(&property);
35994 		} else {
35995 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
35996 		}
35997 		FREE_OP(free_op_data1);
35998 	}
35999 
36000 	/* assign_obj has two opcodes! */
36001 	CHECK_EXCEPTION();
36002 	ZEND_VM_INC_OPCODE();
36003 	ZEND_VM_NEXT_OPCODE();
36004 }
36005 
zend_binary_assign_op_helper_SPEC_CV_VAR(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)36006 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_VAR(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
36007 {
36008 	USE_OPLINE
36009 	zend_free_op free_op2, free_op_data2, free_op_data1;
36010 	zval **var_ptr;
36011 	zval *value;
36012 
36013 	SAVE_OPLINE();
36014 	switch (opline->extended_value) {
36015 		case ZEND_ASSIGN_OBJ:
36016 			return zend_binary_assign_op_obj_helper_SPEC_CV_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36017 			break;
36018 		case ZEND_ASSIGN_DIM: {
36019 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36020 
36021 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36022 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36023 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
36024 					if (IS_CV == IS_VAR && !0) {
36025 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
36026 					}
36027 					return zend_binary_assign_op_obj_helper_SPEC_CV_VAR(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36028 				} else {
36029 					zval *dim = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36030 
36031 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_VAR, BP_VAR_RW TSRMLS_CC);
36032 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
36033 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
36034 				}
36035 			}
36036 			break;
36037 		default:
36038 			value = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36039 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36040 			/* do nothing */
36041 			break;
36042 	}
36043 
36044 	if (UNEXPECTED(var_ptr == NULL)) {
36045 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
36046 	}
36047 
36048 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
36049 		if (RETURN_VALUE_USED(opline)) {
36050 			PZVAL_LOCK(&EG(uninitialized_zval));
36051 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
36052 		}
36053 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36054 
36055 		CHECK_EXCEPTION();
36056 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
36057 			ZEND_VM_INC_OPCODE();
36058 		}
36059 		ZEND_VM_NEXT_OPCODE();
36060 	}
36061 
36062 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
36063 
36064 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
36065 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
36066 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
36067 		/* proxy object */
36068 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
36069 		Z_ADDREF_P(objval);
36070 		binary_op(objval, objval, value TSRMLS_CC);
36071 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
36072 		zval_ptr_dtor(&objval);
36073 	} else {
36074 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
36075 	}
36076 
36077 	if (RETURN_VALUE_USED(opline)) {
36078 		PZVAL_LOCK(*var_ptr);
36079 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
36080 	}
36081 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36082 
36083 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
36084 		FREE_OP(free_op_data1);
36085 		FREE_OP_VAR_PTR(free_op_data2);
36086 
36087 		CHECK_EXCEPTION();
36088 		ZEND_VM_INC_OPCODE();
36089 	} else {
36090 
36091 		CHECK_EXCEPTION();
36092 	}
36093 	ZEND_VM_NEXT_OPCODE();
36094 }
36095 
ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36096 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36097 {
36098 	return zend_binary_assign_op_helper_SPEC_CV_VAR(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36099 }
36100 
ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36101 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36102 {
36103 	return zend_binary_assign_op_helper_SPEC_CV_VAR(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36104 }
36105 
ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36106 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36107 {
36108 	return zend_binary_assign_op_helper_SPEC_CV_VAR(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36109 }
36110 
ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36111 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36112 {
36113 	return zend_binary_assign_op_helper_SPEC_CV_VAR(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36114 }
36115 
ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36116 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36117 {
36118 	return zend_binary_assign_op_helper_SPEC_CV_VAR(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36119 }
36120 
ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36121 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36122 {
36123 	return zend_binary_assign_op_helper_SPEC_CV_VAR(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36124 }
36125 
ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36126 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36127 {
36128 	return zend_binary_assign_op_helper_SPEC_CV_VAR(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36129 }
36130 
ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36131 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36132 {
36133 	return zend_binary_assign_op_helper_SPEC_CV_VAR(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36134 }
36135 
ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36136 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36137 {
36138 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36139 }
36140 
ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36141 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36142 {
36143 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36144 }
36145 
ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36146 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36147 {
36148 	return zend_binary_assign_op_helper_SPEC_CV_VAR(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36149 }
36150 
zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)36151 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
36152 {
36153 	USE_OPLINE
36154 	zend_free_op free_op2;
36155 	zval **object_ptr;
36156 	zval *object;
36157 	zval *property;
36158 	zval **retval;
36159 	int have_get_ptr = 0;
36160 
36161 	SAVE_OPLINE();
36162 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36163 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36164 	retval = &EX_T(opline->result.var).var.ptr;
36165 
36166 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
36167 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
36168 	}
36169 
36170 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
36171 	object = *object_ptr;
36172 
36173 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
36174 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
36175 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36176 		if (RETURN_VALUE_USED(opline)) {
36177 			PZVAL_LOCK(&EG(uninitialized_zval));
36178 			*retval = &EG(uninitialized_zval);
36179 		}
36180 
36181 		CHECK_EXCEPTION();
36182 		ZEND_VM_NEXT_OPCODE();
36183 	}
36184 
36185 	/* here we are sure we are dealing with an object */
36186 
36187 	if (0) {
36188 		MAKE_REAL_ZVAL_PTR(property);
36189 	}
36190 
36191 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
36192 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36193 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
36194 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
36195 
36196 			have_get_ptr = 1;
36197 			incdec_op(*zptr);
36198 			if (RETURN_VALUE_USED(opline)) {
36199 				*retval = *zptr;
36200 				PZVAL_LOCK(*retval);
36201 			}
36202 		}
36203 	}
36204 
36205 	if (!have_get_ptr) {
36206 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
36207 			zval *z;
36208 
36209 			Z_ADDREF_P(object);
36210 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36211 
36212 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
36213 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
36214 
36215 				if (Z_REFCOUNT_P(z) == 0) {
36216 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
36217 					zval_dtor(z);
36218 					FREE_ZVAL(z);
36219 				}
36220 				z = value;
36221 			}
36222 			Z_ADDREF_P(z);
36223 			SEPARATE_ZVAL_IF_NOT_REF(&z);
36224 			incdec_op(z);
36225 			*retval = z;
36226 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36227 			zval_ptr_dtor(&object);
36228 			SELECTIVE_PZVAL_LOCK(*retval, opline);
36229 			zval_ptr_dtor(&z);
36230 		} else {
36231 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
36232 			if (RETURN_VALUE_USED(opline)) {
36233 				PZVAL_LOCK(&EG(uninitialized_zval));
36234 				*retval = &EG(uninitialized_zval);
36235 			}
36236 		}
36237 	}
36238 
36239 	if (0) {
36240 		zval_ptr_dtor(&property);
36241 	} else {
36242 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36243 	}
36244 
36245 	CHECK_EXCEPTION();
36246 	ZEND_VM_NEXT_OPCODE();
36247 }
36248 
ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36249 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36250 {
36251 	return zend_pre_incdec_property_helper_SPEC_CV_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36252 }
36253 
ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36254 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36255 {
36256 	return zend_pre_incdec_property_helper_SPEC_CV_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36257 }
36258 
zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)36259 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
36260 {
36261 	USE_OPLINE
36262 	zend_free_op free_op2;
36263 	zval **object_ptr;
36264 	zval *object;
36265 	zval *property;
36266 	zval *retval;
36267 	int have_get_ptr = 0;
36268 
36269 	SAVE_OPLINE();
36270 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36271 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36272 	retval = &EX_T(opline->result.var).tmp_var;
36273 
36274 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
36275 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
36276 	}
36277 
36278 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
36279 	object = *object_ptr;
36280 
36281 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
36282 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
36283 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36284 		ZVAL_NULL(retval);
36285 
36286 		CHECK_EXCEPTION();
36287 		ZEND_VM_NEXT_OPCODE();
36288 	}
36289 
36290 	/* here we are sure we are dealing with an object */
36291 
36292 	if (0) {
36293 		MAKE_REAL_ZVAL_PTR(property);
36294 	}
36295 
36296 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
36297 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36298 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
36299 			have_get_ptr = 1;
36300 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
36301 
36302 			ZVAL_COPY_VALUE(retval, *zptr);
36303 			zendi_zval_copy_ctor(*retval);
36304 
36305 			incdec_op(*zptr);
36306 
36307 		}
36308 	}
36309 
36310 	if (!have_get_ptr) {
36311 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
36312 			zval *z, *z_copy;
36313 
36314 			Z_ADDREF_P(object);
36315 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36316 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
36317 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
36318 
36319 				if (Z_REFCOUNT_P(z) == 0) {
36320 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
36321 					zval_dtor(z);
36322 					FREE_ZVAL(z);
36323 				}
36324 				z = value;
36325 			}
36326 			ZVAL_COPY_VALUE(retval, z);
36327 			zendi_zval_copy_ctor(*retval);
36328 			ALLOC_ZVAL(z_copy);
36329 			INIT_PZVAL_COPY(z_copy, z);
36330 			zendi_zval_copy_ctor(*z_copy);
36331 			incdec_op(z_copy);
36332 			Z_ADDREF_P(z);
36333 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36334 			zval_ptr_dtor(&object);
36335 			zval_ptr_dtor(&z_copy);
36336 			zval_ptr_dtor(&z);
36337 		} else {
36338 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
36339 			ZVAL_NULL(retval);
36340 		}
36341 	}
36342 
36343 	if (0) {
36344 		zval_ptr_dtor(&property);
36345 	} else {
36346 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36347 	}
36348 
36349 	CHECK_EXCEPTION();
36350 	ZEND_VM_NEXT_OPCODE();
36351 }
36352 
ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36353 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36354 {
36355 	return zend_post_incdec_property_helper_SPEC_CV_VAR(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36356 }
36357 
ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36358 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36359 {
36360 	return zend_post_incdec_property_helper_SPEC_CV_VAR(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36361 }
36362 
zend_fetch_var_address_helper_SPEC_CV_VAR(int type,ZEND_OPCODE_HANDLER_ARGS)36363 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type, ZEND_OPCODE_HANDLER_ARGS)
36364 {
36365 	USE_OPLINE
36366 	zend_free_op free_op1;
36367 	zval *varname;
36368 	zval **retval;
36369 	zval tmp_varname;
36370 	HashTable *target_symbol_table;
36371 	ulong hash_value;
36372 
36373 	SAVE_OPLINE();
36374 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
36375 
36376  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
36377 		ZVAL_COPY_VALUE(&tmp_varname, varname);
36378 		zval_copy_ctor(&tmp_varname);
36379 		Z_SET_REFCOUNT(tmp_varname, 1);
36380 		Z_UNSET_ISREF(tmp_varname);
36381 		convert_to_string(&tmp_varname);
36382 		varname = &tmp_varname;
36383 	}
36384 
36385 	if (IS_VAR != IS_UNUSED) {
36386 		zend_class_entry *ce;
36387 
36388 		if (IS_VAR == IS_CONST) {
36389 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
36390 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
36391 			} else {
36392 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
36393 				if (UNEXPECTED(ce == NULL)) {
36394 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
36395 						zval_dtor(&tmp_varname);
36396 					}
36397 
36398 					CHECK_EXCEPTION();
36399 					ZEND_VM_NEXT_OPCODE();
36400 				}
36401 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
36402 			}
36403 		} else {
36404 			ce = EX_T(opline->op2.var).class_entry;
36405 		}
36406 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
36407 
36408 	} else {
36409 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
36410 /*
36411 		if (!target_symbol_table) {
36412 			CHECK_EXCEPTION();
36413 			ZEND_VM_NEXT_OPCODE();
36414 		}
36415 */
36416 		if (IS_CV == IS_CONST) {
36417 			hash_value = Z_HASH_P(varname);
36418 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
36419 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
36420 		} else {
36421 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
36422 		}
36423 
36424 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
36425 			switch (type) {
36426 				case BP_VAR_R:
36427 				case BP_VAR_UNSET:
36428 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
36429 					/* break missing intentionally */
36430 				case BP_VAR_IS:
36431 					retval = &EG(uninitialized_zval_ptr);
36432 					break;
36433 				case BP_VAR_RW:
36434 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
36435 					/* break missing intentionally */
36436 				case BP_VAR_W:
36437 					Z_ADDREF_P(&EG(uninitialized_zval));
36438 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
36439 					break;
36440 				EMPTY_SWITCH_DEFAULT_CASE()
36441 			}
36442 		}
36443 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
36444 			case ZEND_FETCH_GLOBAL:
36445 				if (IS_CV != IS_TMP_VAR) {
36446 
36447 				}
36448 				break;
36449 			case ZEND_FETCH_LOCAL:
36450 
36451 				break;
36452 			case ZEND_FETCH_STATIC:
36453 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
36454 				break;
36455 			case ZEND_FETCH_GLOBAL_LOCK:
36456 				if (IS_CV == IS_VAR && !free_op1.var) {
36457 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
36458 				}
36459 				break;
36460 		}
36461 	}
36462 
36463 
36464 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
36465 		zval_dtor(&tmp_varname);
36466 	}
36467 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
36468 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
36469 	}
36470 	PZVAL_LOCK(*retval);
36471 	switch (type) {
36472 		case BP_VAR_R:
36473 		case BP_VAR_IS:
36474 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
36475 			break;
36476 		case BP_VAR_UNSET: {
36477 			zend_free_op free_res;
36478 
36479 			PZVAL_UNLOCK(*retval, &free_res);
36480 			if (retval != &EG(uninitialized_zval_ptr)) {
36481 				SEPARATE_ZVAL_IF_NOT_REF(retval);
36482 			}
36483 			PZVAL_LOCK(*retval);
36484 			FREE_OP_VAR_PTR(free_res);
36485 		}
36486 		/* break missing intentionally */
36487 		default:
36488 			EX_T(opline->result.var).var.ptr_ptr = retval;
36489 			break;
36490 	}
36491 	CHECK_EXCEPTION();
36492 	ZEND_VM_NEXT_OPCODE();
36493 }
36494 
ZEND_FETCH_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36495 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36496 {
36497 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36498 }
36499 
ZEND_FETCH_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36500 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36501 {
36502 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36503 }
36504 
ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36505 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36506 {
36507 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36508 }
36509 
ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36510 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36511 {
36512 	USE_OPLINE
36513 
36514 	return zend_fetch_var_address_helper_SPEC_CV_VAR(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36515 }
36516 
ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36517 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36518 {
36519 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36520 }
36521 
ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36522 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36523 {
36524 	return zend_fetch_var_address_helper_SPEC_CV_VAR(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36525 }
36526 
ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36527 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36528 {
36529 	USE_OPLINE
36530 	zend_free_op free_op2;
36531 	zval *container;
36532 
36533 	SAVE_OPLINE();
36534 
36535 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
36536 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
36537 	}
36538 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
36539 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
36540 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36541 
36542 	CHECK_EXCEPTION();
36543 	ZEND_VM_NEXT_OPCODE();
36544 }
36545 
ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36546 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36547 {
36548 	USE_OPLINE
36549 	zend_free_op free_op1, free_op2;
36550 	zval **container;
36551 
36552 	SAVE_OPLINE();
36553 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36554 
36555 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36556 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36557 	}
36558 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
36559 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36560 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36561 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36562 	}
36563 
36564 	/* We are going to assign the result by reference */
36565 	if (UNEXPECTED(opline->extended_value != 0)) {
36566 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
36567 
36568 		if (retval_ptr) {
36569 			Z_DELREF_PP(retval_ptr);
36570 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
36571 			Z_ADDREF_PP(retval_ptr);
36572 		}
36573 	}
36574 
36575 	CHECK_EXCEPTION();
36576 	ZEND_VM_NEXT_OPCODE();
36577 }
36578 
ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36579 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36580 {
36581 	USE_OPLINE
36582 	zend_free_op free_op1, free_op2;
36583 	zval **container;
36584 
36585 	SAVE_OPLINE();
36586 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36587 
36588 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36589 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36590 	}
36591 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_RW TSRMLS_CC);
36592 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36593 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36594 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36595 	}
36596 
36597 	CHECK_EXCEPTION();
36598 	ZEND_VM_NEXT_OPCODE();
36599 }
36600 
ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36601 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36602 {
36603 	USE_OPLINE
36604 	zend_free_op free_op2;
36605 	zval *container;
36606 
36607 	SAVE_OPLINE();
36608 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
36609 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_IS TSRMLS_CC);
36610 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36611 
36612 	CHECK_EXCEPTION();
36613 	ZEND_VM_NEXT_OPCODE();
36614 }
36615 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36616 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36617 {
36618 	USE_OPLINE
36619 	zend_free_op free_op1, free_op2;
36620 
36621 	SAVE_OPLINE();
36622 
36623 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
36624 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36625 
36626 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36627 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36628 		}
36629 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_W TSRMLS_CC);
36630 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36631 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36632 		}
36633 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36634 
36635 	} else {
36636 		zval *container;
36637 
36638 		if (IS_VAR == IS_UNUSED) {
36639 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
36640 		}
36641 		container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
36642 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_R TSRMLS_CC);
36643 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36644 
36645 	}
36646 	CHECK_EXCEPTION();
36647 	ZEND_VM_NEXT_OPCODE();
36648 }
36649 
ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36650 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36651 {
36652 	USE_OPLINE
36653 	zend_free_op free_op1, free_op2;
36654 	zval **container;
36655 
36656 	SAVE_OPLINE();
36657 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
36658 
36659 	if (IS_CV == IS_CV) {
36660 		if (container != &EG(uninitialized_zval_ptr)) {
36661 			SEPARATE_ZVAL_IF_NOT_REF(container);
36662 		}
36663 	}
36664 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36665 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36666 	}
36667 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC), IS_VAR, BP_VAR_UNSET TSRMLS_CC);
36668 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36669 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36670 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36671 	}
36672 
36673 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
36674 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
36675 		ZEND_VM_NEXT_OPCODE();
36676 	} else {
36677 		zend_free_op free_res;
36678 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
36679 
36680 		PZVAL_UNLOCK(*retval_ptr, &free_res);
36681 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
36682 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
36683 		}
36684 		PZVAL_LOCK(*retval_ptr);
36685 		FREE_OP_VAR_PTR(free_res);
36686 		CHECK_EXCEPTION();
36687 		ZEND_VM_NEXT_OPCODE();
36688 	}
36689 }
36690 
zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS)36691 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS)
36692 {
36693 	USE_OPLINE
36694 
36695 	zval *container;
36696 	zend_free_op free_op2;
36697 	zval *offset;
36698 
36699 	SAVE_OPLINE();
36700 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
36701 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36702 
36703 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
36704 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
36705 		zend_error(E_NOTICE, "Trying to get property of non-object");
36706 		PZVAL_LOCK(&EG(uninitialized_zval));
36707 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
36708 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36709 	} else {
36710 		zval *retval;
36711 
36712 		if (0) {
36713 			MAKE_REAL_ZVAL_PTR(offset);
36714 		}
36715 
36716 		/* here we are sure we are dealing with an object */
36717 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36718 
36719 		PZVAL_LOCK(retval);
36720 		AI_SET_PTR(&EX_T(opline->result.var), retval);
36721 
36722 		if (0) {
36723 			zval_ptr_dtor(&offset);
36724 		} else {
36725 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36726 		}
36727 	}
36728 
36729 	CHECK_EXCEPTION();
36730 	ZEND_VM_NEXT_OPCODE();
36731 }
36732 
ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36733 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36734 {
36735 	return zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36736 }
36737 
ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36738 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36739 {
36740 	USE_OPLINE
36741 	zend_free_op free_op1, free_op2;
36742 	zval *property;
36743 	zval **container;
36744 
36745 	SAVE_OPLINE();
36746 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36747 
36748 	if (0) {
36749 		MAKE_REAL_ZVAL_PTR(property);
36750 	}
36751 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36752 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36753 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
36754 	}
36755 
36756 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
36757 	if (0) {
36758 		zval_ptr_dtor(&property);
36759 	} else {
36760 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36761 	}
36762 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36763 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36764 	}
36765 
36766 	/* We are going to assign the result by reference */
36767 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
36768 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
36769 
36770 		Z_DELREF_PP(retval_ptr);
36771 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
36772 		Z_ADDREF_PP(retval_ptr);
36773 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
36774 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
36775 	}
36776 
36777 	CHECK_EXCEPTION();
36778 	ZEND_VM_NEXT_OPCODE();
36779 }
36780 
ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36781 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36782 {
36783 	USE_OPLINE
36784 	zend_free_op free_op1, free_op2;
36785 	zval *property;
36786 	zval **container;
36787 
36788 	SAVE_OPLINE();
36789 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36790 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
36791 
36792 	if (0) {
36793 		MAKE_REAL_ZVAL_PTR(property);
36794 	}
36795 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36796 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
36797 	}
36798 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
36799 	if (0) {
36800 		zval_ptr_dtor(&property);
36801 	} else {
36802 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36803 	}
36804 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36805 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36806 	}
36807 
36808 	CHECK_EXCEPTION();
36809 	ZEND_VM_NEXT_OPCODE();
36810 }
36811 
ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36812 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36813 {
36814 	USE_OPLINE
36815 
36816 	zval *container;
36817 	zend_free_op free_op2;
36818 	zval *offset;
36819 
36820 	SAVE_OPLINE();
36821 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
36822 	offset  = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36823 
36824 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
36825 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
36826 		PZVAL_LOCK(&EG(uninitialized_zval));
36827 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
36828 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36829 	} else {
36830 		zval *retval;
36831 
36832 		if (0) {
36833 			MAKE_REAL_ZVAL_PTR(offset);
36834 		}
36835 
36836 		/* here we are sure we are dealing with an object */
36837 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36838 
36839 		PZVAL_LOCK(retval);
36840 		AI_SET_PTR(&EX_T(opline->result.var), retval);
36841 
36842 		if (0) {
36843 			zval_ptr_dtor(&offset);
36844 		} else {
36845 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36846 		}
36847 	}
36848 
36849 	CHECK_EXCEPTION();
36850 	ZEND_VM_NEXT_OPCODE();
36851 }
36852 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36853 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36854 {
36855 	USE_OPLINE
36856 
36857 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
36858 		/* Behave like FETCH_OBJ_W */
36859 		zend_free_op free_op1, free_op2;
36860 		zval *property;
36861 		zval **container;
36862 
36863 		SAVE_OPLINE();
36864 		property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36865 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36866 
36867 		if (0) {
36868 			MAKE_REAL_ZVAL_PTR(property);
36869 		}
36870 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36871 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
36872 		}
36873 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
36874 		if (0) {
36875 			zval_ptr_dtor(&property);
36876 		} else {
36877 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36878 		}
36879 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36880 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36881 		}
36882 
36883 		CHECK_EXCEPTION();
36884 		ZEND_VM_NEXT_OPCODE();
36885 	} else {
36886 		return zend_fetch_property_address_read_helper_SPEC_CV_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
36887 	}
36888 }
36889 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36890 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36891 {
36892 	USE_OPLINE
36893 	zend_free_op free_op1, free_op2, free_res;
36894 	zval **container;
36895 	zval *property;
36896 
36897 	SAVE_OPLINE();
36898 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
36899 	property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36900 
36901 	if (IS_CV == IS_CV) {
36902 		if (container != &EG(uninitialized_zval_ptr)) {
36903 			SEPARATE_ZVAL_IF_NOT_REF(container);
36904 		}
36905 	}
36906 	if (0) {
36907 		MAKE_REAL_ZVAL_PTR(property);
36908 	}
36909 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
36910 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
36911 	}
36912 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
36913 	if (0) {
36914 		zval_ptr_dtor(&property);
36915 	} else {
36916 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36917 	}
36918 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
36919 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
36920 	}
36921 
36922 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
36923 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
36924 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
36925 	}
36926 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
36927 	FREE_OP_VAR_PTR(free_res);
36928 	CHECK_EXCEPTION();
36929 	ZEND_VM_NEXT_OPCODE();
36930 }
36931 
ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36932 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36933 {
36934 	USE_OPLINE
36935 	zend_free_op free_op2;
36936 	zval **object_ptr;
36937 	zval *property_name;
36938 
36939 	SAVE_OPLINE();
36940 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36941 	property_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36942 
36943 	if (0) {
36944 		MAKE_REAL_ZVAL_PTR(property_name);
36945 	}
36946 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
36947 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36948 	}
36949 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36950 	if (0) {
36951 		zval_ptr_dtor(&property_name);
36952 	} else {
36953 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36954 	}
36955 
36956 	/* assign_obj has two opcodes! */
36957 	CHECK_EXCEPTION();
36958 	ZEND_VM_INC_OPCODE();
36959 	ZEND_VM_NEXT_OPCODE();
36960 }
36961 
ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)36962 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
36963 {
36964 	USE_OPLINE
36965 
36966 	zval **object_ptr;
36967 
36968 	SAVE_OPLINE();
36969 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
36970 
36971 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
36972 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
36973 	}
36974 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
36975 		zend_free_op free_op2;
36976 		zval *property_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36977 
36978 		if (0) {
36979 			MAKE_REAL_ZVAL_PTR(property_name);
36980 		}
36981 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
36982 		if (0) {
36983 			zval_ptr_dtor(&property_name);
36984 		} else {
36985 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36986 		}
36987 	} else {
36988 		zend_free_op free_op2, free_op_data1, free_op_data2;
36989 		zval *value;
36990 		zval *dim = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
36991 		zval **variable_ptr_ptr;
36992 
36993 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_VAR, BP_VAR_W TSRMLS_CC);
36994 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
36995 
36996 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
36997 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
36998 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
36999 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
37000 				if (RETURN_VALUE_USED(opline)) {
37001 					zval *retval;
37002 
37003 					ALLOC_ZVAL(retval);
37004 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
37005 					INIT_PZVAL(retval);
37006 					AI_SET_PTR(&EX_T(opline->result.var), retval);
37007 				}
37008 			} else if (RETURN_VALUE_USED(opline)) {
37009 				PZVAL_LOCK(&EG(uninitialized_zval));
37010 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
37011 			}
37012 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
37013 			if (IS_TMP_FREE(free_op_data1)) {
37014 				zval_dtor(value);
37015 			}
37016 			if (RETURN_VALUE_USED(opline)) {
37017 				PZVAL_LOCK(&EG(uninitialized_zval));
37018 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
37019 			}
37020 		} else {
37021 			if ((opline+1)->op1_type == IS_TMP_VAR) {
37022 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37023 			} else if ((opline+1)->op1_type == IS_CONST) {
37024 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37025 			} else {
37026 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37027 			}
37028 			if (RETURN_VALUE_USED(opline)) {
37029 				PZVAL_LOCK(value);
37030 				AI_SET_PTR(&EX_T(opline->result.var), value);
37031 			}
37032 		}
37033 		FREE_OP_VAR_PTR(free_op_data2);
37034 	 	FREE_OP_IF_VAR(free_op_data1);
37035 	}
37036 
37037 	/* assign_dim has two opcodes! */
37038 	CHECK_EXCEPTION();
37039 	ZEND_VM_INC_OPCODE();
37040 	ZEND_VM_NEXT_OPCODE();
37041 }
37042 
ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37043 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37044 {
37045 	USE_OPLINE
37046 	zend_free_op free_op2;
37047 	zval *value;
37048 	zval **variable_ptr_ptr;
37049 
37050 	SAVE_OPLINE();
37051 	value = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37052 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
37053 
37054 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
37055 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_VAR TSRMLS_CC)) {
37056 			if (RETURN_VALUE_USED(opline)) {
37057 				zval *retval;
37058 
37059 				ALLOC_ZVAL(retval);
37060 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
37061 				INIT_PZVAL(retval);
37062 				AI_SET_PTR(&EX_T(opline->result.var), retval);
37063 			}
37064 		} else if (RETURN_VALUE_USED(opline)) {
37065 			PZVAL_LOCK(&EG(uninitialized_zval));
37066 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
37067 		}
37068 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
37069 		if (0) {
37070 			zval_dtor(value);
37071 		}
37072 		if (RETURN_VALUE_USED(opline)) {
37073 			PZVAL_LOCK(&EG(uninitialized_zval));
37074 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
37075 		}
37076 	} else {
37077 		if (IS_VAR == IS_TMP_VAR) {
37078 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37079 		} else if (IS_VAR == IS_CONST) {
37080 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37081 		} else {
37082 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
37083 		}
37084 		if (RETURN_VALUE_USED(opline)) {
37085 			PZVAL_LOCK(value);
37086 			AI_SET_PTR(&EX_T(opline->result.var), value);
37087 		}
37088 	}
37089 
37090 	if (IS_CV == IS_VAR && 0) {
37091 		zval_ptr_dtor(&value);
37092 	}
37093 
37094 	/* zend_assign_to_variable() always takes care of op2, never free it! */
37095  	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37096 
37097 	CHECK_EXCEPTION();
37098 	ZEND_VM_NEXT_OPCODE();
37099 }
37100 
ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37101 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37102 {
37103 	USE_OPLINE
37104 	zend_free_op free_op2;
37105 	zval **variable_ptr_ptr;
37106 	zval **value_ptr_ptr;
37107 
37108 	SAVE_OPLINE();
37109 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37110 
37111 	if (IS_VAR == IS_VAR &&
37112 	    value_ptr_ptr &&
37113 	    !Z_ISREF_PP(value_ptr_ptr) &&
37114 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
37115 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
37116 		if (free_op2.var == NULL) {
37117 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
37118 		}
37119 		zend_error(E_STRICT, "Only variables should be assigned by reference");
37120 		if (UNEXPECTED(EG(exception) != NULL)) {
37121 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37122 			HANDLE_EXCEPTION();
37123 		}
37124 		return ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
37125 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
37126 		PZVAL_LOCK(*value_ptr_ptr);
37127 	}
37128 	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
37129 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
37130 	}
37131 
37132 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
37133 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
37134 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
37135 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
37136 	}
37137 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
37138 
37139 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
37140 		Z_DELREF_PP(variable_ptr_ptr);
37141 	}
37142 
37143 	if (RETURN_VALUE_USED(opline)) {
37144 		PZVAL_LOCK(*variable_ptr_ptr);
37145 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
37146 	}
37147 
37148 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37149 
37150 	CHECK_EXCEPTION();
37151 	ZEND_VM_NEXT_OPCODE();
37152 }
37153 
ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37154 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37155 {
37156 	USE_OPLINE
37157 	zval *function_name;
37158 	char *function_name_strval;
37159 	int function_name_strlen;
37160 	zend_free_op free_op2;
37161 	call_slot *call = EX(call_slots) + opline->result.num;
37162 
37163 	SAVE_OPLINE();
37164 
37165 	function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37166 
37167 	if (IS_VAR != IS_CONST &&
37168 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
37169 		if (UNEXPECTED(EG(exception) != NULL)) {
37170 			HANDLE_EXCEPTION();
37171 		}
37172 		zend_error_noreturn(E_ERROR, "Method name must be a string");
37173 	}
37174 
37175 	function_name_strval = Z_STRVAL_P(function_name);
37176 	function_name_strlen = Z_STRLEN_P(function_name);
37177 
37178 	call->object = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
37179 
37180 	if (EXPECTED(call->object != NULL) &&
37181 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
37182 		call->called_scope = Z_OBJCE_P(call->object);
37183 
37184 		if (IS_VAR != IS_CONST ||
37185 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
37186 		    zval *object = call->object;
37187 
37188 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
37189 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
37190 			}
37191 
37192 			/* First, locate the function. */
37193 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_VAR == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
37194 			if (UNEXPECTED(call->fbc == NULL)) {
37195 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
37196 			}
37197 			if (IS_VAR == IS_CONST &&
37198 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
37199 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
37200 			    EXPECTED(call->object == object)) {
37201 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
37202 			}
37203 		}
37204 	} else {
37205 		if (UNEXPECTED(EG(exception) != NULL)) {
37206 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37207 			HANDLE_EXCEPTION();
37208 		}
37209 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
37210 	}
37211 
37212 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
37213 		call->object = NULL;
37214 	} else {
37215 		if (!PZVAL_IS_REF(call->object)) {
37216 			Z_ADDREF_P(call->object); /* For $this pointer */
37217 		} else {
37218 			zval *this_ptr;
37219 			ALLOC_ZVAL(this_ptr);
37220 			INIT_PZVAL_COPY(this_ptr, call->object);
37221 			zval_copy_ctor(this_ptr);
37222 			call->object = this_ptr;
37223 		}
37224 	}
37225 	call->is_ctor_call = 0;
37226 	EX(call) = call;
37227 
37228 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37229 
37230 	CHECK_EXCEPTION();
37231 	ZEND_VM_NEXT_OPCODE();
37232 }
37233 
ZEND_CASE_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37234 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37235 {
37236 	USE_OPLINE
37237 	zend_free_op free_op2;
37238 
37239 	SAVE_OPLINE();
37240 	if (IS_CV==IS_VAR) {
37241 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
37242 	}
37243 	is_equal_function(&EX_T(opline->result.var).tmp_var,
37244 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
37245 				 _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC) TSRMLS_CC);
37246 
37247 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37248 	CHECK_EXCEPTION();
37249 	ZEND_VM_NEXT_OPCODE();
37250 }
37251 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37252 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37253 {
37254 	USE_OPLINE
37255 
37256 	zval *expr_ptr;
37257 
37258 	SAVE_OPLINE();
37259 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
37260 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
37261 
37262 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
37263 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
37264 		}
37265 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
37266 		expr_ptr = *expr_ptr_ptr;
37267 		Z_ADDREF_P(expr_ptr);
37268 	} else {
37269 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
37270 		if (0) { /* temporary variable */
37271 			zval *new_expr;
37272 
37273 			ALLOC_ZVAL(new_expr);
37274 			INIT_PZVAL_COPY(new_expr, expr_ptr);
37275 			expr_ptr = new_expr;
37276 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
37277 			zval *new_expr;
37278 
37279 			ALLOC_ZVAL(new_expr);
37280 			INIT_PZVAL_COPY(new_expr, expr_ptr);
37281 			expr_ptr = new_expr;
37282 			zendi_zval_copy_ctor(*expr_ptr);
37283 		} else {
37284 			Z_ADDREF_P(expr_ptr);
37285 		}
37286 	}
37287 
37288 	if (IS_VAR != IS_UNUSED) {
37289 		zend_free_op free_op2;
37290 		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37291 		ulong hval;
37292 
37293 		switch (Z_TYPE_P(offset)) {
37294 			case IS_DOUBLE:
37295 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
37296 				goto num_index;
37297 			case IS_LONG:
37298 			case IS_BOOL:
37299 				hval = Z_LVAL_P(offset);
37300 num_index:
37301 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
37302 				break;
37303 			case IS_STRING:
37304 				if (IS_VAR == IS_CONST) {
37305 					hval = Z_HASH_P(offset);
37306 				} else {
37307 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
37308 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
37309 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
37310 					} else {
37311 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
37312 					}
37313 				}
37314 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
37315 				break;
37316 			case IS_NULL:
37317 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
37318 				break;
37319 			default:
37320 				zend_error(E_WARNING, "Illegal offset type");
37321 				zval_ptr_dtor(&expr_ptr);
37322 				/* do nothing */
37323 				break;
37324 		}
37325 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37326 	} else {
37327 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
37328 	}
37329 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
37330 
37331 	} else {
37332 
37333 	}
37334 	CHECK_EXCEPTION();
37335 	ZEND_VM_NEXT_OPCODE();
37336 }
37337 
ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37338 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37339 {
37340 	USE_OPLINE
37341 
37342 	array_init(&EX_T(opline->result.var).tmp_var);
37343 	if (IS_CV == IS_UNUSED) {
37344 		ZEND_VM_NEXT_OPCODE();
37345 #if 0 || IS_CV != IS_UNUSED
37346 	} else {
37347 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
37348 #endif
37349 	}
37350 }
37351 
ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37352 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37353 {
37354 	USE_OPLINE
37355 	zval tmp, *varname;
37356 	HashTable *target_symbol_table;
37357 
37358 
37359 	SAVE_OPLINE();
37360 	if (IS_CV == IS_CV &&
37361 	    IS_VAR == IS_UNUSED &&
37362 	    (opline->extended_value & ZEND_QUICK_SET)) {
37363 		if (EG(active_symbol_table)) {
37364 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
37365 
37366 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
37367 			EX_CV(opline->op1.var) = NULL;
37368 		} else if (EX_CV(opline->op1.var)) {
37369 			zval_ptr_dtor(EX_CV(opline->op1.var));
37370 			EX_CV(opline->op1.var) = NULL;
37371 		}
37372 		CHECK_EXCEPTION();
37373 		ZEND_VM_NEXT_OPCODE();
37374 	}
37375 
37376 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
37377 
37378 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
37379 		ZVAL_COPY_VALUE(&tmp, varname);
37380 		zval_copy_ctor(&tmp);
37381 		convert_to_string(&tmp);
37382 		varname = &tmp;
37383 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
37384 		Z_ADDREF_P(varname);
37385 	}
37386 
37387 	if (IS_VAR != IS_UNUSED) {
37388 		zend_class_entry *ce;
37389 
37390 		if (IS_VAR == IS_CONST) {
37391 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
37392 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
37393 			} else {
37394 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
37395 				if (UNEXPECTED(EG(exception) != NULL)) {
37396 					if (IS_CV != IS_CONST && varname == &tmp) {
37397 						zval_dtor(&tmp);
37398 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
37399 						zval_ptr_dtor(&varname);
37400 					}
37401 
37402 					HANDLE_EXCEPTION();
37403 				}
37404 				if (UNEXPECTED(ce == NULL)) {
37405 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
37406 				}
37407 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
37408 			}
37409 		} else {
37410 			ce = EX_T(opline->op2.var).class_entry;
37411 		}
37412 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
37413 	} else {
37414 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
37415 
37416 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
37417 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
37418 	}
37419 
37420 	if (IS_CV != IS_CONST && varname == &tmp) {
37421 		zval_dtor(&tmp);
37422 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
37423 		zval_ptr_dtor(&varname);
37424 	}
37425 
37426 	CHECK_EXCEPTION();
37427 	ZEND_VM_NEXT_OPCODE();
37428 }
37429 
ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37430 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37431 {
37432 	USE_OPLINE
37433 	zend_free_op free_op2;
37434 	zval **container;
37435 	zval *offset;
37436 	ulong hval;
37437 
37438 	SAVE_OPLINE();
37439 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
37440 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
37441 		SEPARATE_ZVAL_IF_NOT_REF(container);
37442 	}
37443 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37444 
37445 	if (IS_CV != IS_VAR || container) {
37446 		switch (Z_TYPE_PP(container)) {
37447 			case IS_ARRAY: {
37448 				HashTable *ht = Z_ARRVAL_PP(container);
37449 
37450 				switch (Z_TYPE_P(offset)) {
37451 					case IS_DOUBLE:
37452 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
37453 						zend_hash_index_del(ht, hval);
37454 						break;
37455 					case IS_RESOURCE:
37456 					case IS_BOOL:
37457 					case IS_LONG:
37458 						hval = Z_LVAL_P(offset);
37459 						zend_hash_index_del(ht, hval);
37460 						break;
37461 					case IS_STRING:
37462 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
37463 							Z_ADDREF_P(offset);
37464 						}
37465 						if (IS_VAR == IS_CONST) {
37466 							hval = Z_HASH_P(offset);
37467 						} else {
37468 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
37469 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
37470 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
37471 							} else {
37472 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
37473 							}
37474 						}
37475 						if (ht == &EG(symbol_table)) {
37476 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
37477 						} else {
37478 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
37479 						}
37480 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
37481 							zval_ptr_dtor(&offset);
37482 						}
37483 						break;
37484 num_index_dim:
37485 						zend_hash_index_del(ht, hval);
37486 						if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
37487 							zval_ptr_dtor(&offset);
37488 						}
37489 						break;
37490 					case IS_NULL:
37491 						zend_hash_del(ht, "", sizeof(""));
37492 						break;
37493 					default:
37494 						zend_error(E_WARNING, "Illegal offset type in unset");
37495 						break;
37496 				}
37497 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37498 				break;
37499 			}
37500 			case IS_OBJECT:
37501 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
37502 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
37503 				}
37504 				if (0) {
37505 					MAKE_REAL_ZVAL_PTR(offset);
37506 				}
37507 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
37508 				if (0) {
37509 					zval_ptr_dtor(&offset);
37510 				} else {
37511 					if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37512 				}
37513 				break;
37514 			case IS_STRING:
37515 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
37516 				ZEND_VM_CONTINUE(); /* bailed out before */
37517 			default:
37518 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37519 				break;
37520 		}
37521 	} else {
37522 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37523 	}
37524 
37525 	CHECK_EXCEPTION();
37526 	ZEND_VM_NEXT_OPCODE();
37527 }
37528 
ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37529 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37530 {
37531 	USE_OPLINE
37532 	zend_free_op free_op2;
37533 	zval **container;
37534 	zval *offset;
37535 
37536 	SAVE_OPLINE();
37537 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
37538 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37539 
37540 	if (IS_CV != IS_VAR || container) {
37541 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
37542 			SEPARATE_ZVAL_IF_NOT_REF(container);
37543 		}
37544 		if (Z_TYPE_PP(container) == IS_OBJECT) {
37545 			if (0) {
37546 				MAKE_REAL_ZVAL_PTR(offset);
37547 			}
37548 			if (Z_OBJ_HT_P(*container)->unset_property) {
37549 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
37550 			} else {
37551 				zend_error(E_NOTICE, "Trying to unset property of non-object");
37552 			}
37553 			if (0) {
37554 				zval_ptr_dtor(&offset);
37555 			} else {
37556 				if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37557 			}
37558 		} else {
37559 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37560 		}
37561 	} else {
37562 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37563 	}
37564 
37565 	CHECK_EXCEPTION();
37566 	ZEND_VM_NEXT_OPCODE();
37567 }
37568 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37569 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37570 {
37571 	USE_OPLINE
37572 	zval **value;
37573 	zend_bool isset = 1;
37574 
37575 	SAVE_OPLINE();
37576 	if (IS_CV == IS_CV &&
37577 	    IS_VAR == IS_UNUSED &&
37578 	    (opline->extended_value & ZEND_QUICK_SET)) {
37579 		if (EX_CV(opline->op1.var)) {
37580 			value = EX_CV(opline->op1.var);
37581 		} else if (EG(active_symbol_table)) {
37582 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
37583 
37584 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
37585 				isset = 0;
37586 			}
37587 		} else {
37588 			isset = 0;
37589 		}
37590 	} else {
37591 		HashTable *target_symbol_table;
37592 
37593 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
37594 
37595 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
37596 			ZVAL_COPY_VALUE(&tmp, varname);
37597 			zval_copy_ctor(&tmp);
37598 			convert_to_string(&tmp);
37599 			varname = &tmp;
37600 		}
37601 
37602 		if (IS_VAR != IS_UNUSED) {
37603 			zend_class_entry *ce;
37604 
37605 			if (IS_VAR == IS_CONST) {
37606 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
37607 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
37608 				} else {
37609 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
37610 					if (UNEXPECTED(ce == NULL)) {
37611 						CHECK_EXCEPTION();
37612 						ZEND_VM_NEXT_OPCODE();
37613 					}
37614 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
37615 				}
37616 			} else {
37617 				ce = EX_T(opline->op2.var).class_entry;
37618 			}
37619 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
37620 			if (!value) {
37621 				isset = 0;
37622 			}
37623 		} else {
37624 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
37625 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
37626 				isset = 0;
37627 			}
37628 		}
37629 
37630 		if (IS_CV != IS_CONST && varname == &tmp) {
37631 			zval_dtor(&tmp);
37632 		}
37633 
37634 	}
37635 
37636 	if (opline->extended_value & ZEND_ISSET) {
37637 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
37638 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
37639 		} else {
37640 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
37641 		}
37642 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
37643 		if (!isset || !i_zend_is_true(*value)) {
37644 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
37645 		} else {
37646 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
37647 		}
37648 	}
37649 
37650 	CHECK_EXCEPTION();
37651 	ZEND_VM_NEXT_OPCODE();
37652 }
37653 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)37654 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
37655 {
37656 	USE_OPLINE
37657 	zend_free_op free_op2;
37658 	zval *container;
37659 	zval **value = NULL;
37660 	int result = 0;
37661 	ulong hval;
37662 	zval *offset;
37663 
37664 	SAVE_OPLINE();
37665 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
37666 
37667 	offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37668 
37669 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
37670 		HashTable *ht;
37671 		int isset = 0;
37672 
37673 		ht = Z_ARRVAL_P(container);
37674 
37675 		switch (Z_TYPE_P(offset)) {
37676 			case IS_DOUBLE:
37677 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
37678 				goto num_index_prop;
37679 			case IS_RESOURCE:
37680 			case IS_BOOL:
37681 			case IS_LONG:
37682 				hval = Z_LVAL_P(offset);
37683 num_index_prop:
37684 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
37685 					isset = 1;
37686 				}
37687 				break;
37688 			case IS_STRING:
37689 				if (IS_VAR == IS_CONST) {
37690 					hval = Z_HASH_P(offset);
37691 				} else {
37692 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
37693 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
37694 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
37695 					} else {
37696 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
37697 					}
37698 				}
37699 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
37700 					isset = 1;
37701 				}
37702 				break;
37703 			case IS_NULL:
37704 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
37705 					isset = 1;
37706 				}
37707 				break;
37708 			default:
37709 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
37710 				break;
37711 		}
37712 
37713 		if (opline->extended_value & ZEND_ISSET) {
37714 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
37715 				result = 0;
37716 			} else {
37717 				result = isset;
37718 			}
37719 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
37720 			if (!isset || !i_zend_is_true(*value)) {
37721 				result = 0;
37722 			} else {
37723 				result = 1;
37724 			}
37725 		}
37726 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37727 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
37728 		if (0) {
37729 			MAKE_REAL_ZVAL_PTR(offset);
37730 		}
37731 		if (prop_dim) {
37732 			if (Z_OBJ_HT_P(container)->has_property) {
37733 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
37734 			} else {
37735 				zend_error(E_NOTICE, "Trying to check property of non-object");
37736 				result = 0;
37737 			}
37738 		} else {
37739 			if (Z_OBJ_HT_P(container)->has_dimension) {
37740 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
37741 			} else {
37742 				zend_error(E_NOTICE, "Trying to check element of non-array");
37743 				result = 0;
37744 			}
37745 		}
37746 		if (0) {
37747 			zval_ptr_dtor(&offset);
37748 		} else {
37749 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37750 		}
37751 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
37752 		zval tmp;
37753 
37754 		if (Z_TYPE_P(offset) != IS_LONG) {
37755 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
37756 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
37757 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
37758 				ZVAL_COPY_VALUE(&tmp, offset);
37759 				zval_copy_ctor(&tmp);
37760 				convert_to_long(&tmp);
37761 				offset = &tmp;
37762 			} else {
37763 				/* can not be converted to proper offset, return "not set" */
37764 				result = 0;
37765 			}
37766 		}
37767 		if (Z_TYPE_P(offset) == IS_LONG) {
37768 			if (opline->extended_value & ZEND_ISSET) {
37769 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
37770 					result = 1;
37771 				}
37772 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
37773 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
37774 					result = 1;
37775 				}
37776 			}
37777 		}
37778 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37779 	} else {
37780 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37781 	}
37782 
37783 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
37784 	if (opline->extended_value & ZEND_ISSET) {
37785 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
37786 	} else {
37787 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
37788 	}
37789 
37790 	CHECK_EXCEPTION();
37791 	ZEND_VM_NEXT_OPCODE();
37792 }
37793 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37794 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37795 {
37796 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
37797 }
37798 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37799 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37800 {
37801 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
37802 }
37803 
ZEND_YIELD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)37804 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
37805 {
37806 	USE_OPLINE
37807 
37808 	/* The generator object is stored in return_value_ptr_ptr */
37809 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
37810 
37811 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
37812 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
37813 	}
37814 
37815 	/* Destroy the previously yielded value */
37816 	if (generator->value) {
37817 		zval_ptr_dtor(&generator->value);
37818 	}
37819 
37820 	/* Destroy the previously yielded key */
37821 	if (generator->key) {
37822 		zval_ptr_dtor(&generator->key);
37823 	}
37824 
37825 	/* Set the new yielded value */
37826 	if (IS_CV != IS_UNUSED) {
37827 
37828 
37829 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
37830 			/* Constants and temporary variables aren't yieldable by reference,
37831 			 * but we still allow them with a notice. */
37832 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
37833 				zval *value, *copy;
37834 
37835 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
37836 
37837 				value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
37838 				ALLOC_ZVAL(copy);
37839 				INIT_PZVAL_COPY(copy, value);
37840 
37841 				/* Temporary variables don't need ctor copying */
37842 				if (!0) {
37843 					zval_copy_ctor(copy);
37844 				}
37845 
37846 				generator->value = copy;
37847 			} else {
37848 				zval **value_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
37849 
37850 				if (IS_CV == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
37851 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
37852 				}
37853 
37854 				/* If a function call result is yielded and the function did
37855 				 * not return by reference we throw a notice. */
37856 				if (IS_CV == IS_VAR && !Z_ISREF_PP(value_ptr)
37857 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
37858 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
37859 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
37860 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
37861 
37862 					Z_ADDREF_PP(value_ptr);
37863 					generator->value = *value_ptr;
37864 				} else {
37865 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
37866 					Z_ADDREF_PP(value_ptr);
37867 					generator->value = *value_ptr;
37868 				}
37869 
37870 			}
37871 		} else {
37872 			zval *value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
37873 
37874 			/* Consts, temporary variables and references need copying */
37875 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
37876 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
37877 			) {
37878 				zval *copy;
37879 
37880 				ALLOC_ZVAL(copy);
37881 				INIT_PZVAL_COPY(copy, value);
37882 
37883 				/* Temporary variables don't need ctor copying */
37884 				if (!0) {
37885 					zval_copy_ctor(copy);
37886 				}
37887 
37888 				generator->value = copy;
37889 			} else {
37890 				Z_ADDREF_P(value);
37891 				generator->value = value;
37892 			}
37893 
37894 		}
37895 	} else {
37896 		/* If no value was specified yield null */
37897 		Z_ADDREF(EG(uninitialized_zval));
37898 		generator->value = &EG(uninitialized_zval);
37899 	}
37900 
37901 	/* Set the new yielded key */
37902 	if (IS_VAR != IS_UNUSED) {
37903 		zend_free_op free_op2;
37904 		zval *key = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
37905 
37906 		/* Consts, temporary variables and references need copying */
37907 		if (IS_VAR == IS_CONST || IS_VAR == IS_TMP_VAR
37908 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
37909 		) {
37910 			zval *copy;
37911 
37912 			ALLOC_ZVAL(copy);
37913 			INIT_PZVAL_COPY(copy, key);
37914 
37915 			/* Temporary variables don't need ctor copying */
37916 			if (!0) {
37917 				zval_copy_ctor(copy);
37918 			}
37919 
37920 			generator->key = copy;
37921 		} else {
37922 			Z_ADDREF_P(key);
37923 			generator->key = key;
37924 		}
37925 
37926 		if (Z_TYPE_P(generator->key) == IS_LONG
37927 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
37928 		) {
37929 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
37930 		}
37931 
37932 		if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
37933 	} else {
37934 		/* If no key was specified we use auto-increment keys */
37935 		generator->largest_used_integer_key++;
37936 
37937 		ALLOC_INIT_ZVAL(generator->key);
37938 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
37939 	}
37940 
37941 	if (RETURN_VALUE_USED(opline)) {
37942 		/* If the return value of yield is used set the send
37943 		 * target and initialize it to NULL */
37944 		generator->send_target = &EX_T(opline->result.var).var.ptr;
37945 		Z_ADDREF(EG(uninitialized_zval));
37946 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
37947 	} else {
37948 		generator->send_target = NULL;
37949 	}
37950 
37951 	/* We increment to the next op, so we are at the correct position when the
37952 	 * generator is resumed. */
37953 	ZEND_VM_INC_OPCODE();
37954 
37955 	/* The GOTO VM uses a local opline variable. We need to set the opline
37956 	 * variable in execute_data so we don't resume at an old position. */
37957 	SAVE_OPLINE();
37958 
37959 	ZEND_VM_RETURN();
37960 }
37961 
zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)37962 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
37963 {
37964 	USE_OPLINE
37965 	zend_free_op free_op_data1;
37966 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
37967 	zval *object;
37968 	zval *property = NULL;
37969 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
37970 	int have_get_ptr = 0;
37971 
37972 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
37973 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
37974 	}
37975 
37976 	make_real_object(object_ptr TSRMLS_CC);
37977 	object = *object_ptr;
37978 
37979 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
37980 		zend_error(E_WARNING, "Attempt to assign property of non-object");
37981 
37982 		FREE_OP(free_op_data1);
37983 
37984 		if (RETURN_VALUE_USED(opline)) {
37985 			PZVAL_LOCK(&EG(uninitialized_zval));
37986 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
37987 			EX_T(opline->result.var).var.ptr_ptr = NULL;
37988 		}
37989 	} else {
37990 		/* here we are sure we are dealing with an object */
37991 		if (0) {
37992 			MAKE_REAL_ZVAL_PTR(property);
37993 		}
37994 
37995 		/* here property is a string */
37996 		if (opline->extended_value == ZEND_ASSIGN_OBJ
37997 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
37998 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
37999 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
38000 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
38001 
38002 				have_get_ptr = 1;
38003 				binary_op(*zptr, *zptr, value TSRMLS_CC);
38004 				if (RETURN_VALUE_USED(opline)) {
38005 					PZVAL_LOCK(*zptr);
38006 					EX_T(opline->result.var).var.ptr = *zptr;
38007 					EX_T(opline->result.var).var.ptr_ptr = NULL;
38008 				}
38009 			}
38010 		}
38011 
38012 		if (!have_get_ptr) {
38013 			zval *z = NULL;
38014 
38015 			Z_ADDREF_P(object);
38016 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
38017 				if (Z_OBJ_HT_P(object)->read_property) {
38018 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
38019 				}
38020 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
38021 				if (Z_OBJ_HT_P(object)->read_dimension) {
38022 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
38023 				}
38024 			}
38025 			if (z) {
38026 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
38027 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
38028 
38029 					if (Z_REFCOUNT_P(z) == 0) {
38030 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
38031 						zval_dtor(z);
38032 						FREE_ZVAL(z);
38033 					}
38034 					z = value;
38035 				}
38036 				Z_ADDREF_P(z);
38037 				SEPARATE_ZVAL_IF_NOT_REF(&z);
38038 				binary_op(z, z, value TSRMLS_CC);
38039 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
38040 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
38041 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
38042 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
38043 				}
38044 				if (RETURN_VALUE_USED(opline)) {
38045 					PZVAL_LOCK(z);
38046 					EX_T(opline->result.var).var.ptr = z;
38047 					EX_T(opline->result.var).var.ptr_ptr = NULL;
38048 				}
38049 				zval_ptr_dtor(&z);
38050 			} else {
38051 				zend_error(E_WARNING, "Attempt to assign property of non-object");
38052 				if (RETURN_VALUE_USED(opline)) {
38053 					PZVAL_LOCK(&EG(uninitialized_zval));
38054 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
38055 					EX_T(opline->result.var).var.ptr_ptr = NULL;
38056 				}
38057 			}
38058 			zval_ptr_dtor(&object);
38059 		}
38060 
38061 		if (0) {
38062 			zval_ptr_dtor(&property);
38063 		} else {
38064 
38065 		}
38066 		FREE_OP(free_op_data1);
38067 	}
38068 
38069 	/* assign_obj has two opcodes! */
38070 	CHECK_EXCEPTION();
38071 	ZEND_VM_INC_OPCODE();
38072 	ZEND_VM_NEXT_OPCODE();
38073 }
38074 
zend_binary_assign_op_helper_SPEC_CV_UNUSED(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)38075 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_UNUSED(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
38076 {
38077 	USE_OPLINE
38078 	zend_free_op free_op_data2, free_op_data1;
38079 	zval **var_ptr;
38080 	zval *value;
38081 
38082 	SAVE_OPLINE();
38083 	switch (opline->extended_value) {
38084 		case ZEND_ASSIGN_OBJ:
38085 			return zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38086 			break;
38087 		case ZEND_ASSIGN_DIM: {
38088 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
38089 
38090 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
38091 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
38092 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
38093 					if (IS_CV == IS_VAR && !0) {
38094 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
38095 					}
38096 					return zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38097 				} else {
38098 					zval *dim = NULL;
38099 
38100 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
38101 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
38102 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
38103 				}
38104 			}
38105 			break;
38106 		default:
38107 			value = NULL;
38108 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
38109 			/* do nothing */
38110 			break;
38111 	}
38112 
38113 	if (UNEXPECTED(var_ptr == NULL)) {
38114 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
38115 	}
38116 
38117 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
38118 		if (RETURN_VALUE_USED(opline)) {
38119 			PZVAL_LOCK(&EG(uninitialized_zval));
38120 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
38121 		}
38122 
38123 
38124 		CHECK_EXCEPTION();
38125 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
38126 			ZEND_VM_INC_OPCODE();
38127 		}
38128 		ZEND_VM_NEXT_OPCODE();
38129 	}
38130 
38131 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
38132 
38133 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
38134 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
38135 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
38136 		/* proxy object */
38137 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
38138 		Z_ADDREF_P(objval);
38139 		binary_op(objval, objval, value TSRMLS_CC);
38140 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
38141 		zval_ptr_dtor(&objval);
38142 	} else {
38143 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
38144 	}
38145 
38146 	if (RETURN_VALUE_USED(opline)) {
38147 		PZVAL_LOCK(*var_ptr);
38148 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
38149 	}
38150 
38151 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
38152 		FREE_OP(free_op_data1);
38153 		FREE_OP_VAR_PTR(free_op_data2);
38154 
38155 		CHECK_EXCEPTION();
38156 		ZEND_VM_INC_OPCODE();
38157 	} else {
38158 
38159 		CHECK_EXCEPTION();
38160 	}
38161 	ZEND_VM_NEXT_OPCODE();
38162 }
38163 
ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38164 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38165 {
38166 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38167 }
38168 
ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38169 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38170 {
38171 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38172 }
38173 
ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38174 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38175 {
38176 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38177 }
38178 
ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38179 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38180 {
38181 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38182 }
38183 
ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38184 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38185 {
38186 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38187 }
38188 
ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38189 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38190 {
38191 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38192 }
38193 
ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38194 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38195 {
38196 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38197 }
38198 
ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38199 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38200 {
38201 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38202 }
38203 
ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38204 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38205 {
38206 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38207 }
38208 
ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38209 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38210 {
38211 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38212 }
38213 
ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38214 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38215 {
38216 	return zend_binary_assign_op_helper_SPEC_CV_UNUSED(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38217 }
38218 
zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type,ZEND_OPCODE_HANDLER_ARGS)38219 static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type, ZEND_OPCODE_HANDLER_ARGS)
38220 {
38221 	USE_OPLINE
38222 	zend_free_op free_op1;
38223 	zval *varname;
38224 	zval **retval;
38225 	zval tmp_varname;
38226 	HashTable *target_symbol_table;
38227 	ulong hash_value;
38228 
38229 	SAVE_OPLINE();
38230 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38231 
38232  	if (IS_CV != IS_CONST && UNEXPECTED(Z_TYPE_P(varname) != IS_STRING)) {
38233 		ZVAL_COPY_VALUE(&tmp_varname, varname);
38234 		zval_copy_ctor(&tmp_varname);
38235 		Z_SET_REFCOUNT(tmp_varname, 1);
38236 		Z_UNSET_ISREF(tmp_varname);
38237 		convert_to_string(&tmp_varname);
38238 		varname = &tmp_varname;
38239 	}
38240 
38241 	if (IS_UNUSED != IS_UNUSED) {
38242 		zend_class_entry *ce;
38243 
38244 		if (IS_UNUSED == IS_CONST) {
38245 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
38246 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
38247 			} else {
38248 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
38249 				if (UNEXPECTED(ce == NULL)) {
38250 					if (IS_CV != IS_CONST && varname == &tmp_varname) {
38251 						zval_dtor(&tmp_varname);
38252 					}
38253 
38254 					CHECK_EXCEPTION();
38255 					ZEND_VM_NEXT_OPCODE();
38256 				}
38257 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
38258 			}
38259 		} else {
38260 			ce = EX_T(opline->op2.var).class_entry;
38261 		}
38262 		retval = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 0, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
38263 
38264 	} else {
38265 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
38266 /*
38267 		if (!target_symbol_table) {
38268 			CHECK_EXCEPTION();
38269 			ZEND_VM_NEXT_OPCODE();
38270 		}
38271 */
38272 		if (IS_CV == IS_CONST) {
38273 			hash_value = Z_HASH_P(varname);
38274 		} else if (IS_INTERNED(Z_STRVAL_P(varname))) {
38275 			hash_value = INTERNED_HASH(Z_STRVAL_P(varname));
38276 		} else {
38277 			hash_value = zend_hash_func(Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1);
38278 		}
38279 
38280 		if (zend_hash_quick_find(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, (void **) &retval) == FAILURE) {
38281 			switch (type) {
38282 				case BP_VAR_R:
38283 				case BP_VAR_UNSET:
38284 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
38285 					/* break missing intentionally */
38286 				case BP_VAR_IS:
38287 					retval = &EG(uninitialized_zval_ptr);
38288 					break;
38289 				case BP_VAR_RW:
38290 					zend_error(E_NOTICE,"Undefined variable: %s", Z_STRVAL_P(varname));
38291 					/* break missing intentionally */
38292 				case BP_VAR_W:
38293 					Z_ADDREF_P(&EG(uninitialized_zval));
38294 					zend_hash_quick_update(target_symbol_table, Z_STRVAL_P(varname), Z_STRLEN_P(varname)+1, hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **) &retval);
38295 					break;
38296 				EMPTY_SWITCH_DEFAULT_CASE()
38297 			}
38298 		}
38299 		switch (opline->extended_value & ZEND_FETCH_TYPE_MASK) {
38300 			case ZEND_FETCH_GLOBAL:
38301 				if (IS_CV != IS_TMP_VAR) {
38302 
38303 				}
38304 				break;
38305 			case ZEND_FETCH_LOCAL:
38306 
38307 				break;
38308 			case ZEND_FETCH_STATIC:
38309 				zval_update_constant(retval, (void*) 1 TSRMLS_CC);
38310 				break;
38311 			case ZEND_FETCH_GLOBAL_LOCK:
38312 				if (IS_CV == IS_VAR && !free_op1.var) {
38313 					PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
38314 				}
38315 				break;
38316 		}
38317 	}
38318 
38319 
38320 	if (IS_CV != IS_CONST && varname == &tmp_varname) {
38321 		zval_dtor(&tmp_varname);
38322 	}
38323 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
38324 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
38325 	}
38326 	PZVAL_LOCK(*retval);
38327 	switch (type) {
38328 		case BP_VAR_R:
38329 		case BP_VAR_IS:
38330 			AI_SET_PTR(&EX_T(opline->result.var), *retval);
38331 			break;
38332 		case BP_VAR_UNSET: {
38333 			zend_free_op free_res;
38334 
38335 			PZVAL_UNLOCK(*retval, &free_res);
38336 			if (retval != &EG(uninitialized_zval_ptr)) {
38337 				SEPARATE_ZVAL_IF_NOT_REF(retval);
38338 			}
38339 			PZVAL_LOCK(*retval);
38340 			FREE_OP_VAR_PTR(free_res);
38341 		}
38342 		/* break missing intentionally */
38343 		default:
38344 			EX_T(opline->result.var).var.ptr_ptr = retval;
38345 			break;
38346 	}
38347 	CHECK_EXCEPTION();
38348 	ZEND_VM_NEXT_OPCODE();
38349 }
38350 
ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38351 static int ZEND_FASTCALL  ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38352 {
38353 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38354 }
38355 
ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38356 static int ZEND_FASTCALL  ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38357 {
38358 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_W, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38359 }
38360 
ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38361 static int ZEND_FASTCALL  ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38362 {
38363 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_RW, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38364 }
38365 
ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38366 static int ZEND_FASTCALL  ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38367 {
38368 	USE_OPLINE
38369 
38370 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))?BP_VAR_W:BP_VAR_R, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38371 }
38372 
ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38373 static int ZEND_FASTCALL  ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38374 {
38375 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_UNSET, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38376 }
38377 
ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38378 static int ZEND_FASTCALL  ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38379 {
38380 	return zend_fetch_var_address_helper_SPEC_CV_UNUSED(BP_VAR_IS, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38381 }
38382 
ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38383 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38384 {
38385 	USE_OPLINE
38386 	zend_free_op free_op1;
38387 	zval **container;
38388 
38389 	SAVE_OPLINE();
38390 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
38391 
38392 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
38393 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
38394 	}
38395 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
38396 
38397 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
38398 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
38399 	}
38400 
38401 	/* We are going to assign the result by reference */
38402 	if (UNEXPECTED(opline->extended_value != 0)) {
38403 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
38404 
38405 		if (retval_ptr) {
38406 			Z_DELREF_PP(retval_ptr);
38407 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
38408 			Z_ADDREF_PP(retval_ptr);
38409 		}
38410 	}
38411 
38412 	CHECK_EXCEPTION();
38413 	ZEND_VM_NEXT_OPCODE();
38414 }
38415 
ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38416 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38417 {
38418 	USE_OPLINE
38419 	zend_free_op free_op1;
38420 	zval **container;
38421 
38422 	SAVE_OPLINE();
38423 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
38424 
38425 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
38426 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
38427 	}
38428 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_RW TSRMLS_CC);
38429 
38430 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
38431 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
38432 	}
38433 
38434 	CHECK_EXCEPTION();
38435 	ZEND_VM_NEXT_OPCODE();
38436 }
38437 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38438 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38439 {
38440 	USE_OPLINE
38441 	zend_free_op free_op1;
38442 
38443 	SAVE_OPLINE();
38444 
38445 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
38446 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
38447 
38448 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
38449 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
38450 		}
38451 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_W TSRMLS_CC);
38452 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
38453 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
38454 		}
38455 
38456 
38457 	} else {
38458 		zval *container;
38459 
38460 		if (IS_UNUSED == IS_UNUSED) {
38461 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
38462 		}
38463 		container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38464 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, NULL, IS_UNUSED, BP_VAR_R TSRMLS_CC);
38465 
38466 
38467 	}
38468 	CHECK_EXCEPTION();
38469 	ZEND_VM_NEXT_OPCODE();
38470 }
38471 
ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38472 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38473 {
38474 	USE_OPLINE
38475 
38476 	zval **object_ptr;
38477 
38478 	SAVE_OPLINE();
38479 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
38480 
38481 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
38482 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
38483 	}
38484 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
38485 
38486 		zval *property_name = NULL;
38487 
38488 		if (0) {
38489 			MAKE_REAL_ZVAL_PTR(property_name);
38490 		}
38491 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
38492 		if (0) {
38493 			zval_ptr_dtor(&property_name);
38494 		} else {
38495 
38496 		}
38497 	} else {
38498 		zend_free_op free_op_data1, free_op_data2;
38499 		zval *value;
38500 		zval *dim = NULL;
38501 		zval **variable_ptr_ptr;
38502 
38503 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_UNUSED, BP_VAR_W TSRMLS_CC);
38504 
38505 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
38506 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
38507 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
38508 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
38509 				if (RETURN_VALUE_USED(opline)) {
38510 					zval *retval;
38511 
38512 					ALLOC_ZVAL(retval);
38513 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
38514 					INIT_PZVAL(retval);
38515 					AI_SET_PTR(&EX_T(opline->result.var), retval);
38516 				}
38517 			} else if (RETURN_VALUE_USED(opline)) {
38518 				PZVAL_LOCK(&EG(uninitialized_zval));
38519 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
38520 			}
38521 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
38522 			if (IS_TMP_FREE(free_op_data1)) {
38523 				zval_dtor(value);
38524 			}
38525 			if (RETURN_VALUE_USED(opline)) {
38526 				PZVAL_LOCK(&EG(uninitialized_zval));
38527 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
38528 			}
38529 		} else {
38530 			if ((opline+1)->op1_type == IS_TMP_VAR) {
38531 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
38532 			} else if ((opline+1)->op1_type == IS_CONST) {
38533 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
38534 			} else {
38535 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
38536 			}
38537 			if (RETURN_VALUE_USED(opline)) {
38538 				PZVAL_LOCK(value);
38539 				AI_SET_PTR(&EX_T(opline->result.var), value);
38540 			}
38541 		}
38542 		FREE_OP_VAR_PTR(free_op_data2);
38543 	 	FREE_OP_IF_VAR(free_op_data1);
38544 	}
38545 
38546 	/* assign_dim has two opcodes! */
38547 	CHECK_EXCEPTION();
38548 	ZEND_VM_INC_OPCODE();
38549 	ZEND_VM_NEXT_OPCODE();
38550 }
38551 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38552 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38553 {
38554 	USE_OPLINE
38555 
38556 	zval *expr_ptr;
38557 
38558 	SAVE_OPLINE();
38559 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
38560 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
38561 
38562 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
38563 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
38564 		}
38565 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
38566 		expr_ptr = *expr_ptr_ptr;
38567 		Z_ADDREF_P(expr_ptr);
38568 	} else {
38569 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38570 		if (0) { /* temporary variable */
38571 			zval *new_expr;
38572 
38573 			ALLOC_ZVAL(new_expr);
38574 			INIT_PZVAL_COPY(new_expr, expr_ptr);
38575 			expr_ptr = new_expr;
38576 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
38577 			zval *new_expr;
38578 
38579 			ALLOC_ZVAL(new_expr);
38580 			INIT_PZVAL_COPY(new_expr, expr_ptr);
38581 			expr_ptr = new_expr;
38582 			zendi_zval_copy_ctor(*expr_ptr);
38583 		} else {
38584 			Z_ADDREF_P(expr_ptr);
38585 		}
38586 	}
38587 
38588 	if (IS_UNUSED != IS_UNUSED) {
38589 
38590 		zval *offset = NULL;
38591 		ulong hval;
38592 
38593 		switch (Z_TYPE_P(offset)) {
38594 			case IS_DOUBLE:
38595 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
38596 				goto num_index;
38597 			case IS_LONG:
38598 			case IS_BOOL:
38599 				hval = Z_LVAL_P(offset);
38600 num_index:
38601 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
38602 				break;
38603 			case IS_STRING:
38604 				if (IS_UNUSED == IS_CONST) {
38605 					hval = Z_HASH_P(offset);
38606 				} else {
38607 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
38608 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
38609 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
38610 					} else {
38611 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
38612 					}
38613 				}
38614 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
38615 				break;
38616 			case IS_NULL:
38617 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
38618 				break;
38619 			default:
38620 				zend_error(E_WARNING, "Illegal offset type");
38621 				zval_ptr_dtor(&expr_ptr);
38622 				/* do nothing */
38623 				break;
38624 		}
38625 
38626 	} else {
38627 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
38628 	}
38629 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
38630 
38631 	} else {
38632 
38633 	}
38634 	CHECK_EXCEPTION();
38635 	ZEND_VM_NEXT_OPCODE();
38636 }
38637 
ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38638 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38639 {
38640 	USE_OPLINE
38641 
38642 	array_init(&EX_T(opline->result.var).tmp_var);
38643 	if (IS_CV == IS_UNUSED) {
38644 		ZEND_VM_NEXT_OPCODE();
38645 #if 0 || IS_CV != IS_UNUSED
38646 	} else {
38647 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
38648 #endif
38649 	}
38650 }
38651 
ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38652 static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38653 {
38654 	USE_OPLINE
38655 	zval tmp, *varname;
38656 	HashTable *target_symbol_table;
38657 
38658 
38659 	SAVE_OPLINE();
38660 	if (IS_CV == IS_CV &&
38661 	    IS_UNUSED == IS_UNUSED &&
38662 	    (opline->extended_value & ZEND_QUICK_SET)) {
38663 		if (EG(active_symbol_table)) {
38664 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
38665 
38666 			zend_delete_variable(EX(prev_execute_data), EG(active_symbol_table),  cv->name, cv->name_len+1, cv->hash_value TSRMLS_CC);
38667 			EX_CV(opline->op1.var) = NULL;
38668 		} else if (EX_CV(opline->op1.var)) {
38669 			zval_ptr_dtor(EX_CV(opline->op1.var));
38670 			EX_CV(opline->op1.var) = NULL;
38671 		}
38672 		CHECK_EXCEPTION();
38673 		ZEND_VM_NEXT_OPCODE();
38674 	}
38675 
38676 	varname = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38677 
38678 	if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
38679 		ZVAL_COPY_VALUE(&tmp, varname);
38680 		zval_copy_ctor(&tmp);
38681 		convert_to_string(&tmp);
38682 		varname = &tmp;
38683 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
38684 		Z_ADDREF_P(varname);
38685 	}
38686 
38687 	if (IS_UNUSED != IS_UNUSED) {
38688 		zend_class_entry *ce;
38689 
38690 		if (IS_UNUSED == IS_CONST) {
38691 			if (CACHED_PTR(opline->op2.literal->cache_slot)) {
38692 				ce = CACHED_PTR(opline->op2.literal->cache_slot);
38693 			} else {
38694 				ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
38695 				if (UNEXPECTED(EG(exception) != NULL)) {
38696 					if (IS_CV != IS_CONST && varname == &tmp) {
38697 						zval_dtor(&tmp);
38698 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
38699 						zval_ptr_dtor(&varname);
38700 					}
38701 
38702 					HANDLE_EXCEPTION();
38703 				}
38704 				if (UNEXPECTED(ce == NULL)) {
38705 					zend_error_noreturn(E_ERROR, "Class '%s' not found", Z_STRVAL_P(opline->op2.zv));
38706 				}
38707 				CACHE_PTR(opline->op2.literal->cache_slot, ce);
38708 			}
38709 		} else {
38710 			ce = EX_T(opline->op2.var).class_entry;
38711 		}
38712 		zend_std_unset_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
38713 	} else {
38714 		ulong hash_value = zend_inline_hash_func(varname->value.str.val, varname->value.str.len+1);
38715 
38716 		target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
38717 		zend_delete_variable(execute_data, target_symbol_table, varname->value.str.val, varname->value.str.len+1, hash_value TSRMLS_CC);
38718 	}
38719 
38720 	if (IS_CV != IS_CONST && varname == &tmp) {
38721 		zval_dtor(&tmp);
38722 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
38723 		zval_ptr_dtor(&varname);
38724 	}
38725 
38726 	CHECK_EXCEPTION();
38727 	ZEND_VM_NEXT_OPCODE();
38728 }
38729 
ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38730 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38731 {
38732 	USE_OPLINE
38733 	zval **value;
38734 	zend_bool isset = 1;
38735 
38736 	SAVE_OPLINE();
38737 	if (IS_CV == IS_CV &&
38738 	    IS_UNUSED == IS_UNUSED &&
38739 	    (opline->extended_value & ZEND_QUICK_SET)) {
38740 		if (EX_CV(opline->op1.var)) {
38741 			value = EX_CV(opline->op1.var);
38742 		} else if (EG(active_symbol_table)) {
38743 			zend_compiled_variable *cv = &CV_DEF_OF(opline->op1.var);
38744 
38745 			if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **) &value) == FAILURE) {
38746 				isset = 0;
38747 			}
38748 		} else {
38749 			isset = 0;
38750 		}
38751 	} else {
38752 		HashTable *target_symbol_table;
38753 
38754 		zval tmp, *varname = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
38755 
38756 		if (IS_CV != IS_CONST && Z_TYPE_P(varname) != IS_STRING) {
38757 			ZVAL_COPY_VALUE(&tmp, varname);
38758 			zval_copy_ctor(&tmp);
38759 			convert_to_string(&tmp);
38760 			varname = &tmp;
38761 		}
38762 
38763 		if (IS_UNUSED != IS_UNUSED) {
38764 			zend_class_entry *ce;
38765 
38766 			if (IS_UNUSED == IS_CONST) {
38767 				if (CACHED_PTR(opline->op2.literal->cache_slot)) {
38768 					ce = CACHED_PTR(opline->op2.literal->cache_slot);
38769 				} else {
38770 					ce = zend_fetch_class_by_name(Z_STRVAL_P(opline->op2.zv), Z_STRLEN_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
38771 					if (UNEXPECTED(ce == NULL)) {
38772 						CHECK_EXCEPTION();
38773 						ZEND_VM_NEXT_OPCODE();
38774 					}
38775 					CACHE_PTR(opline->op2.literal->cache_slot, ce);
38776 				}
38777 			} else {
38778 				ce = EX_T(opline->op2.var).class_entry;
38779 			}
38780 			value = zend_std_get_static_property(ce, Z_STRVAL_P(varname), Z_STRLEN_P(varname), 1, ((IS_CV == IS_CONST) ? opline->op1.literal : NULL) TSRMLS_CC);
38781 			if (!value) {
38782 				isset = 0;
38783 			}
38784 		} else {
38785 			target_symbol_table = zend_get_target_symbol_table(opline->extended_value & ZEND_FETCH_TYPE_MASK TSRMLS_CC);
38786 			if (zend_hash_find(target_symbol_table, varname->value.str.val, varname->value.str.len+1, (void **) &value) == FAILURE) {
38787 				isset = 0;
38788 			}
38789 		}
38790 
38791 		if (IS_CV != IS_CONST && varname == &tmp) {
38792 			zval_dtor(&tmp);
38793 		}
38794 
38795 	}
38796 
38797 	if (opline->extended_value & ZEND_ISSET) {
38798 		if (isset && Z_TYPE_PP(value) != IS_NULL) {
38799 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
38800 		} else {
38801 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
38802 		}
38803 	} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
38804 		if (!isset || !i_zend_is_true(*value)) {
38805 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 1);
38806 		} else {
38807 			ZVAL_BOOL(&EX_T(opline->result.var).tmp_var, 0);
38808 		}
38809 	}
38810 
38811 	CHECK_EXCEPTION();
38812 	ZEND_VM_NEXT_OPCODE();
38813 }
38814 
ZEND_YIELD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38815 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38816 {
38817 	USE_OPLINE
38818 
38819 	/* The generator object is stored in return_value_ptr_ptr */
38820 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
38821 
38822 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
38823 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
38824 	}
38825 
38826 	/* Destroy the previously yielded value */
38827 	if (generator->value) {
38828 		zval_ptr_dtor(&generator->value);
38829 	}
38830 
38831 	/* Destroy the previously yielded key */
38832 	if (generator->key) {
38833 		zval_ptr_dtor(&generator->key);
38834 	}
38835 
38836 	/* Set the new yielded value */
38837 	if (IS_CV != IS_UNUSED) {
38838 
38839 
38840 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
38841 			/* Constants and temporary variables aren't yieldable by reference,
38842 			 * but we still allow them with a notice. */
38843 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
38844 				zval *value, *copy;
38845 
38846 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
38847 
38848 				value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38849 				ALLOC_ZVAL(copy);
38850 				INIT_PZVAL_COPY(copy, value);
38851 
38852 				/* Temporary variables don't need ctor copying */
38853 				if (!0) {
38854 					zval_copy_ctor(copy);
38855 				}
38856 
38857 				generator->value = copy;
38858 			} else {
38859 				zval **value_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
38860 
38861 				if (IS_CV == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
38862 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
38863 				}
38864 
38865 				/* If a function call result is yielded and the function did
38866 				 * not return by reference we throw a notice. */
38867 				if (IS_CV == IS_VAR && !Z_ISREF_PP(value_ptr)
38868 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
38869 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
38870 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
38871 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
38872 
38873 					Z_ADDREF_PP(value_ptr);
38874 					generator->value = *value_ptr;
38875 				} else {
38876 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
38877 					Z_ADDREF_PP(value_ptr);
38878 					generator->value = *value_ptr;
38879 				}
38880 
38881 			}
38882 		} else {
38883 			zval *value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
38884 
38885 			/* Consts, temporary variables and references need copying */
38886 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
38887 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
38888 			) {
38889 				zval *copy;
38890 
38891 				ALLOC_ZVAL(copy);
38892 				INIT_PZVAL_COPY(copy, value);
38893 
38894 				/* Temporary variables don't need ctor copying */
38895 				if (!0) {
38896 					zval_copy_ctor(copy);
38897 				}
38898 
38899 				generator->value = copy;
38900 			} else {
38901 				Z_ADDREF_P(value);
38902 				generator->value = value;
38903 			}
38904 
38905 		}
38906 	} else {
38907 		/* If no value was specified yield null */
38908 		Z_ADDREF(EG(uninitialized_zval));
38909 		generator->value = &EG(uninitialized_zval);
38910 	}
38911 
38912 	/* Set the new yielded key */
38913 	if (IS_UNUSED != IS_UNUSED) {
38914 
38915 		zval *key = NULL;
38916 
38917 		/* Consts, temporary variables and references need copying */
38918 		if (IS_UNUSED == IS_CONST || IS_UNUSED == IS_TMP_VAR
38919 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
38920 		) {
38921 			zval *copy;
38922 
38923 			ALLOC_ZVAL(copy);
38924 			INIT_PZVAL_COPY(copy, key);
38925 
38926 			/* Temporary variables don't need ctor copying */
38927 			if (!0) {
38928 				zval_copy_ctor(copy);
38929 			}
38930 
38931 			generator->key = copy;
38932 		} else {
38933 			Z_ADDREF_P(key);
38934 			generator->key = key;
38935 		}
38936 
38937 		if (Z_TYPE_P(generator->key) == IS_LONG
38938 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
38939 		) {
38940 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
38941 		}
38942 
38943 	} else {
38944 		/* If no key was specified we use auto-increment keys */
38945 		generator->largest_used_integer_key++;
38946 
38947 		ALLOC_INIT_ZVAL(generator->key);
38948 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
38949 	}
38950 
38951 	if (RETURN_VALUE_USED(opline)) {
38952 		/* If the return value of yield is used set the send
38953 		 * target and initialize it to NULL */
38954 		generator->send_target = &EX_T(opline->result.var).var.ptr;
38955 		Z_ADDREF(EG(uninitialized_zval));
38956 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
38957 	} else {
38958 		generator->send_target = NULL;
38959 	}
38960 
38961 	/* We increment to the next op, so we are at the correct position when the
38962 	 * generator is resumed. */
38963 	ZEND_VM_INC_OPCODE();
38964 
38965 	/* The GOTO VM uses a local opline variable. We need to set the opline
38966 	 * variable in execute_data so we don't resume at an old position. */
38967 	SAVE_OPLINE();
38968 
38969 	ZEND_VM_RETURN();
38970 }
38971 
ZEND_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38972 static int ZEND_FASTCALL  ZEND_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38973 {
38974 	USE_OPLINE
38975 
38976 
38977 	SAVE_OPLINE();
38978 	fast_add_function(&EX_T(opline->result.var).tmp_var,
38979 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
38980 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
38981 
38982 
38983 	CHECK_EXCEPTION();
38984 	ZEND_VM_NEXT_OPCODE();
38985 }
38986 
ZEND_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)38987 static int ZEND_FASTCALL  ZEND_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
38988 {
38989 	USE_OPLINE
38990 
38991 
38992 	SAVE_OPLINE();
38993 	fast_sub_function(&EX_T(opline->result.var).tmp_var,
38994 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
38995 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
38996 
38997 
38998 	CHECK_EXCEPTION();
38999 	ZEND_VM_NEXT_OPCODE();
39000 }
39001 
ZEND_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39002 static int ZEND_FASTCALL  ZEND_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39003 {
39004 	USE_OPLINE
39005 
39006 
39007 	SAVE_OPLINE();
39008 	fast_mul_function(&EX_T(opline->result.var).tmp_var,
39009 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39010 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39011 
39012 
39013 	CHECK_EXCEPTION();
39014 	ZEND_VM_NEXT_OPCODE();
39015 }
39016 
ZEND_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39017 static int ZEND_FASTCALL  ZEND_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39018 {
39019 	USE_OPLINE
39020 
39021 
39022 	SAVE_OPLINE();
39023 	fast_div_function(&EX_T(opline->result.var).tmp_var,
39024 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39025 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39026 
39027 
39028 	CHECK_EXCEPTION();
39029 	ZEND_VM_NEXT_OPCODE();
39030 }
39031 
ZEND_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39032 static int ZEND_FASTCALL  ZEND_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39033 {
39034 	USE_OPLINE
39035 
39036 
39037 	SAVE_OPLINE();
39038 	fast_mod_function(&EX_T(opline->result.var).tmp_var,
39039 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39040 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39041 
39042 
39043 	CHECK_EXCEPTION();
39044 	ZEND_VM_NEXT_OPCODE();
39045 }
39046 
ZEND_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39047 static int ZEND_FASTCALL  ZEND_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39048 {
39049 	USE_OPLINE
39050 
39051 
39052 	SAVE_OPLINE();
39053 	shift_left_function(&EX_T(opline->result.var).tmp_var,
39054 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39055 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39056 
39057 
39058 	CHECK_EXCEPTION();
39059 	ZEND_VM_NEXT_OPCODE();
39060 }
39061 
ZEND_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39062 static int ZEND_FASTCALL  ZEND_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39063 {
39064 	USE_OPLINE
39065 
39066 
39067 	SAVE_OPLINE();
39068 	shift_right_function(&EX_T(opline->result.var).tmp_var,
39069 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39070 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39071 
39072 
39073 	CHECK_EXCEPTION();
39074 	ZEND_VM_NEXT_OPCODE();
39075 }
39076 
ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39077 static int ZEND_FASTCALL  ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39078 {
39079 	USE_OPLINE
39080 
39081 
39082 	SAVE_OPLINE();
39083 	concat_function(&EX_T(opline->result.var).tmp_var,
39084 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39085 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39086 
39087 
39088 	CHECK_EXCEPTION();
39089 	ZEND_VM_NEXT_OPCODE();
39090 }
39091 
ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39092 static int ZEND_FASTCALL  ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39093 {
39094 	USE_OPLINE
39095 
39096 
39097 	SAVE_OPLINE();
39098 	is_identical_function(&EX_T(opline->result.var).tmp_var,
39099 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39100 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39101 
39102 
39103 	CHECK_EXCEPTION();
39104 	ZEND_VM_NEXT_OPCODE();
39105 }
39106 
ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39107 static int ZEND_FASTCALL  ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39108 {
39109 	USE_OPLINE
39110 
39111 	zval *result = &EX_T(opline->result.var).tmp_var;
39112 
39113 	SAVE_OPLINE();
39114 	is_identical_function(result,
39115 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39116 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39117 	Z_LVAL_P(result) = !Z_LVAL_P(result);
39118 
39119 
39120 	CHECK_EXCEPTION();
39121 	ZEND_VM_NEXT_OPCODE();
39122 }
39123 
ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39124 static int ZEND_FASTCALL  ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39125 {
39126 	USE_OPLINE
39127 
39128 	zval *result = &EX_T(opline->result.var).tmp_var;
39129 
39130 	SAVE_OPLINE();
39131 	ZVAL_BOOL(result, fast_equal_function(result,
39132 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39133 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
39134 
39135 
39136 	CHECK_EXCEPTION();
39137 	ZEND_VM_NEXT_OPCODE();
39138 }
39139 
ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39140 static int ZEND_FASTCALL  ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39141 {
39142 	USE_OPLINE
39143 
39144 	zval *result = &EX_T(opline->result.var).tmp_var;
39145 
39146 	SAVE_OPLINE();
39147 	ZVAL_BOOL(result, fast_not_equal_function(result,
39148 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39149 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
39150 
39151 
39152 	CHECK_EXCEPTION();
39153 	ZEND_VM_NEXT_OPCODE();
39154 }
39155 
ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39156 static int ZEND_FASTCALL  ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39157 {
39158 	USE_OPLINE
39159 
39160 	zval *result = &EX_T(opline->result.var).tmp_var;
39161 
39162 	SAVE_OPLINE();
39163 	ZVAL_BOOL(result, fast_is_smaller_function(result,
39164 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39165 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
39166 
39167 
39168 	CHECK_EXCEPTION();
39169 	ZEND_VM_NEXT_OPCODE();
39170 }
39171 
ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39172 static int ZEND_FASTCALL  ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39173 {
39174 	USE_OPLINE
39175 
39176 	zval *result = &EX_T(opline->result.var).tmp_var;
39177 
39178 	SAVE_OPLINE();
39179 	ZVAL_BOOL(result, fast_is_smaller_or_equal_function(result,
39180 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39181 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC));
39182 
39183 
39184 	CHECK_EXCEPTION();
39185 	ZEND_VM_NEXT_OPCODE();
39186 }
39187 
ZEND_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39188 static int ZEND_FASTCALL  ZEND_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39189 {
39190 	USE_OPLINE
39191 
39192 
39193 	SAVE_OPLINE();
39194 	bitwise_or_function(&EX_T(opline->result.var).tmp_var,
39195 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39196 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39197 
39198 
39199 	CHECK_EXCEPTION();
39200 	ZEND_VM_NEXT_OPCODE();
39201 }
39202 
ZEND_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39203 static int ZEND_FASTCALL  ZEND_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39204 {
39205 	USE_OPLINE
39206 
39207 
39208 	SAVE_OPLINE();
39209 	bitwise_and_function(&EX_T(opline->result.var).tmp_var,
39210 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39211 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39212 
39213 
39214 	CHECK_EXCEPTION();
39215 	ZEND_VM_NEXT_OPCODE();
39216 }
39217 
ZEND_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39218 static int ZEND_FASTCALL  ZEND_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39219 {
39220 	USE_OPLINE
39221 
39222 
39223 	SAVE_OPLINE();
39224 	bitwise_xor_function(&EX_T(opline->result.var).tmp_var,
39225 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39226 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39227 
39228 
39229 	CHECK_EXCEPTION();
39230 	ZEND_VM_NEXT_OPCODE();
39231 }
39232 
ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39233 static int ZEND_FASTCALL  ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39234 {
39235 	USE_OPLINE
39236 
39237 
39238 	SAVE_OPLINE();
39239 	boolean_xor_function(&EX_T(opline->result.var).tmp_var,
39240 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
39241 		_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
39242 
39243 
39244 	CHECK_EXCEPTION();
39245 	ZEND_VM_NEXT_OPCODE();
39246 }
39247 
zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)39248 static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
39249 {
39250 	USE_OPLINE
39251 	zend_free_op free_op_data1;
39252 	zval **object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39253 	zval *object;
39254 	zval *property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39255 	zval *value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
39256 	int have_get_ptr = 0;
39257 
39258 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
39259 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
39260 	}
39261 
39262 	make_real_object(object_ptr TSRMLS_CC);
39263 	object = *object_ptr;
39264 
39265 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
39266 		zend_error(E_WARNING, "Attempt to assign property of non-object");
39267 
39268 		FREE_OP(free_op_data1);
39269 
39270 		if (RETURN_VALUE_USED(opline)) {
39271 			PZVAL_LOCK(&EG(uninitialized_zval));
39272 			EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
39273 			EX_T(opline->result.var).var.ptr_ptr = NULL;
39274 		}
39275 	} else {
39276 		/* here we are sure we are dealing with an object */
39277 		if (0) {
39278 			MAKE_REAL_ZVAL_PTR(property);
39279 		}
39280 
39281 		/* here property is a string */
39282 		if (opline->extended_value == ZEND_ASSIGN_OBJ
39283 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
39284 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39285 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
39286 				SEPARATE_ZVAL_IF_NOT_REF(zptr);
39287 
39288 				have_get_ptr = 1;
39289 				binary_op(*zptr, *zptr, value TSRMLS_CC);
39290 				if (RETURN_VALUE_USED(opline)) {
39291 					PZVAL_LOCK(*zptr);
39292 					EX_T(opline->result.var).var.ptr = *zptr;
39293 					EX_T(opline->result.var).var.ptr_ptr = NULL;
39294 				}
39295 			}
39296 		}
39297 
39298 		if (!have_get_ptr) {
39299 			zval *z = NULL;
39300 
39301 			Z_ADDREF_P(object);
39302 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
39303 				if (Z_OBJ_HT_P(object)->read_property) {
39304 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39305 				}
39306 			} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
39307 				if (Z_OBJ_HT_P(object)->read_dimension) {
39308 					z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R TSRMLS_CC);
39309 				}
39310 			}
39311 			if (z) {
39312 				if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
39313 					zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
39314 
39315 					if (Z_REFCOUNT_P(z) == 0) {
39316 						GC_REMOVE_ZVAL_FROM_BUFFER(z);
39317 						zval_dtor(z);
39318 						FREE_ZVAL(z);
39319 					}
39320 					z = value;
39321 				}
39322 				Z_ADDREF_P(z);
39323 				SEPARATE_ZVAL_IF_NOT_REF(&z);
39324 				binary_op(z, z, value TSRMLS_CC);
39325 				if (opline->extended_value == ZEND_ASSIGN_OBJ) {
39326 					Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39327 				} else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ {
39328 					Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC);
39329 				}
39330 				if (RETURN_VALUE_USED(opline)) {
39331 					PZVAL_LOCK(z);
39332 					EX_T(opline->result.var).var.ptr = z;
39333 					EX_T(opline->result.var).var.ptr_ptr = NULL;
39334 				}
39335 				zval_ptr_dtor(&z);
39336 			} else {
39337 				zend_error(E_WARNING, "Attempt to assign property of non-object");
39338 				if (RETURN_VALUE_USED(opline)) {
39339 					PZVAL_LOCK(&EG(uninitialized_zval));
39340 					EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
39341 					EX_T(opline->result.var).var.ptr_ptr = NULL;
39342 				}
39343 			}
39344 			zval_ptr_dtor(&object);
39345 		}
39346 
39347 		if (0) {
39348 			zval_ptr_dtor(&property);
39349 		} else {
39350 
39351 		}
39352 		FREE_OP(free_op_data1);
39353 	}
39354 
39355 	/* assign_obj has two opcodes! */
39356 	CHECK_EXCEPTION();
39357 	ZEND_VM_INC_OPCODE();
39358 	ZEND_VM_NEXT_OPCODE();
39359 }
39360 
zend_binary_assign_op_helper_SPEC_CV_CV(int (* binary_op)(zval * result,zval * op1,zval * op2 TSRMLS_DC),ZEND_OPCODE_HANDLER_ARGS)39361 static int ZEND_FASTCALL zend_binary_assign_op_helper_SPEC_CV_CV(int (*binary_op)(zval *result, zval *op1, zval *op2 TSRMLS_DC), ZEND_OPCODE_HANDLER_ARGS)
39362 {
39363 	USE_OPLINE
39364 	zend_free_op free_op_data2, free_op_data1;
39365 	zval **var_ptr;
39366 	zval *value;
39367 
39368 	SAVE_OPLINE();
39369 	switch (opline->extended_value) {
39370 		case ZEND_ASSIGN_OBJ:
39371 			return zend_binary_assign_op_obj_helper_SPEC_CV_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39372 			break;
39373 		case ZEND_ASSIGN_DIM: {
39374 				zval **container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39375 
39376 				if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39377 					zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
39378 				} else if (UNEXPECTED(Z_TYPE_PP(container) == IS_OBJECT)) {
39379 					if (IS_CV == IS_VAR && !0) {
39380 						Z_ADDREF_PP(container);  /* undo the effect of get_obj_zval_ptr_ptr() */
39381 					}
39382 					return zend_binary_assign_op_obj_helper_SPEC_CV_CV(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39383 				} else {
39384 					zval *dim = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39385 
39386 					zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), container, dim, IS_CV, BP_VAR_RW TSRMLS_CC);
39387 					value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
39388 					var_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
39389 				}
39390 			}
39391 			break;
39392 		default:
39393 			value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39394 			var_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39395 			/* do nothing */
39396 			break;
39397 	}
39398 
39399 	if (UNEXPECTED(var_ptr == NULL)) {
39400 		zend_error_noreturn(E_ERROR, "Cannot use assign-op operators with overloaded objects nor string offsets");
39401 	}
39402 
39403 	if (UNEXPECTED(*var_ptr == &EG(error_zval))) {
39404 		if (RETURN_VALUE_USED(opline)) {
39405 			PZVAL_LOCK(&EG(uninitialized_zval));
39406 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
39407 		}
39408 
39409 
39410 		CHECK_EXCEPTION();
39411 		if (opline->extended_value == ZEND_ASSIGN_DIM) {
39412 			ZEND_VM_INC_OPCODE();
39413 		}
39414 		ZEND_VM_NEXT_OPCODE();
39415 	}
39416 
39417 	SEPARATE_ZVAL_IF_NOT_REF(var_ptr);
39418 
39419 	if (UNEXPECTED(Z_TYPE_PP(var_ptr) == IS_OBJECT)
39420 	   && Z_OBJ_HANDLER_PP(var_ptr, get)
39421 	   && Z_OBJ_HANDLER_PP(var_ptr, set)) {
39422 		/* proxy object */
39423 		zval *objval = Z_OBJ_HANDLER_PP(var_ptr, get)(*var_ptr TSRMLS_CC);
39424 		Z_ADDREF_P(objval);
39425 		binary_op(objval, objval, value TSRMLS_CC);
39426 		Z_OBJ_HANDLER_PP(var_ptr, set)(var_ptr, objval TSRMLS_CC);
39427 		zval_ptr_dtor(&objval);
39428 	} else {
39429 		binary_op(*var_ptr, *var_ptr, value TSRMLS_CC);
39430 	}
39431 
39432 	if (RETURN_VALUE_USED(opline)) {
39433 		PZVAL_LOCK(*var_ptr);
39434 		AI_SET_PTR(&EX_T(opline->result.var), *var_ptr);
39435 	}
39436 
39437 	if (opline->extended_value == ZEND_ASSIGN_DIM) {
39438 		FREE_OP(free_op_data1);
39439 		FREE_OP_VAR_PTR(free_op_data2);
39440 
39441 		CHECK_EXCEPTION();
39442 		ZEND_VM_INC_OPCODE();
39443 	} else {
39444 
39445 		CHECK_EXCEPTION();
39446 	}
39447 	ZEND_VM_NEXT_OPCODE();
39448 }
39449 
ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39450 static int ZEND_FASTCALL  ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39451 {
39452 	return zend_binary_assign_op_helper_SPEC_CV_CV(add_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39453 }
39454 
ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39455 static int ZEND_FASTCALL  ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39456 {
39457 	return zend_binary_assign_op_helper_SPEC_CV_CV(sub_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39458 }
39459 
ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39460 static int ZEND_FASTCALL  ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39461 {
39462 	return zend_binary_assign_op_helper_SPEC_CV_CV(mul_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39463 }
39464 
ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39465 static int ZEND_FASTCALL  ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39466 {
39467 	return zend_binary_assign_op_helper_SPEC_CV_CV(div_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39468 }
39469 
ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39470 static int ZEND_FASTCALL  ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39471 {
39472 	return zend_binary_assign_op_helper_SPEC_CV_CV(mod_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39473 }
39474 
ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39475 static int ZEND_FASTCALL  ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39476 {
39477 	return zend_binary_assign_op_helper_SPEC_CV_CV(shift_left_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39478 }
39479 
ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39480 static int ZEND_FASTCALL  ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39481 {
39482 	return zend_binary_assign_op_helper_SPEC_CV_CV(shift_right_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39483 }
39484 
ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39485 static int ZEND_FASTCALL  ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39486 {
39487 	return zend_binary_assign_op_helper_SPEC_CV_CV(concat_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39488 }
39489 
ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39490 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39491 {
39492 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_or_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39493 }
39494 
ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39495 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39496 {
39497 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_and_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39498 }
39499 
ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39500 static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39501 {
39502 	return zend_binary_assign_op_helper_SPEC_CV_CV(bitwise_xor_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39503 }
39504 
zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)39505 static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
39506 {
39507 	USE_OPLINE
39508 
39509 	zval **object_ptr;
39510 	zval *object;
39511 	zval *property;
39512 	zval **retval;
39513 	int have_get_ptr = 0;
39514 
39515 	SAVE_OPLINE();
39516 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39517 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39518 	retval = &EX_T(opline->result.var).var.ptr;
39519 
39520 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
39521 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
39522 	}
39523 
39524 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
39525 	object = *object_ptr;
39526 
39527 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
39528 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
39529 
39530 		if (RETURN_VALUE_USED(opline)) {
39531 			PZVAL_LOCK(&EG(uninitialized_zval));
39532 			*retval = &EG(uninitialized_zval);
39533 		}
39534 
39535 		CHECK_EXCEPTION();
39536 		ZEND_VM_NEXT_OPCODE();
39537 	}
39538 
39539 	/* here we are sure we are dealing with an object */
39540 
39541 	if (0) {
39542 		MAKE_REAL_ZVAL_PTR(property);
39543 	}
39544 
39545 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
39546 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39547 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
39548 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
39549 
39550 			have_get_ptr = 1;
39551 			incdec_op(*zptr);
39552 			if (RETURN_VALUE_USED(opline)) {
39553 				*retval = *zptr;
39554 				PZVAL_LOCK(*retval);
39555 			}
39556 		}
39557 	}
39558 
39559 	if (!have_get_ptr) {
39560 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
39561 			zval *z;
39562 
39563 			Z_ADDREF_P(object);
39564 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39565 
39566 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
39567 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
39568 
39569 				if (Z_REFCOUNT_P(z) == 0) {
39570 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
39571 					zval_dtor(z);
39572 					FREE_ZVAL(z);
39573 				}
39574 				z = value;
39575 			}
39576 			Z_ADDREF_P(z);
39577 			SEPARATE_ZVAL_IF_NOT_REF(&z);
39578 			incdec_op(z);
39579 			*retval = z;
39580 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39581 			zval_ptr_dtor(&object);
39582 			SELECTIVE_PZVAL_LOCK(*retval, opline);
39583 			zval_ptr_dtor(&z);
39584 		} else {
39585 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
39586 			if (RETURN_VALUE_USED(opline)) {
39587 				PZVAL_LOCK(&EG(uninitialized_zval));
39588 				*retval = &EG(uninitialized_zval);
39589 			}
39590 		}
39591 	}
39592 
39593 	if (0) {
39594 		zval_ptr_dtor(&property);
39595 	} else {
39596 
39597 	}
39598 
39599 	CHECK_EXCEPTION();
39600 	ZEND_VM_NEXT_OPCODE();
39601 }
39602 
ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39603 static int ZEND_FASTCALL  ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39604 {
39605 	return zend_pre_incdec_property_helper_SPEC_CV_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39606 }
39607 
ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39608 static int ZEND_FASTCALL  ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39609 {
39610 	return zend_pre_incdec_property_helper_SPEC_CV_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39611 }
39612 
zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op,ZEND_OPCODE_HANDLER_ARGS)39613 static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_OPCODE_HANDLER_ARGS)
39614 {
39615 	USE_OPLINE
39616 
39617 	zval **object_ptr;
39618 	zval *object;
39619 	zval *property;
39620 	zval *retval;
39621 	int have_get_ptr = 0;
39622 
39623 	SAVE_OPLINE();
39624 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39625 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39626 	retval = &EX_T(opline->result.var).tmp_var;
39627 
39628 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
39629 		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
39630 	}
39631 
39632 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
39633 	object = *object_ptr;
39634 
39635 	if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
39636 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
39637 
39638 		ZVAL_NULL(retval);
39639 
39640 		CHECK_EXCEPTION();
39641 		ZEND_VM_NEXT_OPCODE();
39642 	}
39643 
39644 	/* here we are sure we are dealing with an object */
39645 
39646 	if (0) {
39647 		MAKE_REAL_ZVAL_PTR(property);
39648 	}
39649 
39650 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
39651 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39652 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
39653 			have_get_ptr = 1;
39654 			SEPARATE_ZVAL_IF_NOT_REF(zptr);
39655 
39656 			ZVAL_COPY_VALUE(retval, *zptr);
39657 			zendi_zval_copy_ctor(*retval);
39658 
39659 			incdec_op(*zptr);
39660 
39661 		}
39662 	}
39663 
39664 	if (!have_get_ptr) {
39665 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
39666 			zval *z, *z_copy;
39667 
39668 			Z_ADDREF_P(object);
39669 			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39670 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
39671 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
39672 
39673 				if (Z_REFCOUNT_P(z) == 0) {
39674 					GC_REMOVE_ZVAL_FROM_BUFFER(z);
39675 					zval_dtor(z);
39676 					FREE_ZVAL(z);
39677 				}
39678 				z = value;
39679 			}
39680 			ZVAL_COPY_VALUE(retval, z);
39681 			zendi_zval_copy_ctor(*retval);
39682 			ALLOC_ZVAL(z_copy);
39683 			INIT_PZVAL_COPY(z_copy, z);
39684 			zendi_zval_copy_ctor(*z_copy);
39685 			incdec_op(z_copy);
39686 			Z_ADDREF_P(z);
39687 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39688 			zval_ptr_dtor(&object);
39689 			zval_ptr_dtor(&z_copy);
39690 			zval_ptr_dtor(&z);
39691 		} else {
39692 			zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
39693 			ZVAL_NULL(retval);
39694 		}
39695 	}
39696 
39697 	if (0) {
39698 		zval_ptr_dtor(&property);
39699 	} else {
39700 
39701 	}
39702 
39703 	CHECK_EXCEPTION();
39704 	ZEND_VM_NEXT_OPCODE();
39705 }
39706 
ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39707 static int ZEND_FASTCALL  ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39708 {
39709 	return zend_post_incdec_property_helper_SPEC_CV_CV(increment_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39710 }
39711 
ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39712 static int ZEND_FASTCALL  ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39713 {
39714 	return zend_post_incdec_property_helper_SPEC_CV_CV(decrement_function, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39715 }
39716 
ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39717 static int ZEND_FASTCALL  ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39718 {
39719 	USE_OPLINE
39720 
39721 	zval *container;
39722 
39723 	SAVE_OPLINE();
39724 
39725 	if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
39726 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
39727 	}
39728 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
39729 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
39730 
39731 
39732 	CHECK_EXCEPTION();
39733 	ZEND_VM_NEXT_OPCODE();
39734 }
39735 
ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39736 static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39737 {
39738 	USE_OPLINE
39739 	zend_free_op free_op1;
39740 	zval **container;
39741 
39742 	SAVE_OPLINE();
39743 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
39744 
39745 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39746 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
39747 	}
39748 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
39749 
39750 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39751 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39752 	}
39753 
39754 	/* We are going to assign the result by reference */
39755 	if (UNEXPECTED(opline->extended_value != 0)) {
39756 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
39757 
39758 		if (retval_ptr) {
39759 			Z_DELREF_PP(retval_ptr);
39760 			SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
39761 			Z_ADDREF_PP(retval_ptr);
39762 		}
39763 	}
39764 
39765 	CHECK_EXCEPTION();
39766 	ZEND_VM_NEXT_OPCODE();
39767 }
39768 
ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39769 static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39770 {
39771 	USE_OPLINE
39772 	zend_free_op free_op1;
39773 	zval **container;
39774 
39775 	SAVE_OPLINE();
39776 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39777 
39778 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39779 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
39780 	}
39781 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_RW TSRMLS_CC);
39782 
39783 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39784 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39785 	}
39786 
39787 	CHECK_EXCEPTION();
39788 	ZEND_VM_NEXT_OPCODE();
39789 }
39790 
ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39791 static int ZEND_FASTCALL  ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39792 {
39793 	USE_OPLINE
39794 
39795 	zval *container;
39796 
39797 	SAVE_OPLINE();
39798 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
39799 	zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_IS TSRMLS_CC);
39800 
39801 
39802 	CHECK_EXCEPTION();
39803 	ZEND_VM_NEXT_OPCODE();
39804 }
39805 
ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39806 static int ZEND_FASTCALL  ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39807 {
39808 	USE_OPLINE
39809 	zend_free_op free_op1;
39810 
39811 	SAVE_OPLINE();
39812 
39813 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
39814 		zval **container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
39815 
39816 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39817 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
39818 		}
39819 		zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_W TSRMLS_CC);
39820 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39821 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39822 		}
39823 
39824 
39825 	} else {
39826 		zval *container;
39827 
39828 		if (IS_CV == IS_UNUSED) {
39829 			zend_error_noreturn(E_ERROR, "Cannot use [] for reading");
39830 		}
39831 		container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
39832 		zend_fetch_dimension_address_read(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_R TSRMLS_CC);
39833 
39834 
39835 	}
39836 	CHECK_EXCEPTION();
39837 	ZEND_VM_NEXT_OPCODE();
39838 }
39839 
ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39840 static int ZEND_FASTCALL  ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39841 {
39842 	USE_OPLINE
39843 	zend_free_op free_op1;
39844 	zval **container;
39845 
39846 	SAVE_OPLINE();
39847 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
39848 
39849 	if (IS_CV == IS_CV) {
39850 		if (container != &EG(uninitialized_zval_ptr)) {
39851 			SEPARATE_ZVAL_IF_NOT_REF(container);
39852 		}
39853 	}
39854 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39855 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
39856 	}
39857 	zend_fetch_dimension_address(&EX_T(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC), IS_CV, BP_VAR_UNSET TSRMLS_CC);
39858 
39859 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39860 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39861 	}
39862 
39863 	if (UNEXPECTED(EX_T(opline->result.var).var.ptr_ptr == NULL)) {
39864 		zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
39865 		ZEND_VM_NEXT_OPCODE();
39866 	} else {
39867 		zend_free_op free_res;
39868 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
39869 
39870 		PZVAL_UNLOCK(*retval_ptr, &free_res);
39871 		if (retval_ptr != &EG(uninitialized_zval_ptr)) {
39872 			SEPARATE_ZVAL_IF_NOT_REF(retval_ptr);
39873 		}
39874 		PZVAL_LOCK(*retval_ptr);
39875 		FREE_OP_VAR_PTR(free_res);
39876 		CHECK_EXCEPTION();
39877 		ZEND_VM_NEXT_OPCODE();
39878 	}
39879 }
39880 
zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS)39881 static int ZEND_FASTCALL zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS)
39882 {
39883 	USE_OPLINE
39884 
39885 	zval *container;
39886 
39887 	zval *offset;
39888 
39889 	SAVE_OPLINE();
39890 	container = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
39891 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39892 
39893 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
39894 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
39895 		zend_error(E_NOTICE, "Trying to get property of non-object");
39896 		PZVAL_LOCK(&EG(uninitialized_zval));
39897 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
39898 
39899 	} else {
39900 		zval *retval;
39901 
39902 		if (0) {
39903 			MAKE_REAL_ZVAL_PTR(offset);
39904 		}
39905 
39906 		/* here we are sure we are dealing with an object */
39907 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
39908 
39909 		PZVAL_LOCK(retval);
39910 		AI_SET_PTR(&EX_T(opline->result.var), retval);
39911 
39912 		if (0) {
39913 			zval_ptr_dtor(&offset);
39914 		} else {
39915 
39916 		}
39917 	}
39918 
39919 	CHECK_EXCEPTION();
39920 	ZEND_VM_NEXT_OPCODE();
39921 }
39922 
ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39923 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39924 {
39925 	return zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
39926 }
39927 
ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39928 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39929 {
39930 	USE_OPLINE
39931 	zend_free_op free_op1;
39932 	zval *property;
39933 	zval **container;
39934 
39935 	SAVE_OPLINE();
39936 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39937 
39938 	if (0) {
39939 		MAKE_REAL_ZVAL_PTR(property);
39940 	}
39941 	container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
39942 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39943 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
39944 	}
39945 
39946 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
39947 	if (0) {
39948 		zval_ptr_dtor(&property);
39949 	} else {
39950 
39951 	}
39952 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39953 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39954 	}
39955 
39956 	/* We are going to assign the result by reference */
39957 	if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
39958 		zval **retval_ptr = EX_T(opline->result.var).var.ptr_ptr;
39959 
39960 		Z_DELREF_PP(retval_ptr);
39961 		SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
39962 		Z_ADDREF_PP(retval_ptr);
39963 		EX_T(opline->result.var).var.ptr = *EX_T(opline->result.var).var.ptr_ptr;
39964 		EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
39965 	}
39966 
39967 	CHECK_EXCEPTION();
39968 	ZEND_VM_NEXT_OPCODE();
39969 }
39970 
ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)39971 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
39972 {
39973 	USE_OPLINE
39974 	zend_free_op free_op1;
39975 	zval *property;
39976 	zval **container;
39977 
39978 	SAVE_OPLINE();
39979 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
39980 	container = _get_zval_ptr_ptr_cv_BP_VAR_RW(execute_data, opline->op1.var TSRMLS_CC);
39981 
39982 	if (0) {
39983 		MAKE_REAL_ZVAL_PTR(property);
39984 	}
39985 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
39986 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
39987 	}
39988 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_RW TSRMLS_CC);
39989 	if (0) {
39990 		zval_ptr_dtor(&property);
39991 	} else {
39992 
39993 	}
39994 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
39995 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
39996 	}
39997 
39998 	CHECK_EXCEPTION();
39999 	ZEND_VM_NEXT_OPCODE();
40000 }
40001 
ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40002 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40003 {
40004 	USE_OPLINE
40005 
40006 	zval *container;
40007 
40008 	zval *offset;
40009 
40010 	SAVE_OPLINE();
40011 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
40012 	offset  = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40013 
40014 	if (UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT) ||
40015 	    UNEXPECTED(Z_OBJ_HT_P(container)->read_property == NULL)) {
40016 		PZVAL_LOCK(&EG(uninitialized_zval));
40017 		AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
40018 
40019 	} else {
40020 		zval *retval;
40021 
40022 		if (0) {
40023 			MAKE_REAL_ZVAL_PTR(offset);
40024 		}
40025 
40026 		/* here we are sure we are dealing with an object */
40027 		retval = Z_OBJ_HT_P(container)->read_property(container, offset, BP_VAR_IS, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
40028 
40029 		PZVAL_LOCK(retval);
40030 		AI_SET_PTR(&EX_T(opline->result.var), retval);
40031 
40032 		if (0) {
40033 			zval_ptr_dtor(&offset);
40034 		} else {
40035 
40036 		}
40037 	}
40038 
40039 	CHECK_EXCEPTION();
40040 	ZEND_VM_NEXT_OPCODE();
40041 }
40042 
ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40043 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40044 {
40045 	USE_OPLINE
40046 
40047 	if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, (opline->extended_value & ZEND_FETCH_ARG_MASK))) {
40048 		/* Behave like FETCH_OBJ_W */
40049 		zend_free_op free_op1;
40050 		zval *property;
40051 		zval **container;
40052 
40053 		SAVE_OPLINE();
40054 		property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40055 		container = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40056 
40057 		if (0) {
40058 			MAKE_REAL_ZVAL_PTR(property);
40059 		}
40060 		if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
40061 			zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
40062 		}
40063 		zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_W TSRMLS_CC);
40064 		if (0) {
40065 			zval_ptr_dtor(&property);
40066 		} else {
40067 
40068 		}
40069 		if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
40070 			EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
40071 		}
40072 
40073 		CHECK_EXCEPTION();
40074 		ZEND_VM_NEXT_OPCODE();
40075 	} else {
40076 		return zend_fetch_property_address_read_helper_SPEC_CV_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40077 	}
40078 }
40079 
ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40080 static int ZEND_FASTCALL  ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40081 {
40082 	USE_OPLINE
40083 	zend_free_op free_op1, free_res;
40084 	zval **container;
40085 	zval *property;
40086 
40087 	SAVE_OPLINE();
40088 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
40089 	property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40090 
40091 	if (IS_CV == IS_CV) {
40092 		if (container != &EG(uninitialized_zval_ptr)) {
40093 			SEPARATE_ZVAL_IF_NOT_REF(container);
40094 		}
40095 	}
40096 	if (0) {
40097 		MAKE_REAL_ZVAL_PTR(property);
40098 	}
40099 	if (IS_CV == IS_VAR && UNEXPECTED(container == NULL)) {
40100 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
40101 	}
40102 	zend_fetch_property_address(&EX_T(opline->result.var), container, property, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL), BP_VAR_UNSET TSRMLS_CC);
40103 	if (0) {
40104 		zval_ptr_dtor(&property);
40105 	} else {
40106 
40107 	}
40108 	if (IS_CV == IS_VAR && 0 && READY_TO_DESTROY(free_op1.var)) {
40109 		EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
40110 	}
40111 
40112 	PZVAL_UNLOCK(*EX_T(opline->result.var).var.ptr_ptr, &free_res);
40113 	if (EX_T(opline->result.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
40114 		SEPARATE_ZVAL_IF_NOT_REF(EX_T(opline->result.var).var.ptr_ptr);
40115 	}
40116 	PZVAL_LOCK(*EX_T(opline->result.var).var.ptr_ptr);
40117 	FREE_OP_VAR_PTR(free_res);
40118 	CHECK_EXCEPTION();
40119 	ZEND_VM_NEXT_OPCODE();
40120 }
40121 
ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40122 static int ZEND_FASTCALL  ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40123 {
40124 	USE_OPLINE
40125 
40126 	zval **object_ptr;
40127 	zval *property_name;
40128 
40129 	SAVE_OPLINE();
40130 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40131 	property_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40132 
40133 	if (0) {
40134 		MAKE_REAL_ZVAL_PTR(property_name);
40135 	}
40136 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
40137 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
40138 	}
40139 	zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_OBJ, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
40140 	if (0) {
40141 		zval_ptr_dtor(&property_name);
40142 	} else {
40143 
40144 	}
40145 
40146 	/* assign_obj has two opcodes! */
40147 	CHECK_EXCEPTION();
40148 	ZEND_VM_INC_OPCODE();
40149 	ZEND_VM_NEXT_OPCODE();
40150 }
40151 
ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40152 static int ZEND_FASTCALL  ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40153 {
40154 	USE_OPLINE
40155 
40156 	zval **object_ptr;
40157 
40158 	SAVE_OPLINE();
40159 	object_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40160 
40161 	if (IS_CV == IS_VAR && UNEXPECTED(object_ptr == NULL)) {
40162 		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
40163 	}
40164 	if (Z_TYPE_PP(object_ptr) == IS_OBJECT) {
40165 
40166 		zval *property_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40167 
40168 		if (0) {
40169 			MAKE_REAL_ZVAL_PTR(property_name);
40170 		}
40171 		zend_assign_to_object(RETURN_VALUE_USED(opline)?&EX_T(opline->result.var).var.ptr:NULL, object_ptr, property_name, (opline+1)->op1_type, &(opline+1)->op1, execute_data, ZEND_ASSIGN_DIM, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
40172 		if (0) {
40173 			zval_ptr_dtor(&property_name);
40174 		} else {
40175 
40176 		}
40177 	} else {
40178 		zend_free_op free_op_data1, free_op_data2;
40179 		zval *value;
40180 		zval *dim = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40181 		zval **variable_ptr_ptr;
40182 
40183 		zend_fetch_dimension_address(&EX_T((opline+1)->op2.var), object_ptr, dim, IS_CV, BP_VAR_W TSRMLS_CC);
40184 
40185 		value = get_zval_ptr((opline+1)->op1_type, &(opline+1)->op1, execute_data, &free_op_data1, BP_VAR_R);
40186 		variable_ptr_ptr = _get_zval_ptr_ptr_var((opline+1)->op2.var, execute_data, &free_op_data2 TSRMLS_CC);
40187 		if (UNEXPECTED(variable_ptr_ptr == NULL)) {
40188 			if (zend_assign_to_string_offset(&EX_T((opline+1)->op2.var), value, (opline+1)->op1_type TSRMLS_CC)) {
40189 				if (RETURN_VALUE_USED(opline)) {
40190 					zval *retval;
40191 
40192 					ALLOC_ZVAL(retval);
40193 					ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T((opline+1)->op2.var).str_offset.str)+EX_T((opline+1)->op2.var).str_offset.offset, 1, 1);
40194 					INIT_PZVAL(retval);
40195 					AI_SET_PTR(&EX_T(opline->result.var), retval);
40196 				}
40197 			} else if (RETURN_VALUE_USED(opline)) {
40198 				PZVAL_LOCK(&EG(uninitialized_zval));
40199 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
40200 			}
40201 		} else if (UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
40202 			if (IS_TMP_FREE(free_op_data1)) {
40203 				zval_dtor(value);
40204 			}
40205 			if (RETURN_VALUE_USED(opline)) {
40206 				PZVAL_LOCK(&EG(uninitialized_zval));
40207 				AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
40208 			}
40209 		} else {
40210 			if ((opline+1)->op1_type == IS_TMP_VAR) {
40211 			 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40212 			} else if ((opline+1)->op1_type == IS_CONST) {
40213 			 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40214 			} else {
40215 			 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40216 			}
40217 			if (RETURN_VALUE_USED(opline)) {
40218 				PZVAL_LOCK(value);
40219 				AI_SET_PTR(&EX_T(opline->result.var), value);
40220 			}
40221 		}
40222 		FREE_OP_VAR_PTR(free_op_data2);
40223 	 	FREE_OP_IF_VAR(free_op_data1);
40224 	}
40225 
40226 	/* assign_dim has two opcodes! */
40227 	CHECK_EXCEPTION();
40228 	ZEND_VM_INC_OPCODE();
40229 	ZEND_VM_NEXT_OPCODE();
40230 }
40231 
ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40232 static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40233 {
40234 	USE_OPLINE
40235 
40236 	zval *value;
40237 	zval **variable_ptr_ptr;
40238 
40239 	SAVE_OPLINE();
40240 	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40241 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40242 
40243 	if (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL)) {
40244 		if (zend_assign_to_string_offset(&EX_T(opline->op1.var), value, IS_CV TSRMLS_CC)) {
40245 			if (RETURN_VALUE_USED(opline)) {
40246 				zval *retval;
40247 
40248 				ALLOC_ZVAL(retval);
40249 				ZVAL_STRINGL(retval, Z_STRVAL_P(EX_T(opline->op1.var).str_offset.str)+EX_T(opline->op1.var).str_offset.offset, 1, 1);
40250 				INIT_PZVAL(retval);
40251 				AI_SET_PTR(&EX_T(opline->result.var), retval);
40252 			}
40253 		} else if (RETURN_VALUE_USED(opline)) {
40254 			PZVAL_LOCK(&EG(uninitialized_zval));
40255 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
40256 		}
40257 	} else if (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval))) {
40258 		if (0) {
40259 			zval_dtor(value);
40260 		}
40261 		if (RETURN_VALUE_USED(opline)) {
40262 			PZVAL_LOCK(&EG(uninitialized_zval));
40263 			AI_SET_PTR(&EX_T(opline->result.var), &EG(uninitialized_zval));
40264 		}
40265 	} else {
40266 		if (IS_CV == IS_TMP_VAR) {
40267 		 	value = zend_assign_tmp_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40268 		} else if (IS_CV == IS_CONST) {
40269 		 	value = zend_assign_const_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40270 		} else {
40271 		 	value = zend_assign_to_variable(variable_ptr_ptr, value TSRMLS_CC);
40272 		}
40273 		if (RETURN_VALUE_USED(opline)) {
40274 			PZVAL_LOCK(value);
40275 			AI_SET_PTR(&EX_T(opline->result.var), value);
40276 		}
40277 	}
40278 
40279 	if (IS_CV == IS_VAR && 0) {
40280 		zval_ptr_dtor(&value);
40281 	}
40282 
40283 	/* zend_assign_to_variable() always takes care of op2, never free it! */
40284 
40285 	CHECK_EXCEPTION();
40286 	ZEND_VM_NEXT_OPCODE();
40287 }
40288 
ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40289 static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40290 {
40291 	USE_OPLINE
40292 	zend_free_op free_op2;
40293 	zval **variable_ptr_ptr;
40294 	zval **value_ptr_ptr;
40295 
40296 	SAVE_OPLINE();
40297 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);
40298 
40299 	if (IS_CV == IS_VAR &&
40300 	    value_ptr_ptr &&
40301 	    !Z_ISREF_PP(value_ptr_ptr) &&
40302 	    opline->extended_value == ZEND_RETURNS_FUNCTION &&
40303 	    !EX_T(opline->op2.var).var.fcall_returned_reference) {
40304 		if (free_op2.var == NULL) {
40305 			PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
40306 		}
40307 		zend_error(E_STRICT, "Only variables should be assigned by reference");
40308 		if (UNEXPECTED(EG(exception) != NULL)) {
40309 
40310 			HANDLE_EXCEPTION();
40311 		}
40312 		return ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40313 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
40314 		PZVAL_LOCK(*value_ptr_ptr);
40315 	}
40316 	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
40317 		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
40318 	}
40319 
40320 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40321 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
40322 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
40323 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
40324 	}
40325 	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
40326 
40327 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
40328 		Z_DELREF_PP(variable_ptr_ptr);
40329 	}
40330 
40331 	if (RETURN_VALUE_USED(opline)) {
40332 		PZVAL_LOCK(*variable_ptr_ptr);
40333 		AI_SET_PTR(&EX_T(opline->result.var), *variable_ptr_ptr);
40334 	}
40335 
40336 
40337 	CHECK_EXCEPTION();
40338 	ZEND_VM_NEXT_OPCODE();
40339 }
40340 
ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40341 static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40342 {
40343 	USE_OPLINE
40344 	zval *function_name;
40345 	char *function_name_strval;
40346 	int function_name_strlen;
40347 
40348 	call_slot *call = EX(call_slots) + opline->result.num;
40349 
40350 	SAVE_OPLINE();
40351 
40352 	function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40353 
40354 	if (IS_CV != IS_CONST &&
40355 	    UNEXPECTED(Z_TYPE_P(function_name) != IS_STRING)) {
40356 		if (UNEXPECTED(EG(exception) != NULL)) {
40357 			HANDLE_EXCEPTION();
40358 		}
40359 		zend_error_noreturn(E_ERROR, "Method name must be a string");
40360 	}
40361 
40362 	function_name_strval = Z_STRVAL_P(function_name);
40363 	function_name_strlen = Z_STRLEN_P(function_name);
40364 
40365 	call->object = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
40366 
40367 	if (EXPECTED(call->object != NULL) &&
40368 	    EXPECTED(Z_TYPE_P(call->object) == IS_OBJECT)) {
40369 		call->called_scope = Z_OBJCE_P(call->object);
40370 
40371 		if (IS_CV != IS_CONST ||
40372 		    (call->fbc = CACHED_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope)) == NULL) {
40373 		    zval *object = call->object;
40374 
40375 			if (UNEXPECTED(Z_OBJ_HT_P(call->object)->get_method == NULL)) {
40376 				zend_error_noreturn(E_ERROR, "Object does not support method calls");
40377 			}
40378 
40379 			/* First, locate the function. */
40380 			call->fbc = Z_OBJ_HT_P(call->object)->get_method(&call->object, function_name_strval, function_name_strlen, ((IS_CV == IS_CONST) ? (opline->op2.literal + 1) : NULL) TSRMLS_CC);
40381 			if (UNEXPECTED(call->fbc == NULL)) {
40382 				zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(call->object), function_name_strval);
40383 			}
40384 			if (IS_CV == IS_CONST &&
40385 			    EXPECTED(call->fbc->type <= ZEND_USER_FUNCTION) &&
40386 			    EXPECTED((call->fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_NEVER_CACHE)) == 0) &&
40387 			    EXPECTED(call->object == object)) {
40388 				CACHE_POLYMORPHIC_PTR(opline->op2.literal->cache_slot, call->called_scope, call->fbc);
40389 			}
40390 		}
40391 	} else {
40392 		if (UNEXPECTED(EG(exception) != NULL)) {
40393 
40394 			HANDLE_EXCEPTION();
40395 		}
40396 		zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
40397 	}
40398 
40399 	if ((call->fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
40400 		call->object = NULL;
40401 	} else {
40402 		if (!PZVAL_IS_REF(call->object)) {
40403 			Z_ADDREF_P(call->object); /* For $this pointer */
40404 		} else {
40405 			zval *this_ptr;
40406 			ALLOC_ZVAL(this_ptr);
40407 			INIT_PZVAL_COPY(this_ptr, call->object);
40408 			zval_copy_ctor(this_ptr);
40409 			call->object = this_ptr;
40410 		}
40411 	}
40412 	call->is_ctor_call = 0;
40413 	EX(call) = call;
40414 
40415 
40416 	CHECK_EXCEPTION();
40417 	ZEND_VM_NEXT_OPCODE();
40418 }
40419 
ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40420 static int ZEND_FASTCALL  ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40421 {
40422 	USE_OPLINE
40423 
40424 
40425 	SAVE_OPLINE();
40426 	if (IS_CV==IS_VAR) {
40427 		PZVAL_LOCK(EX_T(opline->op1.var).var.ptr);
40428 	}
40429 	is_equal_function(&EX_T(opline->result.var).tmp_var,
40430 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC),
40431 				 _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC) TSRMLS_CC);
40432 
40433 	CHECK_EXCEPTION();
40434 	ZEND_VM_NEXT_OPCODE();
40435 }
40436 
ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40437 static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40438 {
40439 	USE_OPLINE
40440 
40441 	zval *expr_ptr;
40442 
40443 	SAVE_OPLINE();
40444 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
40445 		zval **expr_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40446 
40447 		if (IS_CV == IS_VAR && UNEXPECTED(expr_ptr_ptr == NULL)) {
40448 			zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets");
40449 		}
40450 		SEPARATE_ZVAL_TO_MAKE_IS_REF(expr_ptr_ptr);
40451 		expr_ptr = *expr_ptr_ptr;
40452 		Z_ADDREF_P(expr_ptr);
40453 	} else {
40454 		expr_ptr=_get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
40455 		if (0) { /* temporary variable */
40456 			zval *new_expr;
40457 
40458 			ALLOC_ZVAL(new_expr);
40459 			INIT_PZVAL_COPY(new_expr, expr_ptr);
40460 			expr_ptr = new_expr;
40461 		} else if (IS_CV == IS_CONST || PZVAL_IS_REF(expr_ptr)) {
40462 			zval *new_expr;
40463 
40464 			ALLOC_ZVAL(new_expr);
40465 			INIT_PZVAL_COPY(new_expr, expr_ptr);
40466 			expr_ptr = new_expr;
40467 			zendi_zval_copy_ctor(*expr_ptr);
40468 		} else {
40469 			Z_ADDREF_P(expr_ptr);
40470 		}
40471 	}
40472 
40473 	if (IS_CV != IS_UNUSED) {
40474 
40475 		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40476 		ulong hval;
40477 
40478 		switch (Z_TYPE_P(offset)) {
40479 			case IS_DOUBLE:
40480 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
40481 				goto num_index;
40482 			case IS_LONG:
40483 			case IS_BOOL:
40484 				hval = Z_LVAL_P(offset);
40485 num_index:
40486 				zend_hash_index_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), hval, &expr_ptr, sizeof(zval *), NULL);
40487 				break;
40488 			case IS_STRING:
40489 				if (IS_CV == IS_CONST) {
40490 					hval = Z_HASH_P(offset);
40491 				} else {
40492 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index);
40493 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
40494 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
40495 					} else {
40496 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
40497 					}
40498 				}
40499 				zend_hash_quick_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, &expr_ptr, sizeof(zval *), NULL);
40500 				break;
40501 			case IS_NULL:
40502 				zend_hash_update(Z_ARRVAL(EX_T(opline->result.var).tmp_var), "", sizeof(""), &expr_ptr, sizeof(zval *), NULL);
40503 				break;
40504 			default:
40505 				zend_error(E_WARNING, "Illegal offset type");
40506 				zval_ptr_dtor(&expr_ptr);
40507 				/* do nothing */
40508 				break;
40509 		}
40510 
40511 	} else {
40512 		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
40513 	}
40514 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
40515 
40516 	} else {
40517 
40518 	}
40519 	CHECK_EXCEPTION();
40520 	ZEND_VM_NEXT_OPCODE();
40521 }
40522 
ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40523 static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40524 {
40525 	USE_OPLINE
40526 
40527 	array_init(&EX_T(opline->result.var).tmp_var);
40528 	if (IS_CV == IS_UNUSED) {
40529 		ZEND_VM_NEXT_OPCODE();
40530 #if 0 || IS_CV != IS_UNUSED
40531 	} else {
40532 		return ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40533 #endif
40534 	}
40535 }
40536 
ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40537 static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40538 {
40539 	USE_OPLINE
40540 
40541 	zval **container;
40542 	zval *offset;
40543 	ulong hval;
40544 
40545 	SAVE_OPLINE();
40546 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
40547 	if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
40548 		SEPARATE_ZVAL_IF_NOT_REF(container);
40549 	}
40550 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40551 
40552 	if (IS_CV != IS_VAR || container) {
40553 		switch (Z_TYPE_PP(container)) {
40554 			case IS_ARRAY: {
40555 				HashTable *ht = Z_ARRVAL_PP(container);
40556 
40557 				switch (Z_TYPE_P(offset)) {
40558 					case IS_DOUBLE:
40559 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
40560 						zend_hash_index_del(ht, hval);
40561 						break;
40562 					case IS_RESOURCE:
40563 					case IS_BOOL:
40564 					case IS_LONG:
40565 						hval = Z_LVAL_P(offset);
40566 						zend_hash_index_del(ht, hval);
40567 						break;
40568 					case IS_STRING:
40569 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
40570 							Z_ADDREF_P(offset);
40571 						}
40572 						if (IS_CV == IS_CONST) {
40573 							hval = Z_HASH_P(offset);
40574 						} else {
40575 							ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_dim);
40576 							if (IS_INTERNED(Z_STRVAL_P(offset))) {
40577 								hval = INTERNED_HASH(Z_STRVAL_P(offset));
40578 							} else {
40579 								hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
40580 							}
40581 						}
40582 						if (ht == &EG(symbol_table)) {
40583 							zend_delete_global_variable_ex(offset->value.str.val, offset->value.str.len, hval TSRMLS_CC);
40584 						} else {
40585 							zend_hash_quick_del(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval);
40586 						}
40587 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
40588 							zval_ptr_dtor(&offset);
40589 						}
40590 						break;
40591 num_index_dim:
40592 						zend_hash_index_del(ht, hval);
40593 						if (IS_CV == IS_CV || IS_CV == IS_VAR) {
40594 							zval_ptr_dtor(&offset);
40595 						}
40596 						break;
40597 					case IS_NULL:
40598 						zend_hash_del(ht, "", sizeof(""));
40599 						break;
40600 					default:
40601 						zend_error(E_WARNING, "Illegal offset type in unset");
40602 						break;
40603 				}
40604 
40605 				break;
40606 			}
40607 			case IS_OBJECT:
40608 				if (UNEXPECTED(Z_OBJ_HT_P(*container)->unset_dimension == NULL)) {
40609 					zend_error_noreturn(E_ERROR, "Cannot use object as array");
40610 				}
40611 				if (0) {
40612 					MAKE_REAL_ZVAL_PTR(offset);
40613 				}
40614 				Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC);
40615 				if (0) {
40616 					zval_ptr_dtor(&offset);
40617 				} else {
40618 
40619 				}
40620 				break;
40621 			case IS_STRING:
40622 				zend_error_noreturn(E_ERROR, "Cannot unset string offsets");
40623 				ZEND_VM_CONTINUE(); /* bailed out before */
40624 			default:
40625 
40626 				break;
40627 		}
40628 	} else {
40629 
40630 	}
40631 
40632 	CHECK_EXCEPTION();
40633 	ZEND_VM_NEXT_OPCODE();
40634 }
40635 
ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40636 static int ZEND_FASTCALL  ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40637 {
40638 	USE_OPLINE
40639 
40640 	zval **container;
40641 	zval *offset;
40642 
40643 	SAVE_OPLINE();
40644 	container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC);
40645 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40646 
40647 	if (IS_CV != IS_VAR || container) {
40648 		if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
40649 			SEPARATE_ZVAL_IF_NOT_REF(container);
40650 		}
40651 		if (Z_TYPE_PP(container) == IS_OBJECT) {
40652 			if (0) {
40653 				MAKE_REAL_ZVAL_PTR(offset);
40654 			}
40655 			if (Z_OBJ_HT_P(*container)->unset_property) {
40656 				Z_OBJ_HT_P(*container)->unset_property(*container, offset, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
40657 			} else {
40658 				zend_error(E_NOTICE, "Trying to unset property of non-object");
40659 			}
40660 			if (0) {
40661 				zval_ptr_dtor(&offset);
40662 			} else {
40663 
40664 			}
40665 		} else {
40666 
40667 		}
40668 	} else {
40669 
40670 	}
40671 
40672 	CHECK_EXCEPTION();
40673 	ZEND_VM_NEXT_OPCODE();
40674 }
40675 
zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(int prop_dim,ZEND_OPCODE_HANDLER_ARGS)40676 static int ZEND_FASTCALL zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(int prop_dim, ZEND_OPCODE_HANDLER_ARGS)
40677 {
40678 	USE_OPLINE
40679 
40680 	zval *container;
40681 	zval **value = NULL;
40682 	int result = 0;
40683 	ulong hval;
40684 	zval *offset;
40685 
40686 	SAVE_OPLINE();
40687 	container = _get_zval_ptr_cv_BP_VAR_IS(execute_data, opline->op1.var TSRMLS_CC);
40688 
40689 	offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40690 
40691 	if (Z_TYPE_P(container) == IS_ARRAY && !prop_dim) {
40692 		HashTable *ht;
40693 		int isset = 0;
40694 
40695 		ht = Z_ARRVAL_P(container);
40696 
40697 		switch (Z_TYPE_P(offset)) {
40698 			case IS_DOUBLE:
40699 				hval = zend_dval_to_lval(Z_DVAL_P(offset));
40700 				goto num_index_prop;
40701 			case IS_RESOURCE:
40702 			case IS_BOOL:
40703 			case IS_LONG:
40704 				hval = Z_LVAL_P(offset);
40705 num_index_prop:
40706 				if (zend_hash_index_find(ht, hval, (void **) &value) == SUCCESS) {
40707 					isset = 1;
40708 				}
40709 				break;
40710 			case IS_STRING:
40711 				if (IS_CV == IS_CONST) {
40712 					hval = Z_HASH_P(offset);
40713 				} else {
40714 					ZEND_HANDLE_NUMERIC_EX(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, goto num_index_prop);
40715 					if (IS_INTERNED(Z_STRVAL_P(offset))) {
40716 						hval = INTERNED_HASH(Z_STRVAL_P(offset));
40717 					} else {
40718 						hval = zend_hash_func(Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1);
40719 					}
40720 				}
40721 				if (zend_hash_quick_find(ht, Z_STRVAL_P(offset), Z_STRLEN_P(offset)+1, hval, (void **) &value) == SUCCESS) {
40722 					isset = 1;
40723 				}
40724 				break;
40725 			case IS_NULL:
40726 				if (zend_hash_find(ht, "", sizeof(""), (void **) &value) == SUCCESS) {
40727 					isset = 1;
40728 				}
40729 				break;
40730 			default:
40731 				zend_error(E_WARNING, "Illegal offset type in isset or empty");
40732 				break;
40733 		}
40734 
40735 		if (opline->extended_value & ZEND_ISSET) {
40736 			if (isset && Z_TYPE_PP(value) == IS_NULL) {
40737 				result = 0;
40738 			} else {
40739 				result = isset;
40740 			}
40741 		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
40742 			if (!isset || !i_zend_is_true(*value)) {
40743 				result = 0;
40744 			} else {
40745 				result = 1;
40746 			}
40747 		}
40748 
40749 	} else if (Z_TYPE_P(container) == IS_OBJECT) {
40750 		if (0) {
40751 			MAKE_REAL_ZVAL_PTR(offset);
40752 		}
40753 		if (prop_dim) {
40754 			if (Z_OBJ_HT_P(container)->has_property) {
40755 				result = Z_OBJ_HT_P(container)->has_property(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
40756 			} else {
40757 				zend_error(E_NOTICE, "Trying to check property of non-object");
40758 				result = 0;
40759 			}
40760 		} else {
40761 			if (Z_OBJ_HT_P(container)->has_dimension) {
40762 				result = Z_OBJ_HT_P(container)->has_dimension(container, offset, (opline->extended_value & ZEND_ISEMPTY) != 0 TSRMLS_CC);
40763 			} else {
40764 				zend_error(E_NOTICE, "Trying to check element of non-array");
40765 				result = 0;
40766 			}
40767 		}
40768 		if (0) {
40769 			zval_ptr_dtor(&offset);
40770 		} else {
40771 
40772 		}
40773 	} else if (Z_TYPE_P(container) == IS_STRING && !prop_dim) { /* string offsets */
40774 		zval tmp;
40775 
40776 		if (Z_TYPE_P(offset) != IS_LONG) {
40777 			if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */
40778 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
40779 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
40780 				ZVAL_COPY_VALUE(&tmp, offset);
40781 				zval_copy_ctor(&tmp);
40782 				convert_to_long(&tmp);
40783 				offset = &tmp;
40784 			} else {
40785 				/* can not be converted to proper offset, return "not set" */
40786 				result = 0;
40787 			}
40788 		}
40789 		if (Z_TYPE_P(offset) == IS_LONG) {
40790 			if (opline->extended_value & ZEND_ISSET) {
40791 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container)) {
40792 					result = 1;
40793 				}
40794 			} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {
40795 				if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_P(container) && Z_STRVAL_P(container)[offset->value.lval] != '0') {
40796 					result = 1;
40797 				}
40798 			}
40799 		}
40800 
40801 	} else {
40802 
40803 	}
40804 
40805 	Z_TYPE(EX_T(opline->result.var).tmp_var) = IS_BOOL;
40806 	if (opline->extended_value & ZEND_ISSET) {
40807 		Z_LVAL(EX_T(opline->result.var).tmp_var) = result;
40808 	} else {
40809 		Z_LVAL(EX_T(opline->result.var).tmp_var) = !result;
40810 	}
40811 
40812 	CHECK_EXCEPTION();
40813 	ZEND_VM_NEXT_OPCODE();
40814 }
40815 
ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40816 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40817 {
40818 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(0, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40819 }
40820 
ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40821 static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40822 {
40823 	return zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(1, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
40824 }
40825 
ZEND_YIELD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40826 static int ZEND_FASTCALL  ZEND_YIELD_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40827 {
40828 	USE_OPLINE
40829 
40830 	/* The generator object is stored in return_value_ptr_ptr */
40831 	zend_generator *generator = (zend_generator *) EG(return_value_ptr_ptr);
40832 
40833 	if (generator->flags & ZEND_GENERATOR_FORCED_CLOSE) {
40834 		zend_error_noreturn(E_ERROR, "Cannot yield from finally in a force-closed generator");
40835 	}
40836 
40837 	/* Destroy the previously yielded value */
40838 	if (generator->value) {
40839 		zval_ptr_dtor(&generator->value);
40840 	}
40841 
40842 	/* Destroy the previously yielded key */
40843 	if (generator->key) {
40844 		zval_ptr_dtor(&generator->key);
40845 	}
40846 
40847 	/* Set the new yielded value */
40848 	if (IS_CV != IS_UNUSED) {
40849 
40850 
40851 		if (EX(op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
40852 			/* Constants and temporary variables aren't yieldable by reference,
40853 			 * but we still allow them with a notice. */
40854 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR) {
40855 				zval *value, *copy;
40856 
40857 				zend_error(E_NOTICE, "Only variable references should be yielded by reference");
40858 
40859 				value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
40860 				ALLOC_ZVAL(copy);
40861 				INIT_PZVAL_COPY(copy, value);
40862 
40863 				/* Temporary variables don't need ctor copying */
40864 				if (!0) {
40865 					zval_copy_ctor(copy);
40866 				}
40867 
40868 				generator->value = copy;
40869 			} else {
40870 				zval **value_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
40871 
40872 				if (IS_CV == IS_VAR && UNEXPECTED(value_ptr == NULL)) {
40873 					zend_error_noreturn(E_ERROR, "Cannot yield string offsets by reference");
40874 				}
40875 
40876 				/* If a function call result is yielded and the function did
40877 				 * not return by reference we throw a notice. */
40878 				if (IS_CV == IS_VAR && !Z_ISREF_PP(value_ptr)
40879 				    && !(opline->extended_value == ZEND_RETURNS_FUNCTION
40880 				         && EX_T(opline->op1.var).var.fcall_returned_reference)
40881 				    && EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr) {
40882 					zend_error(E_NOTICE, "Only variable references should be yielded by reference");
40883 
40884 					Z_ADDREF_PP(value_ptr);
40885 					generator->value = *value_ptr;
40886 				} else {
40887 					SEPARATE_ZVAL_TO_MAKE_IS_REF(value_ptr);
40888 					Z_ADDREF_PP(value_ptr);
40889 					generator->value = *value_ptr;
40890 				}
40891 
40892 			}
40893 		} else {
40894 			zval *value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
40895 
40896 			/* Consts, temporary variables and references need copying */
40897 			if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
40898 				|| (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0)
40899 			) {
40900 				zval *copy;
40901 
40902 				ALLOC_ZVAL(copy);
40903 				INIT_PZVAL_COPY(copy, value);
40904 
40905 				/* Temporary variables don't need ctor copying */
40906 				if (!0) {
40907 					zval_copy_ctor(copy);
40908 				}
40909 
40910 				generator->value = copy;
40911 			} else {
40912 				Z_ADDREF_P(value);
40913 				generator->value = value;
40914 			}
40915 
40916 		}
40917 	} else {
40918 		/* If no value was specified yield null */
40919 		Z_ADDREF(EG(uninitialized_zval));
40920 		generator->value = &EG(uninitialized_zval);
40921 	}
40922 
40923 	/* Set the new yielded key */
40924 	if (IS_CV != IS_UNUSED) {
40925 
40926 		zval *key = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
40927 
40928 		/* Consts, temporary variables and references need copying */
40929 		if (IS_CV == IS_CONST || IS_CV == IS_TMP_VAR
40930 			|| (PZVAL_IS_REF(key) && Z_REFCOUNT_P(key) > 0)
40931 		) {
40932 			zval *copy;
40933 
40934 			ALLOC_ZVAL(copy);
40935 			INIT_PZVAL_COPY(copy, key);
40936 
40937 			/* Temporary variables don't need ctor copying */
40938 			if (!0) {
40939 				zval_copy_ctor(copy);
40940 			}
40941 
40942 			generator->key = copy;
40943 		} else {
40944 			Z_ADDREF_P(key);
40945 			generator->key = key;
40946 		}
40947 
40948 		if (Z_TYPE_P(generator->key) == IS_LONG
40949 		    && Z_LVAL_P(generator->key) > generator->largest_used_integer_key
40950 		) {
40951 			generator->largest_used_integer_key = Z_LVAL_P(generator->key);
40952 		}
40953 
40954 	} else {
40955 		/* If no key was specified we use auto-increment keys */
40956 		generator->largest_used_integer_key++;
40957 
40958 		ALLOC_INIT_ZVAL(generator->key);
40959 		ZVAL_LONG(generator->key, generator->largest_used_integer_key);
40960 	}
40961 
40962 	if (RETURN_VALUE_USED(opline)) {
40963 		/* If the return value of yield is used set the send
40964 		 * target and initialize it to NULL */
40965 		generator->send_target = &EX_T(opline->result.var).var.ptr;
40966 		Z_ADDREF(EG(uninitialized_zval));
40967 		EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
40968 	} else {
40969 		generator->send_target = NULL;
40970 	}
40971 
40972 	/* We increment to the next op, so we are at the correct position when the
40973 	 * generator is resumed. */
40974 	ZEND_VM_INC_OPCODE();
40975 
40976 	/* The GOTO VM uses a local opline variable. We need to set the opline
40977 	 * variable in execute_data so we don't resume at an old position. */
40978 	SAVE_OPLINE();
40979 
40980 	ZEND_VM_RETURN();
40981 }
40982 
ZEND_NULL_HANDLER(ZEND_OPCODE_HANDLER_ARGS)40983 static int ZEND_FASTCALL ZEND_NULL_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
40984 {
40985 	zend_error_noreturn(E_ERROR, "Invalid opcode %d/%d/%d.", OPLINE->opcode, OPLINE->op1_type, OPLINE->op2_type);
40986 	ZEND_VM_NEXT_OPCODE(); /* Never reached */
40987 }
40988 
40989 
zend_init_opcodes_handlers(void)40990 void zend_init_opcodes_handlers(void)
40991 {
40992   static const opcode_handler_t labels[] = {
40993   	ZEND_NOP_SPEC_HANDLER,
40994   	ZEND_NOP_SPEC_HANDLER,
40995   	ZEND_NOP_SPEC_HANDLER,
40996   	ZEND_NOP_SPEC_HANDLER,
40997   	ZEND_NOP_SPEC_HANDLER,
40998   	ZEND_NOP_SPEC_HANDLER,
40999   	ZEND_NOP_SPEC_HANDLER,
41000   	ZEND_NOP_SPEC_HANDLER,
41001   	ZEND_NOP_SPEC_HANDLER,
41002   	ZEND_NOP_SPEC_HANDLER,
41003   	ZEND_NOP_SPEC_HANDLER,
41004   	ZEND_NOP_SPEC_HANDLER,
41005   	ZEND_NOP_SPEC_HANDLER,
41006   	ZEND_NOP_SPEC_HANDLER,
41007   	ZEND_NOP_SPEC_HANDLER,
41008   	ZEND_NOP_SPEC_HANDLER,
41009   	ZEND_NOP_SPEC_HANDLER,
41010   	ZEND_NOP_SPEC_HANDLER,
41011   	ZEND_NOP_SPEC_HANDLER,
41012   	ZEND_NOP_SPEC_HANDLER,
41013   	ZEND_NOP_SPEC_HANDLER,
41014   	ZEND_NOP_SPEC_HANDLER,
41015   	ZEND_NOP_SPEC_HANDLER,
41016   	ZEND_NOP_SPEC_HANDLER,
41017   	ZEND_NOP_SPEC_HANDLER,
41018   	ZEND_ADD_SPEC_CONST_CONST_HANDLER,
41019   	ZEND_ADD_SPEC_CONST_TMP_HANDLER,
41020   	ZEND_ADD_SPEC_CONST_VAR_HANDLER,
41021   	ZEND_NULL_HANDLER,
41022   	ZEND_ADD_SPEC_CONST_CV_HANDLER,
41023   	ZEND_ADD_SPEC_TMP_CONST_HANDLER,
41024   	ZEND_ADD_SPEC_TMP_TMP_HANDLER,
41025   	ZEND_ADD_SPEC_TMP_VAR_HANDLER,
41026   	ZEND_NULL_HANDLER,
41027   	ZEND_ADD_SPEC_TMP_CV_HANDLER,
41028   	ZEND_ADD_SPEC_VAR_CONST_HANDLER,
41029   	ZEND_ADD_SPEC_VAR_TMP_HANDLER,
41030   	ZEND_ADD_SPEC_VAR_VAR_HANDLER,
41031   	ZEND_NULL_HANDLER,
41032   	ZEND_ADD_SPEC_VAR_CV_HANDLER,
41033   	ZEND_NULL_HANDLER,
41034   	ZEND_NULL_HANDLER,
41035   	ZEND_NULL_HANDLER,
41036   	ZEND_NULL_HANDLER,
41037   	ZEND_NULL_HANDLER,
41038   	ZEND_ADD_SPEC_CV_CONST_HANDLER,
41039   	ZEND_ADD_SPEC_CV_TMP_HANDLER,
41040   	ZEND_ADD_SPEC_CV_VAR_HANDLER,
41041   	ZEND_NULL_HANDLER,
41042   	ZEND_ADD_SPEC_CV_CV_HANDLER,
41043   	ZEND_SUB_SPEC_CONST_CONST_HANDLER,
41044   	ZEND_SUB_SPEC_CONST_TMP_HANDLER,
41045   	ZEND_SUB_SPEC_CONST_VAR_HANDLER,
41046   	ZEND_NULL_HANDLER,
41047   	ZEND_SUB_SPEC_CONST_CV_HANDLER,
41048   	ZEND_SUB_SPEC_TMP_CONST_HANDLER,
41049   	ZEND_SUB_SPEC_TMP_TMP_HANDLER,
41050   	ZEND_SUB_SPEC_TMP_VAR_HANDLER,
41051   	ZEND_NULL_HANDLER,
41052   	ZEND_SUB_SPEC_TMP_CV_HANDLER,
41053   	ZEND_SUB_SPEC_VAR_CONST_HANDLER,
41054   	ZEND_SUB_SPEC_VAR_TMP_HANDLER,
41055   	ZEND_SUB_SPEC_VAR_VAR_HANDLER,
41056   	ZEND_NULL_HANDLER,
41057   	ZEND_SUB_SPEC_VAR_CV_HANDLER,
41058   	ZEND_NULL_HANDLER,
41059   	ZEND_NULL_HANDLER,
41060   	ZEND_NULL_HANDLER,
41061   	ZEND_NULL_HANDLER,
41062   	ZEND_NULL_HANDLER,
41063   	ZEND_SUB_SPEC_CV_CONST_HANDLER,
41064   	ZEND_SUB_SPEC_CV_TMP_HANDLER,
41065   	ZEND_SUB_SPEC_CV_VAR_HANDLER,
41066   	ZEND_NULL_HANDLER,
41067   	ZEND_SUB_SPEC_CV_CV_HANDLER,
41068   	ZEND_MUL_SPEC_CONST_CONST_HANDLER,
41069   	ZEND_MUL_SPEC_CONST_TMP_HANDLER,
41070   	ZEND_MUL_SPEC_CONST_VAR_HANDLER,
41071   	ZEND_NULL_HANDLER,
41072   	ZEND_MUL_SPEC_CONST_CV_HANDLER,
41073   	ZEND_MUL_SPEC_TMP_CONST_HANDLER,
41074   	ZEND_MUL_SPEC_TMP_TMP_HANDLER,
41075   	ZEND_MUL_SPEC_TMP_VAR_HANDLER,
41076   	ZEND_NULL_HANDLER,
41077   	ZEND_MUL_SPEC_TMP_CV_HANDLER,
41078   	ZEND_MUL_SPEC_VAR_CONST_HANDLER,
41079   	ZEND_MUL_SPEC_VAR_TMP_HANDLER,
41080   	ZEND_MUL_SPEC_VAR_VAR_HANDLER,
41081   	ZEND_NULL_HANDLER,
41082   	ZEND_MUL_SPEC_VAR_CV_HANDLER,
41083   	ZEND_NULL_HANDLER,
41084   	ZEND_NULL_HANDLER,
41085   	ZEND_NULL_HANDLER,
41086   	ZEND_NULL_HANDLER,
41087   	ZEND_NULL_HANDLER,
41088   	ZEND_MUL_SPEC_CV_CONST_HANDLER,
41089   	ZEND_MUL_SPEC_CV_TMP_HANDLER,
41090   	ZEND_MUL_SPEC_CV_VAR_HANDLER,
41091   	ZEND_NULL_HANDLER,
41092   	ZEND_MUL_SPEC_CV_CV_HANDLER,
41093   	ZEND_DIV_SPEC_CONST_CONST_HANDLER,
41094   	ZEND_DIV_SPEC_CONST_TMP_HANDLER,
41095   	ZEND_DIV_SPEC_CONST_VAR_HANDLER,
41096   	ZEND_NULL_HANDLER,
41097   	ZEND_DIV_SPEC_CONST_CV_HANDLER,
41098   	ZEND_DIV_SPEC_TMP_CONST_HANDLER,
41099   	ZEND_DIV_SPEC_TMP_TMP_HANDLER,
41100   	ZEND_DIV_SPEC_TMP_VAR_HANDLER,
41101   	ZEND_NULL_HANDLER,
41102   	ZEND_DIV_SPEC_TMP_CV_HANDLER,
41103   	ZEND_DIV_SPEC_VAR_CONST_HANDLER,
41104   	ZEND_DIV_SPEC_VAR_TMP_HANDLER,
41105   	ZEND_DIV_SPEC_VAR_VAR_HANDLER,
41106   	ZEND_NULL_HANDLER,
41107   	ZEND_DIV_SPEC_VAR_CV_HANDLER,
41108   	ZEND_NULL_HANDLER,
41109   	ZEND_NULL_HANDLER,
41110   	ZEND_NULL_HANDLER,
41111   	ZEND_NULL_HANDLER,
41112   	ZEND_NULL_HANDLER,
41113   	ZEND_DIV_SPEC_CV_CONST_HANDLER,
41114   	ZEND_DIV_SPEC_CV_TMP_HANDLER,
41115   	ZEND_DIV_SPEC_CV_VAR_HANDLER,
41116   	ZEND_NULL_HANDLER,
41117   	ZEND_DIV_SPEC_CV_CV_HANDLER,
41118   	ZEND_MOD_SPEC_CONST_CONST_HANDLER,
41119   	ZEND_MOD_SPEC_CONST_TMP_HANDLER,
41120   	ZEND_MOD_SPEC_CONST_VAR_HANDLER,
41121   	ZEND_NULL_HANDLER,
41122   	ZEND_MOD_SPEC_CONST_CV_HANDLER,
41123   	ZEND_MOD_SPEC_TMP_CONST_HANDLER,
41124   	ZEND_MOD_SPEC_TMP_TMP_HANDLER,
41125   	ZEND_MOD_SPEC_TMP_VAR_HANDLER,
41126   	ZEND_NULL_HANDLER,
41127   	ZEND_MOD_SPEC_TMP_CV_HANDLER,
41128   	ZEND_MOD_SPEC_VAR_CONST_HANDLER,
41129   	ZEND_MOD_SPEC_VAR_TMP_HANDLER,
41130   	ZEND_MOD_SPEC_VAR_VAR_HANDLER,
41131   	ZEND_NULL_HANDLER,
41132   	ZEND_MOD_SPEC_VAR_CV_HANDLER,
41133   	ZEND_NULL_HANDLER,
41134   	ZEND_NULL_HANDLER,
41135   	ZEND_NULL_HANDLER,
41136   	ZEND_NULL_HANDLER,
41137   	ZEND_NULL_HANDLER,
41138   	ZEND_MOD_SPEC_CV_CONST_HANDLER,
41139   	ZEND_MOD_SPEC_CV_TMP_HANDLER,
41140   	ZEND_MOD_SPEC_CV_VAR_HANDLER,
41141   	ZEND_NULL_HANDLER,
41142   	ZEND_MOD_SPEC_CV_CV_HANDLER,
41143   	ZEND_SL_SPEC_CONST_CONST_HANDLER,
41144   	ZEND_SL_SPEC_CONST_TMP_HANDLER,
41145   	ZEND_SL_SPEC_CONST_VAR_HANDLER,
41146   	ZEND_NULL_HANDLER,
41147   	ZEND_SL_SPEC_CONST_CV_HANDLER,
41148   	ZEND_SL_SPEC_TMP_CONST_HANDLER,
41149   	ZEND_SL_SPEC_TMP_TMP_HANDLER,
41150   	ZEND_SL_SPEC_TMP_VAR_HANDLER,
41151   	ZEND_NULL_HANDLER,
41152   	ZEND_SL_SPEC_TMP_CV_HANDLER,
41153   	ZEND_SL_SPEC_VAR_CONST_HANDLER,
41154   	ZEND_SL_SPEC_VAR_TMP_HANDLER,
41155   	ZEND_SL_SPEC_VAR_VAR_HANDLER,
41156   	ZEND_NULL_HANDLER,
41157   	ZEND_SL_SPEC_VAR_CV_HANDLER,
41158   	ZEND_NULL_HANDLER,
41159   	ZEND_NULL_HANDLER,
41160   	ZEND_NULL_HANDLER,
41161   	ZEND_NULL_HANDLER,
41162   	ZEND_NULL_HANDLER,
41163   	ZEND_SL_SPEC_CV_CONST_HANDLER,
41164   	ZEND_SL_SPEC_CV_TMP_HANDLER,
41165   	ZEND_SL_SPEC_CV_VAR_HANDLER,
41166   	ZEND_NULL_HANDLER,
41167   	ZEND_SL_SPEC_CV_CV_HANDLER,
41168   	ZEND_SR_SPEC_CONST_CONST_HANDLER,
41169   	ZEND_SR_SPEC_CONST_TMP_HANDLER,
41170   	ZEND_SR_SPEC_CONST_VAR_HANDLER,
41171   	ZEND_NULL_HANDLER,
41172   	ZEND_SR_SPEC_CONST_CV_HANDLER,
41173   	ZEND_SR_SPEC_TMP_CONST_HANDLER,
41174   	ZEND_SR_SPEC_TMP_TMP_HANDLER,
41175   	ZEND_SR_SPEC_TMP_VAR_HANDLER,
41176   	ZEND_NULL_HANDLER,
41177   	ZEND_SR_SPEC_TMP_CV_HANDLER,
41178   	ZEND_SR_SPEC_VAR_CONST_HANDLER,
41179   	ZEND_SR_SPEC_VAR_TMP_HANDLER,
41180   	ZEND_SR_SPEC_VAR_VAR_HANDLER,
41181   	ZEND_NULL_HANDLER,
41182   	ZEND_SR_SPEC_VAR_CV_HANDLER,
41183   	ZEND_NULL_HANDLER,
41184   	ZEND_NULL_HANDLER,
41185   	ZEND_NULL_HANDLER,
41186   	ZEND_NULL_HANDLER,
41187   	ZEND_NULL_HANDLER,
41188   	ZEND_SR_SPEC_CV_CONST_HANDLER,
41189   	ZEND_SR_SPEC_CV_TMP_HANDLER,
41190   	ZEND_SR_SPEC_CV_VAR_HANDLER,
41191   	ZEND_NULL_HANDLER,
41192   	ZEND_SR_SPEC_CV_CV_HANDLER,
41193   	ZEND_CONCAT_SPEC_CONST_CONST_HANDLER,
41194   	ZEND_CONCAT_SPEC_CONST_TMP_HANDLER,
41195   	ZEND_CONCAT_SPEC_CONST_VAR_HANDLER,
41196   	ZEND_NULL_HANDLER,
41197   	ZEND_CONCAT_SPEC_CONST_CV_HANDLER,
41198   	ZEND_CONCAT_SPEC_TMP_CONST_HANDLER,
41199   	ZEND_CONCAT_SPEC_TMP_TMP_HANDLER,
41200   	ZEND_CONCAT_SPEC_TMP_VAR_HANDLER,
41201   	ZEND_NULL_HANDLER,
41202   	ZEND_CONCAT_SPEC_TMP_CV_HANDLER,
41203   	ZEND_CONCAT_SPEC_VAR_CONST_HANDLER,
41204   	ZEND_CONCAT_SPEC_VAR_TMP_HANDLER,
41205   	ZEND_CONCAT_SPEC_VAR_VAR_HANDLER,
41206   	ZEND_NULL_HANDLER,
41207   	ZEND_CONCAT_SPEC_VAR_CV_HANDLER,
41208   	ZEND_NULL_HANDLER,
41209   	ZEND_NULL_HANDLER,
41210   	ZEND_NULL_HANDLER,
41211   	ZEND_NULL_HANDLER,
41212   	ZEND_NULL_HANDLER,
41213   	ZEND_CONCAT_SPEC_CV_CONST_HANDLER,
41214   	ZEND_CONCAT_SPEC_CV_TMP_HANDLER,
41215   	ZEND_CONCAT_SPEC_CV_VAR_HANDLER,
41216   	ZEND_NULL_HANDLER,
41217   	ZEND_CONCAT_SPEC_CV_CV_HANDLER,
41218   	ZEND_BW_OR_SPEC_CONST_CONST_HANDLER,
41219   	ZEND_BW_OR_SPEC_CONST_TMP_HANDLER,
41220   	ZEND_BW_OR_SPEC_CONST_VAR_HANDLER,
41221   	ZEND_NULL_HANDLER,
41222   	ZEND_BW_OR_SPEC_CONST_CV_HANDLER,
41223   	ZEND_BW_OR_SPEC_TMP_CONST_HANDLER,
41224   	ZEND_BW_OR_SPEC_TMP_TMP_HANDLER,
41225   	ZEND_BW_OR_SPEC_TMP_VAR_HANDLER,
41226   	ZEND_NULL_HANDLER,
41227   	ZEND_BW_OR_SPEC_TMP_CV_HANDLER,
41228   	ZEND_BW_OR_SPEC_VAR_CONST_HANDLER,
41229   	ZEND_BW_OR_SPEC_VAR_TMP_HANDLER,
41230   	ZEND_BW_OR_SPEC_VAR_VAR_HANDLER,
41231   	ZEND_NULL_HANDLER,
41232   	ZEND_BW_OR_SPEC_VAR_CV_HANDLER,
41233   	ZEND_NULL_HANDLER,
41234   	ZEND_NULL_HANDLER,
41235   	ZEND_NULL_HANDLER,
41236   	ZEND_NULL_HANDLER,
41237   	ZEND_NULL_HANDLER,
41238   	ZEND_BW_OR_SPEC_CV_CONST_HANDLER,
41239   	ZEND_BW_OR_SPEC_CV_TMP_HANDLER,
41240   	ZEND_BW_OR_SPEC_CV_VAR_HANDLER,
41241   	ZEND_NULL_HANDLER,
41242   	ZEND_BW_OR_SPEC_CV_CV_HANDLER,
41243   	ZEND_BW_AND_SPEC_CONST_CONST_HANDLER,
41244   	ZEND_BW_AND_SPEC_CONST_TMP_HANDLER,
41245   	ZEND_BW_AND_SPEC_CONST_VAR_HANDLER,
41246   	ZEND_NULL_HANDLER,
41247   	ZEND_BW_AND_SPEC_CONST_CV_HANDLER,
41248   	ZEND_BW_AND_SPEC_TMP_CONST_HANDLER,
41249   	ZEND_BW_AND_SPEC_TMP_TMP_HANDLER,
41250   	ZEND_BW_AND_SPEC_TMP_VAR_HANDLER,
41251   	ZEND_NULL_HANDLER,
41252   	ZEND_BW_AND_SPEC_TMP_CV_HANDLER,
41253   	ZEND_BW_AND_SPEC_VAR_CONST_HANDLER,
41254   	ZEND_BW_AND_SPEC_VAR_TMP_HANDLER,
41255   	ZEND_BW_AND_SPEC_VAR_VAR_HANDLER,
41256   	ZEND_NULL_HANDLER,
41257   	ZEND_BW_AND_SPEC_VAR_CV_HANDLER,
41258   	ZEND_NULL_HANDLER,
41259   	ZEND_NULL_HANDLER,
41260   	ZEND_NULL_HANDLER,
41261   	ZEND_NULL_HANDLER,
41262   	ZEND_NULL_HANDLER,
41263   	ZEND_BW_AND_SPEC_CV_CONST_HANDLER,
41264   	ZEND_BW_AND_SPEC_CV_TMP_HANDLER,
41265   	ZEND_BW_AND_SPEC_CV_VAR_HANDLER,
41266   	ZEND_NULL_HANDLER,
41267   	ZEND_BW_AND_SPEC_CV_CV_HANDLER,
41268   	ZEND_BW_XOR_SPEC_CONST_CONST_HANDLER,
41269   	ZEND_BW_XOR_SPEC_CONST_TMP_HANDLER,
41270   	ZEND_BW_XOR_SPEC_CONST_VAR_HANDLER,
41271   	ZEND_NULL_HANDLER,
41272   	ZEND_BW_XOR_SPEC_CONST_CV_HANDLER,
41273   	ZEND_BW_XOR_SPEC_TMP_CONST_HANDLER,
41274   	ZEND_BW_XOR_SPEC_TMP_TMP_HANDLER,
41275   	ZEND_BW_XOR_SPEC_TMP_VAR_HANDLER,
41276   	ZEND_NULL_HANDLER,
41277   	ZEND_BW_XOR_SPEC_TMP_CV_HANDLER,
41278   	ZEND_BW_XOR_SPEC_VAR_CONST_HANDLER,
41279   	ZEND_BW_XOR_SPEC_VAR_TMP_HANDLER,
41280   	ZEND_BW_XOR_SPEC_VAR_VAR_HANDLER,
41281   	ZEND_NULL_HANDLER,
41282   	ZEND_BW_XOR_SPEC_VAR_CV_HANDLER,
41283   	ZEND_NULL_HANDLER,
41284   	ZEND_NULL_HANDLER,
41285   	ZEND_NULL_HANDLER,
41286   	ZEND_NULL_HANDLER,
41287   	ZEND_NULL_HANDLER,
41288   	ZEND_BW_XOR_SPEC_CV_CONST_HANDLER,
41289   	ZEND_BW_XOR_SPEC_CV_TMP_HANDLER,
41290   	ZEND_BW_XOR_SPEC_CV_VAR_HANDLER,
41291   	ZEND_NULL_HANDLER,
41292   	ZEND_BW_XOR_SPEC_CV_CV_HANDLER,
41293   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
41294   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
41295   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
41296   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
41297   	ZEND_BW_NOT_SPEC_CONST_HANDLER,
41298   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
41299   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
41300   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
41301   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
41302   	ZEND_BW_NOT_SPEC_TMP_HANDLER,
41303   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
41304   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
41305   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
41306   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
41307   	ZEND_BW_NOT_SPEC_VAR_HANDLER,
41308   	ZEND_NULL_HANDLER,
41309   	ZEND_NULL_HANDLER,
41310   	ZEND_NULL_HANDLER,
41311   	ZEND_NULL_HANDLER,
41312   	ZEND_NULL_HANDLER,
41313   	ZEND_BW_NOT_SPEC_CV_HANDLER,
41314   	ZEND_BW_NOT_SPEC_CV_HANDLER,
41315   	ZEND_BW_NOT_SPEC_CV_HANDLER,
41316   	ZEND_BW_NOT_SPEC_CV_HANDLER,
41317   	ZEND_BW_NOT_SPEC_CV_HANDLER,
41318   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
41319   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
41320   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
41321   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
41322   	ZEND_BOOL_NOT_SPEC_CONST_HANDLER,
41323   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
41324   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
41325   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
41326   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
41327   	ZEND_BOOL_NOT_SPEC_TMP_HANDLER,
41328   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
41329   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
41330   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
41331   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
41332   	ZEND_BOOL_NOT_SPEC_VAR_HANDLER,
41333   	ZEND_NULL_HANDLER,
41334   	ZEND_NULL_HANDLER,
41335   	ZEND_NULL_HANDLER,
41336   	ZEND_NULL_HANDLER,
41337   	ZEND_NULL_HANDLER,
41338   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
41339   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
41340   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
41341   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
41342   	ZEND_BOOL_NOT_SPEC_CV_HANDLER,
41343   	ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER,
41344   	ZEND_BOOL_XOR_SPEC_CONST_TMP_HANDLER,
41345   	ZEND_BOOL_XOR_SPEC_CONST_VAR_HANDLER,
41346   	ZEND_NULL_HANDLER,
41347   	ZEND_BOOL_XOR_SPEC_CONST_CV_HANDLER,
41348   	ZEND_BOOL_XOR_SPEC_TMP_CONST_HANDLER,
41349   	ZEND_BOOL_XOR_SPEC_TMP_TMP_HANDLER,
41350   	ZEND_BOOL_XOR_SPEC_TMP_VAR_HANDLER,
41351   	ZEND_NULL_HANDLER,
41352   	ZEND_BOOL_XOR_SPEC_TMP_CV_HANDLER,
41353   	ZEND_BOOL_XOR_SPEC_VAR_CONST_HANDLER,
41354   	ZEND_BOOL_XOR_SPEC_VAR_TMP_HANDLER,
41355   	ZEND_BOOL_XOR_SPEC_VAR_VAR_HANDLER,
41356   	ZEND_NULL_HANDLER,
41357   	ZEND_BOOL_XOR_SPEC_VAR_CV_HANDLER,
41358   	ZEND_NULL_HANDLER,
41359   	ZEND_NULL_HANDLER,
41360   	ZEND_NULL_HANDLER,
41361   	ZEND_NULL_HANDLER,
41362   	ZEND_NULL_HANDLER,
41363   	ZEND_BOOL_XOR_SPEC_CV_CONST_HANDLER,
41364   	ZEND_BOOL_XOR_SPEC_CV_TMP_HANDLER,
41365   	ZEND_BOOL_XOR_SPEC_CV_VAR_HANDLER,
41366   	ZEND_NULL_HANDLER,
41367   	ZEND_BOOL_XOR_SPEC_CV_CV_HANDLER,
41368   	ZEND_IS_IDENTICAL_SPEC_CONST_CONST_HANDLER,
41369   	ZEND_IS_IDENTICAL_SPEC_CONST_TMP_HANDLER,
41370   	ZEND_IS_IDENTICAL_SPEC_CONST_VAR_HANDLER,
41371   	ZEND_NULL_HANDLER,
41372   	ZEND_IS_IDENTICAL_SPEC_CONST_CV_HANDLER,
41373   	ZEND_IS_IDENTICAL_SPEC_TMP_CONST_HANDLER,
41374   	ZEND_IS_IDENTICAL_SPEC_TMP_TMP_HANDLER,
41375   	ZEND_IS_IDENTICAL_SPEC_TMP_VAR_HANDLER,
41376   	ZEND_NULL_HANDLER,
41377   	ZEND_IS_IDENTICAL_SPEC_TMP_CV_HANDLER,
41378   	ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER,
41379   	ZEND_IS_IDENTICAL_SPEC_VAR_TMP_HANDLER,
41380   	ZEND_IS_IDENTICAL_SPEC_VAR_VAR_HANDLER,
41381   	ZEND_NULL_HANDLER,
41382   	ZEND_IS_IDENTICAL_SPEC_VAR_CV_HANDLER,
41383   	ZEND_NULL_HANDLER,
41384   	ZEND_NULL_HANDLER,
41385   	ZEND_NULL_HANDLER,
41386   	ZEND_NULL_HANDLER,
41387   	ZEND_NULL_HANDLER,
41388   	ZEND_IS_IDENTICAL_SPEC_CV_CONST_HANDLER,
41389   	ZEND_IS_IDENTICAL_SPEC_CV_TMP_HANDLER,
41390   	ZEND_IS_IDENTICAL_SPEC_CV_VAR_HANDLER,
41391   	ZEND_NULL_HANDLER,
41392   	ZEND_IS_IDENTICAL_SPEC_CV_CV_HANDLER,
41393   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CONST_HANDLER,
41394   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_TMP_HANDLER,
41395   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_VAR_HANDLER,
41396   	ZEND_NULL_HANDLER,
41397   	ZEND_IS_NOT_IDENTICAL_SPEC_CONST_CV_HANDLER,
41398   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CONST_HANDLER,
41399   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_TMP_HANDLER,
41400   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_VAR_HANDLER,
41401   	ZEND_NULL_HANDLER,
41402   	ZEND_IS_NOT_IDENTICAL_SPEC_TMP_CV_HANDLER,
41403   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CONST_HANDLER,
41404   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_TMP_HANDLER,
41405   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_VAR_HANDLER,
41406   	ZEND_NULL_HANDLER,
41407   	ZEND_IS_NOT_IDENTICAL_SPEC_VAR_CV_HANDLER,
41408   	ZEND_NULL_HANDLER,
41409   	ZEND_NULL_HANDLER,
41410   	ZEND_NULL_HANDLER,
41411   	ZEND_NULL_HANDLER,
41412   	ZEND_NULL_HANDLER,
41413   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_CONST_HANDLER,
41414   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_TMP_HANDLER,
41415   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_VAR_HANDLER,
41416   	ZEND_NULL_HANDLER,
41417   	ZEND_IS_NOT_IDENTICAL_SPEC_CV_CV_HANDLER,
41418   	ZEND_IS_EQUAL_SPEC_CONST_CONST_HANDLER,
41419   	ZEND_IS_EQUAL_SPEC_CONST_TMP_HANDLER,
41420   	ZEND_IS_EQUAL_SPEC_CONST_VAR_HANDLER,
41421   	ZEND_NULL_HANDLER,
41422   	ZEND_IS_EQUAL_SPEC_CONST_CV_HANDLER,
41423   	ZEND_IS_EQUAL_SPEC_TMP_CONST_HANDLER,
41424   	ZEND_IS_EQUAL_SPEC_TMP_TMP_HANDLER,
41425   	ZEND_IS_EQUAL_SPEC_TMP_VAR_HANDLER,
41426   	ZEND_NULL_HANDLER,
41427   	ZEND_IS_EQUAL_SPEC_TMP_CV_HANDLER,
41428   	ZEND_IS_EQUAL_SPEC_VAR_CONST_HANDLER,
41429   	ZEND_IS_EQUAL_SPEC_VAR_TMP_HANDLER,
41430   	ZEND_IS_EQUAL_SPEC_VAR_VAR_HANDLER,
41431   	ZEND_NULL_HANDLER,
41432   	ZEND_IS_EQUAL_SPEC_VAR_CV_HANDLER,
41433   	ZEND_NULL_HANDLER,
41434   	ZEND_NULL_HANDLER,
41435   	ZEND_NULL_HANDLER,
41436   	ZEND_NULL_HANDLER,
41437   	ZEND_NULL_HANDLER,
41438   	ZEND_IS_EQUAL_SPEC_CV_CONST_HANDLER,
41439   	ZEND_IS_EQUAL_SPEC_CV_TMP_HANDLER,
41440   	ZEND_IS_EQUAL_SPEC_CV_VAR_HANDLER,
41441   	ZEND_NULL_HANDLER,
41442   	ZEND_IS_EQUAL_SPEC_CV_CV_HANDLER,
41443   	ZEND_IS_NOT_EQUAL_SPEC_CONST_CONST_HANDLER,
41444   	ZEND_IS_NOT_EQUAL_SPEC_CONST_TMP_HANDLER,
41445   	ZEND_IS_NOT_EQUAL_SPEC_CONST_VAR_HANDLER,
41446   	ZEND_NULL_HANDLER,
41447   	ZEND_IS_NOT_EQUAL_SPEC_CONST_CV_HANDLER,
41448   	ZEND_IS_NOT_EQUAL_SPEC_TMP_CONST_HANDLER,
41449   	ZEND_IS_NOT_EQUAL_SPEC_TMP_TMP_HANDLER,
41450   	ZEND_IS_NOT_EQUAL_SPEC_TMP_VAR_HANDLER,
41451   	ZEND_NULL_HANDLER,
41452   	ZEND_IS_NOT_EQUAL_SPEC_TMP_CV_HANDLER,
41453   	ZEND_IS_NOT_EQUAL_SPEC_VAR_CONST_HANDLER,
41454   	ZEND_IS_NOT_EQUAL_SPEC_VAR_TMP_HANDLER,
41455   	ZEND_IS_NOT_EQUAL_SPEC_VAR_VAR_HANDLER,
41456   	ZEND_NULL_HANDLER,
41457   	ZEND_IS_NOT_EQUAL_SPEC_VAR_CV_HANDLER,
41458   	ZEND_NULL_HANDLER,
41459   	ZEND_NULL_HANDLER,
41460   	ZEND_NULL_HANDLER,
41461   	ZEND_NULL_HANDLER,
41462   	ZEND_NULL_HANDLER,
41463   	ZEND_IS_NOT_EQUAL_SPEC_CV_CONST_HANDLER,
41464   	ZEND_IS_NOT_EQUAL_SPEC_CV_TMP_HANDLER,
41465   	ZEND_IS_NOT_EQUAL_SPEC_CV_VAR_HANDLER,
41466   	ZEND_NULL_HANDLER,
41467   	ZEND_IS_NOT_EQUAL_SPEC_CV_CV_HANDLER,
41468   	ZEND_IS_SMALLER_SPEC_CONST_CONST_HANDLER,
41469   	ZEND_IS_SMALLER_SPEC_CONST_TMP_HANDLER,
41470   	ZEND_IS_SMALLER_SPEC_CONST_VAR_HANDLER,
41471   	ZEND_NULL_HANDLER,
41472   	ZEND_IS_SMALLER_SPEC_CONST_CV_HANDLER,
41473   	ZEND_IS_SMALLER_SPEC_TMP_CONST_HANDLER,
41474   	ZEND_IS_SMALLER_SPEC_TMP_TMP_HANDLER,
41475   	ZEND_IS_SMALLER_SPEC_TMP_VAR_HANDLER,
41476   	ZEND_NULL_HANDLER,
41477   	ZEND_IS_SMALLER_SPEC_TMP_CV_HANDLER,
41478   	ZEND_IS_SMALLER_SPEC_VAR_CONST_HANDLER,
41479   	ZEND_IS_SMALLER_SPEC_VAR_TMP_HANDLER,
41480   	ZEND_IS_SMALLER_SPEC_VAR_VAR_HANDLER,
41481   	ZEND_NULL_HANDLER,
41482   	ZEND_IS_SMALLER_SPEC_VAR_CV_HANDLER,
41483   	ZEND_NULL_HANDLER,
41484   	ZEND_NULL_HANDLER,
41485   	ZEND_NULL_HANDLER,
41486   	ZEND_NULL_HANDLER,
41487   	ZEND_NULL_HANDLER,
41488   	ZEND_IS_SMALLER_SPEC_CV_CONST_HANDLER,
41489   	ZEND_IS_SMALLER_SPEC_CV_TMP_HANDLER,
41490   	ZEND_IS_SMALLER_SPEC_CV_VAR_HANDLER,
41491   	ZEND_NULL_HANDLER,
41492   	ZEND_IS_SMALLER_SPEC_CV_CV_HANDLER,
41493   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CONST_HANDLER,
41494   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_TMP_HANDLER,
41495   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_VAR_HANDLER,
41496   	ZEND_NULL_HANDLER,
41497   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CONST_CV_HANDLER,
41498   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CONST_HANDLER,
41499   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_TMP_HANDLER,
41500   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_VAR_HANDLER,
41501   	ZEND_NULL_HANDLER,
41502   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMP_CV_HANDLER,
41503   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CONST_HANDLER,
41504   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_TMP_HANDLER,
41505   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_VAR_HANDLER,
41506   	ZEND_NULL_HANDLER,
41507   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_VAR_CV_HANDLER,
41508   	ZEND_NULL_HANDLER,
41509   	ZEND_NULL_HANDLER,
41510   	ZEND_NULL_HANDLER,
41511   	ZEND_NULL_HANDLER,
41512   	ZEND_NULL_HANDLER,
41513   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CONST_HANDLER,
41514   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_TMP_HANDLER,
41515   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_VAR_HANDLER,
41516   	ZEND_NULL_HANDLER,
41517   	ZEND_IS_SMALLER_OR_EQUAL_SPEC_CV_CV_HANDLER,
41518   	ZEND_CAST_SPEC_CONST_HANDLER,
41519   	ZEND_CAST_SPEC_CONST_HANDLER,
41520   	ZEND_CAST_SPEC_CONST_HANDLER,
41521   	ZEND_CAST_SPEC_CONST_HANDLER,
41522   	ZEND_CAST_SPEC_CONST_HANDLER,
41523   	ZEND_CAST_SPEC_TMP_HANDLER,
41524   	ZEND_CAST_SPEC_TMP_HANDLER,
41525   	ZEND_CAST_SPEC_TMP_HANDLER,
41526   	ZEND_CAST_SPEC_TMP_HANDLER,
41527   	ZEND_CAST_SPEC_TMP_HANDLER,
41528   	ZEND_CAST_SPEC_VAR_HANDLER,
41529   	ZEND_CAST_SPEC_VAR_HANDLER,
41530   	ZEND_CAST_SPEC_VAR_HANDLER,
41531   	ZEND_CAST_SPEC_VAR_HANDLER,
41532   	ZEND_CAST_SPEC_VAR_HANDLER,
41533   	ZEND_NULL_HANDLER,
41534   	ZEND_NULL_HANDLER,
41535   	ZEND_NULL_HANDLER,
41536   	ZEND_NULL_HANDLER,
41537   	ZEND_NULL_HANDLER,
41538   	ZEND_CAST_SPEC_CV_HANDLER,
41539   	ZEND_CAST_SPEC_CV_HANDLER,
41540   	ZEND_CAST_SPEC_CV_HANDLER,
41541   	ZEND_CAST_SPEC_CV_HANDLER,
41542   	ZEND_CAST_SPEC_CV_HANDLER,
41543   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
41544   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
41545   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
41546   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
41547   	ZEND_QM_ASSIGN_SPEC_CONST_HANDLER,
41548   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
41549   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
41550   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
41551   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
41552   	ZEND_QM_ASSIGN_SPEC_TMP_HANDLER,
41553   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
41554   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
41555   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
41556   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
41557   	ZEND_QM_ASSIGN_SPEC_VAR_HANDLER,
41558   	ZEND_NULL_HANDLER,
41559   	ZEND_NULL_HANDLER,
41560   	ZEND_NULL_HANDLER,
41561   	ZEND_NULL_HANDLER,
41562   	ZEND_NULL_HANDLER,
41563   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
41564   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
41565   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
41566   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
41567   	ZEND_QM_ASSIGN_SPEC_CV_HANDLER,
41568   	ZEND_NULL_HANDLER,
41569   	ZEND_NULL_HANDLER,
41570   	ZEND_NULL_HANDLER,
41571   	ZEND_NULL_HANDLER,
41572   	ZEND_NULL_HANDLER,
41573   	ZEND_NULL_HANDLER,
41574   	ZEND_NULL_HANDLER,
41575   	ZEND_NULL_HANDLER,
41576   	ZEND_NULL_HANDLER,
41577   	ZEND_NULL_HANDLER,
41578   	ZEND_ASSIGN_ADD_SPEC_VAR_CONST_HANDLER,
41579   	ZEND_ASSIGN_ADD_SPEC_VAR_TMP_HANDLER,
41580   	ZEND_ASSIGN_ADD_SPEC_VAR_VAR_HANDLER,
41581   	ZEND_ASSIGN_ADD_SPEC_VAR_UNUSED_HANDLER,
41582   	ZEND_ASSIGN_ADD_SPEC_VAR_CV_HANDLER,
41583   	ZEND_ASSIGN_ADD_SPEC_UNUSED_CONST_HANDLER,
41584   	ZEND_ASSIGN_ADD_SPEC_UNUSED_TMP_HANDLER,
41585   	ZEND_ASSIGN_ADD_SPEC_UNUSED_VAR_HANDLER,
41586   	ZEND_ASSIGN_ADD_SPEC_UNUSED_UNUSED_HANDLER,
41587   	ZEND_ASSIGN_ADD_SPEC_UNUSED_CV_HANDLER,
41588   	ZEND_ASSIGN_ADD_SPEC_CV_CONST_HANDLER,
41589   	ZEND_ASSIGN_ADD_SPEC_CV_TMP_HANDLER,
41590   	ZEND_ASSIGN_ADD_SPEC_CV_VAR_HANDLER,
41591   	ZEND_ASSIGN_ADD_SPEC_CV_UNUSED_HANDLER,
41592   	ZEND_ASSIGN_ADD_SPEC_CV_CV_HANDLER,
41593   	ZEND_NULL_HANDLER,
41594   	ZEND_NULL_HANDLER,
41595   	ZEND_NULL_HANDLER,
41596   	ZEND_NULL_HANDLER,
41597   	ZEND_NULL_HANDLER,
41598   	ZEND_NULL_HANDLER,
41599   	ZEND_NULL_HANDLER,
41600   	ZEND_NULL_HANDLER,
41601   	ZEND_NULL_HANDLER,
41602   	ZEND_NULL_HANDLER,
41603   	ZEND_ASSIGN_SUB_SPEC_VAR_CONST_HANDLER,
41604   	ZEND_ASSIGN_SUB_SPEC_VAR_TMP_HANDLER,
41605   	ZEND_ASSIGN_SUB_SPEC_VAR_VAR_HANDLER,
41606   	ZEND_ASSIGN_SUB_SPEC_VAR_UNUSED_HANDLER,
41607   	ZEND_ASSIGN_SUB_SPEC_VAR_CV_HANDLER,
41608   	ZEND_ASSIGN_SUB_SPEC_UNUSED_CONST_HANDLER,
41609   	ZEND_ASSIGN_SUB_SPEC_UNUSED_TMP_HANDLER,
41610   	ZEND_ASSIGN_SUB_SPEC_UNUSED_VAR_HANDLER,
41611   	ZEND_ASSIGN_SUB_SPEC_UNUSED_UNUSED_HANDLER,
41612   	ZEND_ASSIGN_SUB_SPEC_UNUSED_CV_HANDLER,
41613   	ZEND_ASSIGN_SUB_SPEC_CV_CONST_HANDLER,
41614   	ZEND_ASSIGN_SUB_SPEC_CV_TMP_HANDLER,
41615   	ZEND_ASSIGN_SUB_SPEC_CV_VAR_HANDLER,
41616   	ZEND_ASSIGN_SUB_SPEC_CV_UNUSED_HANDLER,
41617   	ZEND_ASSIGN_SUB_SPEC_CV_CV_HANDLER,
41618   	ZEND_NULL_HANDLER,
41619   	ZEND_NULL_HANDLER,
41620   	ZEND_NULL_HANDLER,
41621   	ZEND_NULL_HANDLER,
41622   	ZEND_NULL_HANDLER,
41623   	ZEND_NULL_HANDLER,
41624   	ZEND_NULL_HANDLER,
41625   	ZEND_NULL_HANDLER,
41626   	ZEND_NULL_HANDLER,
41627   	ZEND_NULL_HANDLER,
41628   	ZEND_ASSIGN_MUL_SPEC_VAR_CONST_HANDLER,
41629   	ZEND_ASSIGN_MUL_SPEC_VAR_TMP_HANDLER,
41630   	ZEND_ASSIGN_MUL_SPEC_VAR_VAR_HANDLER,
41631   	ZEND_ASSIGN_MUL_SPEC_VAR_UNUSED_HANDLER,
41632   	ZEND_ASSIGN_MUL_SPEC_VAR_CV_HANDLER,
41633   	ZEND_ASSIGN_MUL_SPEC_UNUSED_CONST_HANDLER,
41634   	ZEND_ASSIGN_MUL_SPEC_UNUSED_TMP_HANDLER,
41635   	ZEND_ASSIGN_MUL_SPEC_UNUSED_VAR_HANDLER,
41636   	ZEND_ASSIGN_MUL_SPEC_UNUSED_UNUSED_HANDLER,
41637   	ZEND_ASSIGN_MUL_SPEC_UNUSED_CV_HANDLER,
41638   	ZEND_ASSIGN_MUL_SPEC_CV_CONST_HANDLER,
41639   	ZEND_ASSIGN_MUL_SPEC_CV_TMP_HANDLER,
41640   	ZEND_ASSIGN_MUL_SPEC_CV_VAR_HANDLER,
41641   	ZEND_ASSIGN_MUL_SPEC_CV_UNUSED_HANDLER,
41642   	ZEND_ASSIGN_MUL_SPEC_CV_CV_HANDLER,
41643   	ZEND_NULL_HANDLER,
41644   	ZEND_NULL_HANDLER,
41645   	ZEND_NULL_HANDLER,
41646   	ZEND_NULL_HANDLER,
41647   	ZEND_NULL_HANDLER,
41648   	ZEND_NULL_HANDLER,
41649   	ZEND_NULL_HANDLER,
41650   	ZEND_NULL_HANDLER,
41651   	ZEND_NULL_HANDLER,
41652   	ZEND_NULL_HANDLER,
41653   	ZEND_ASSIGN_DIV_SPEC_VAR_CONST_HANDLER,
41654   	ZEND_ASSIGN_DIV_SPEC_VAR_TMP_HANDLER,
41655   	ZEND_ASSIGN_DIV_SPEC_VAR_VAR_HANDLER,
41656   	ZEND_ASSIGN_DIV_SPEC_VAR_UNUSED_HANDLER,
41657   	ZEND_ASSIGN_DIV_SPEC_VAR_CV_HANDLER,
41658   	ZEND_ASSIGN_DIV_SPEC_UNUSED_CONST_HANDLER,
41659   	ZEND_ASSIGN_DIV_SPEC_UNUSED_TMP_HANDLER,
41660   	ZEND_ASSIGN_DIV_SPEC_UNUSED_VAR_HANDLER,
41661   	ZEND_ASSIGN_DIV_SPEC_UNUSED_UNUSED_HANDLER,
41662   	ZEND_ASSIGN_DIV_SPEC_UNUSED_CV_HANDLER,
41663   	ZEND_ASSIGN_DIV_SPEC_CV_CONST_HANDLER,
41664   	ZEND_ASSIGN_DIV_SPEC_CV_TMP_HANDLER,
41665   	ZEND_ASSIGN_DIV_SPEC_CV_VAR_HANDLER,
41666   	ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER,
41667   	ZEND_ASSIGN_DIV_SPEC_CV_CV_HANDLER,
41668   	ZEND_NULL_HANDLER,
41669   	ZEND_NULL_HANDLER,
41670   	ZEND_NULL_HANDLER,
41671   	ZEND_NULL_HANDLER,
41672   	ZEND_NULL_HANDLER,
41673   	ZEND_NULL_HANDLER,
41674   	ZEND_NULL_HANDLER,
41675   	ZEND_NULL_HANDLER,
41676   	ZEND_NULL_HANDLER,
41677   	ZEND_NULL_HANDLER,
41678   	ZEND_ASSIGN_MOD_SPEC_VAR_CONST_HANDLER,
41679   	ZEND_ASSIGN_MOD_SPEC_VAR_TMP_HANDLER,
41680   	ZEND_ASSIGN_MOD_SPEC_VAR_VAR_HANDLER,
41681   	ZEND_ASSIGN_MOD_SPEC_VAR_UNUSED_HANDLER,
41682   	ZEND_ASSIGN_MOD_SPEC_VAR_CV_HANDLER,
41683   	ZEND_ASSIGN_MOD_SPEC_UNUSED_CONST_HANDLER,
41684   	ZEND_ASSIGN_MOD_SPEC_UNUSED_TMP_HANDLER,
41685   	ZEND_ASSIGN_MOD_SPEC_UNUSED_VAR_HANDLER,
41686   	ZEND_ASSIGN_MOD_SPEC_UNUSED_UNUSED_HANDLER,
41687   	ZEND_ASSIGN_MOD_SPEC_UNUSED_CV_HANDLER,
41688   	ZEND_ASSIGN_MOD_SPEC_CV_CONST_HANDLER,
41689   	ZEND_ASSIGN_MOD_SPEC_CV_TMP_HANDLER,
41690   	ZEND_ASSIGN_MOD_SPEC_CV_VAR_HANDLER,
41691   	ZEND_ASSIGN_MOD_SPEC_CV_UNUSED_HANDLER,
41692   	ZEND_ASSIGN_MOD_SPEC_CV_CV_HANDLER,
41693   	ZEND_NULL_HANDLER,
41694   	ZEND_NULL_HANDLER,
41695   	ZEND_NULL_HANDLER,
41696   	ZEND_NULL_HANDLER,
41697   	ZEND_NULL_HANDLER,
41698   	ZEND_NULL_HANDLER,
41699   	ZEND_NULL_HANDLER,
41700   	ZEND_NULL_HANDLER,
41701   	ZEND_NULL_HANDLER,
41702   	ZEND_NULL_HANDLER,
41703   	ZEND_ASSIGN_SL_SPEC_VAR_CONST_HANDLER,
41704   	ZEND_ASSIGN_SL_SPEC_VAR_TMP_HANDLER,
41705   	ZEND_ASSIGN_SL_SPEC_VAR_VAR_HANDLER,
41706   	ZEND_ASSIGN_SL_SPEC_VAR_UNUSED_HANDLER,
41707   	ZEND_ASSIGN_SL_SPEC_VAR_CV_HANDLER,
41708   	ZEND_ASSIGN_SL_SPEC_UNUSED_CONST_HANDLER,
41709   	ZEND_ASSIGN_SL_SPEC_UNUSED_TMP_HANDLER,
41710   	ZEND_ASSIGN_SL_SPEC_UNUSED_VAR_HANDLER,
41711   	ZEND_ASSIGN_SL_SPEC_UNUSED_UNUSED_HANDLER,
41712   	ZEND_ASSIGN_SL_SPEC_UNUSED_CV_HANDLER,
41713   	ZEND_ASSIGN_SL_SPEC_CV_CONST_HANDLER,
41714   	ZEND_ASSIGN_SL_SPEC_CV_TMP_HANDLER,
41715   	ZEND_ASSIGN_SL_SPEC_CV_VAR_HANDLER,
41716   	ZEND_ASSIGN_SL_SPEC_CV_UNUSED_HANDLER,
41717   	ZEND_ASSIGN_SL_SPEC_CV_CV_HANDLER,
41718   	ZEND_NULL_HANDLER,
41719   	ZEND_NULL_HANDLER,
41720   	ZEND_NULL_HANDLER,
41721   	ZEND_NULL_HANDLER,
41722   	ZEND_NULL_HANDLER,
41723   	ZEND_NULL_HANDLER,
41724   	ZEND_NULL_HANDLER,
41725   	ZEND_NULL_HANDLER,
41726   	ZEND_NULL_HANDLER,
41727   	ZEND_NULL_HANDLER,
41728   	ZEND_ASSIGN_SR_SPEC_VAR_CONST_HANDLER,
41729   	ZEND_ASSIGN_SR_SPEC_VAR_TMP_HANDLER,
41730   	ZEND_ASSIGN_SR_SPEC_VAR_VAR_HANDLER,
41731   	ZEND_ASSIGN_SR_SPEC_VAR_UNUSED_HANDLER,
41732   	ZEND_ASSIGN_SR_SPEC_VAR_CV_HANDLER,
41733   	ZEND_ASSIGN_SR_SPEC_UNUSED_CONST_HANDLER,
41734   	ZEND_ASSIGN_SR_SPEC_UNUSED_TMP_HANDLER,
41735   	ZEND_ASSIGN_SR_SPEC_UNUSED_VAR_HANDLER,
41736   	ZEND_ASSIGN_SR_SPEC_UNUSED_UNUSED_HANDLER,
41737   	ZEND_ASSIGN_SR_SPEC_UNUSED_CV_HANDLER,
41738   	ZEND_ASSIGN_SR_SPEC_CV_CONST_HANDLER,
41739   	ZEND_ASSIGN_SR_SPEC_CV_TMP_HANDLER,
41740   	ZEND_ASSIGN_SR_SPEC_CV_VAR_HANDLER,
41741   	ZEND_ASSIGN_SR_SPEC_CV_UNUSED_HANDLER,
41742   	ZEND_ASSIGN_SR_SPEC_CV_CV_HANDLER,
41743   	ZEND_NULL_HANDLER,
41744   	ZEND_NULL_HANDLER,
41745   	ZEND_NULL_HANDLER,
41746   	ZEND_NULL_HANDLER,
41747   	ZEND_NULL_HANDLER,
41748   	ZEND_NULL_HANDLER,
41749   	ZEND_NULL_HANDLER,
41750   	ZEND_NULL_HANDLER,
41751   	ZEND_NULL_HANDLER,
41752   	ZEND_NULL_HANDLER,
41753   	ZEND_ASSIGN_CONCAT_SPEC_VAR_CONST_HANDLER,
41754   	ZEND_ASSIGN_CONCAT_SPEC_VAR_TMP_HANDLER,
41755   	ZEND_ASSIGN_CONCAT_SPEC_VAR_VAR_HANDLER,
41756   	ZEND_ASSIGN_CONCAT_SPEC_VAR_UNUSED_HANDLER,
41757   	ZEND_ASSIGN_CONCAT_SPEC_VAR_CV_HANDLER,
41758   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CONST_HANDLER,
41759   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_TMP_HANDLER,
41760   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_VAR_HANDLER,
41761   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_UNUSED_HANDLER,
41762   	ZEND_ASSIGN_CONCAT_SPEC_UNUSED_CV_HANDLER,
41763   	ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_HANDLER,
41764   	ZEND_ASSIGN_CONCAT_SPEC_CV_TMP_HANDLER,
41765   	ZEND_ASSIGN_CONCAT_SPEC_CV_VAR_HANDLER,
41766   	ZEND_ASSIGN_CONCAT_SPEC_CV_UNUSED_HANDLER,
41767   	ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER,
41768   	ZEND_NULL_HANDLER,
41769   	ZEND_NULL_HANDLER,
41770   	ZEND_NULL_HANDLER,
41771   	ZEND_NULL_HANDLER,
41772   	ZEND_NULL_HANDLER,
41773   	ZEND_NULL_HANDLER,
41774   	ZEND_NULL_HANDLER,
41775   	ZEND_NULL_HANDLER,
41776   	ZEND_NULL_HANDLER,
41777   	ZEND_NULL_HANDLER,
41778   	ZEND_ASSIGN_BW_OR_SPEC_VAR_CONST_HANDLER,
41779   	ZEND_ASSIGN_BW_OR_SPEC_VAR_TMP_HANDLER,
41780   	ZEND_ASSIGN_BW_OR_SPEC_VAR_VAR_HANDLER,
41781   	ZEND_ASSIGN_BW_OR_SPEC_VAR_UNUSED_HANDLER,
41782   	ZEND_ASSIGN_BW_OR_SPEC_VAR_CV_HANDLER,
41783   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CONST_HANDLER,
41784   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_TMP_HANDLER,
41785   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_VAR_HANDLER,
41786   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_UNUSED_HANDLER,
41787   	ZEND_ASSIGN_BW_OR_SPEC_UNUSED_CV_HANDLER,
41788   	ZEND_ASSIGN_BW_OR_SPEC_CV_CONST_HANDLER,
41789   	ZEND_ASSIGN_BW_OR_SPEC_CV_TMP_HANDLER,
41790   	ZEND_ASSIGN_BW_OR_SPEC_CV_VAR_HANDLER,
41791   	ZEND_ASSIGN_BW_OR_SPEC_CV_UNUSED_HANDLER,
41792   	ZEND_ASSIGN_BW_OR_SPEC_CV_CV_HANDLER,
41793   	ZEND_NULL_HANDLER,
41794   	ZEND_NULL_HANDLER,
41795   	ZEND_NULL_HANDLER,
41796   	ZEND_NULL_HANDLER,
41797   	ZEND_NULL_HANDLER,
41798   	ZEND_NULL_HANDLER,
41799   	ZEND_NULL_HANDLER,
41800   	ZEND_NULL_HANDLER,
41801   	ZEND_NULL_HANDLER,
41802   	ZEND_NULL_HANDLER,
41803   	ZEND_ASSIGN_BW_AND_SPEC_VAR_CONST_HANDLER,
41804   	ZEND_ASSIGN_BW_AND_SPEC_VAR_TMP_HANDLER,
41805   	ZEND_ASSIGN_BW_AND_SPEC_VAR_VAR_HANDLER,
41806   	ZEND_ASSIGN_BW_AND_SPEC_VAR_UNUSED_HANDLER,
41807   	ZEND_ASSIGN_BW_AND_SPEC_VAR_CV_HANDLER,
41808   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CONST_HANDLER,
41809   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_TMP_HANDLER,
41810   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_VAR_HANDLER,
41811   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_UNUSED_HANDLER,
41812   	ZEND_ASSIGN_BW_AND_SPEC_UNUSED_CV_HANDLER,
41813   	ZEND_ASSIGN_BW_AND_SPEC_CV_CONST_HANDLER,
41814   	ZEND_ASSIGN_BW_AND_SPEC_CV_TMP_HANDLER,
41815   	ZEND_ASSIGN_BW_AND_SPEC_CV_VAR_HANDLER,
41816   	ZEND_ASSIGN_BW_AND_SPEC_CV_UNUSED_HANDLER,
41817   	ZEND_ASSIGN_BW_AND_SPEC_CV_CV_HANDLER,
41818   	ZEND_NULL_HANDLER,
41819   	ZEND_NULL_HANDLER,
41820   	ZEND_NULL_HANDLER,
41821   	ZEND_NULL_HANDLER,
41822   	ZEND_NULL_HANDLER,
41823   	ZEND_NULL_HANDLER,
41824   	ZEND_NULL_HANDLER,
41825   	ZEND_NULL_HANDLER,
41826   	ZEND_NULL_HANDLER,
41827   	ZEND_NULL_HANDLER,
41828   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_CONST_HANDLER,
41829   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_TMP_HANDLER,
41830   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_VAR_HANDLER,
41831   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_UNUSED_HANDLER,
41832   	ZEND_ASSIGN_BW_XOR_SPEC_VAR_CV_HANDLER,
41833   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CONST_HANDLER,
41834   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_TMP_HANDLER,
41835   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_VAR_HANDLER,
41836   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER,
41837   	ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_CV_HANDLER,
41838   	ZEND_ASSIGN_BW_XOR_SPEC_CV_CONST_HANDLER,
41839   	ZEND_ASSIGN_BW_XOR_SPEC_CV_TMP_HANDLER,
41840   	ZEND_ASSIGN_BW_XOR_SPEC_CV_VAR_HANDLER,
41841   	ZEND_ASSIGN_BW_XOR_SPEC_CV_UNUSED_HANDLER,
41842   	ZEND_ASSIGN_BW_XOR_SPEC_CV_CV_HANDLER,
41843   	ZEND_NULL_HANDLER,
41844   	ZEND_NULL_HANDLER,
41845   	ZEND_NULL_HANDLER,
41846   	ZEND_NULL_HANDLER,
41847   	ZEND_NULL_HANDLER,
41848   	ZEND_NULL_HANDLER,
41849   	ZEND_NULL_HANDLER,
41850   	ZEND_NULL_HANDLER,
41851   	ZEND_NULL_HANDLER,
41852   	ZEND_NULL_HANDLER,
41853   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
41854   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
41855   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
41856   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
41857   	ZEND_PRE_INC_SPEC_VAR_HANDLER,
41858   	ZEND_NULL_HANDLER,
41859   	ZEND_NULL_HANDLER,
41860   	ZEND_NULL_HANDLER,
41861   	ZEND_NULL_HANDLER,
41862   	ZEND_NULL_HANDLER,
41863   	ZEND_PRE_INC_SPEC_CV_HANDLER,
41864   	ZEND_PRE_INC_SPEC_CV_HANDLER,
41865   	ZEND_PRE_INC_SPEC_CV_HANDLER,
41866   	ZEND_PRE_INC_SPEC_CV_HANDLER,
41867   	ZEND_PRE_INC_SPEC_CV_HANDLER,
41868   	ZEND_NULL_HANDLER,
41869   	ZEND_NULL_HANDLER,
41870   	ZEND_NULL_HANDLER,
41871   	ZEND_NULL_HANDLER,
41872   	ZEND_NULL_HANDLER,
41873   	ZEND_NULL_HANDLER,
41874   	ZEND_NULL_HANDLER,
41875   	ZEND_NULL_HANDLER,
41876   	ZEND_NULL_HANDLER,
41877   	ZEND_NULL_HANDLER,
41878   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
41879   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
41880   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
41881   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
41882   	ZEND_PRE_DEC_SPEC_VAR_HANDLER,
41883   	ZEND_NULL_HANDLER,
41884   	ZEND_NULL_HANDLER,
41885   	ZEND_NULL_HANDLER,
41886   	ZEND_NULL_HANDLER,
41887   	ZEND_NULL_HANDLER,
41888   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
41889   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
41890   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
41891   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
41892   	ZEND_PRE_DEC_SPEC_CV_HANDLER,
41893   	ZEND_NULL_HANDLER,
41894   	ZEND_NULL_HANDLER,
41895   	ZEND_NULL_HANDLER,
41896   	ZEND_NULL_HANDLER,
41897   	ZEND_NULL_HANDLER,
41898   	ZEND_NULL_HANDLER,
41899   	ZEND_NULL_HANDLER,
41900   	ZEND_NULL_HANDLER,
41901   	ZEND_NULL_HANDLER,
41902   	ZEND_NULL_HANDLER,
41903   	ZEND_POST_INC_SPEC_VAR_HANDLER,
41904   	ZEND_POST_INC_SPEC_VAR_HANDLER,
41905   	ZEND_POST_INC_SPEC_VAR_HANDLER,
41906   	ZEND_POST_INC_SPEC_VAR_HANDLER,
41907   	ZEND_POST_INC_SPEC_VAR_HANDLER,
41908   	ZEND_NULL_HANDLER,
41909   	ZEND_NULL_HANDLER,
41910   	ZEND_NULL_HANDLER,
41911   	ZEND_NULL_HANDLER,
41912   	ZEND_NULL_HANDLER,
41913   	ZEND_POST_INC_SPEC_CV_HANDLER,
41914   	ZEND_POST_INC_SPEC_CV_HANDLER,
41915   	ZEND_POST_INC_SPEC_CV_HANDLER,
41916   	ZEND_POST_INC_SPEC_CV_HANDLER,
41917   	ZEND_POST_INC_SPEC_CV_HANDLER,
41918   	ZEND_NULL_HANDLER,
41919   	ZEND_NULL_HANDLER,
41920   	ZEND_NULL_HANDLER,
41921   	ZEND_NULL_HANDLER,
41922   	ZEND_NULL_HANDLER,
41923   	ZEND_NULL_HANDLER,
41924   	ZEND_NULL_HANDLER,
41925   	ZEND_NULL_HANDLER,
41926   	ZEND_NULL_HANDLER,
41927   	ZEND_NULL_HANDLER,
41928   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
41929   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
41930   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
41931   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
41932   	ZEND_POST_DEC_SPEC_VAR_HANDLER,
41933   	ZEND_NULL_HANDLER,
41934   	ZEND_NULL_HANDLER,
41935   	ZEND_NULL_HANDLER,
41936   	ZEND_NULL_HANDLER,
41937   	ZEND_NULL_HANDLER,
41938   	ZEND_POST_DEC_SPEC_CV_HANDLER,
41939   	ZEND_POST_DEC_SPEC_CV_HANDLER,
41940   	ZEND_POST_DEC_SPEC_CV_HANDLER,
41941   	ZEND_POST_DEC_SPEC_CV_HANDLER,
41942   	ZEND_POST_DEC_SPEC_CV_HANDLER,
41943   	ZEND_NULL_HANDLER,
41944   	ZEND_NULL_HANDLER,
41945   	ZEND_NULL_HANDLER,
41946   	ZEND_NULL_HANDLER,
41947   	ZEND_NULL_HANDLER,
41948   	ZEND_NULL_HANDLER,
41949   	ZEND_NULL_HANDLER,
41950   	ZEND_NULL_HANDLER,
41951   	ZEND_NULL_HANDLER,
41952   	ZEND_NULL_HANDLER,
41953   	ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER,
41954   	ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER,
41955   	ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER,
41956   	ZEND_NULL_HANDLER,
41957   	ZEND_ASSIGN_SPEC_VAR_CV_HANDLER,
41958   	ZEND_NULL_HANDLER,
41959   	ZEND_NULL_HANDLER,
41960   	ZEND_NULL_HANDLER,
41961   	ZEND_NULL_HANDLER,
41962   	ZEND_NULL_HANDLER,
41963   	ZEND_ASSIGN_SPEC_CV_CONST_HANDLER,
41964   	ZEND_ASSIGN_SPEC_CV_TMP_HANDLER,
41965   	ZEND_ASSIGN_SPEC_CV_VAR_HANDLER,
41966   	ZEND_NULL_HANDLER,
41967   	ZEND_ASSIGN_SPEC_CV_CV_HANDLER,
41968   	ZEND_NULL_HANDLER,
41969   	ZEND_NULL_HANDLER,
41970   	ZEND_NULL_HANDLER,
41971   	ZEND_NULL_HANDLER,
41972   	ZEND_NULL_HANDLER,
41973   	ZEND_NULL_HANDLER,
41974   	ZEND_NULL_HANDLER,
41975   	ZEND_NULL_HANDLER,
41976   	ZEND_NULL_HANDLER,
41977   	ZEND_NULL_HANDLER,
41978   	ZEND_NULL_HANDLER,
41979   	ZEND_NULL_HANDLER,
41980   	ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER,
41981   	ZEND_NULL_HANDLER,
41982   	ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER,
41983   	ZEND_NULL_HANDLER,
41984   	ZEND_NULL_HANDLER,
41985   	ZEND_NULL_HANDLER,
41986   	ZEND_NULL_HANDLER,
41987   	ZEND_NULL_HANDLER,
41988   	ZEND_NULL_HANDLER,
41989   	ZEND_NULL_HANDLER,
41990   	ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER,
41991   	ZEND_NULL_HANDLER,
41992   	ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER,
41993   	ZEND_ECHO_SPEC_CONST_HANDLER,
41994   	ZEND_ECHO_SPEC_CONST_HANDLER,
41995   	ZEND_ECHO_SPEC_CONST_HANDLER,
41996   	ZEND_ECHO_SPEC_CONST_HANDLER,
41997   	ZEND_ECHO_SPEC_CONST_HANDLER,
41998   	ZEND_ECHO_SPEC_TMP_HANDLER,
41999   	ZEND_ECHO_SPEC_TMP_HANDLER,
42000   	ZEND_ECHO_SPEC_TMP_HANDLER,
42001   	ZEND_ECHO_SPEC_TMP_HANDLER,
42002   	ZEND_ECHO_SPEC_TMP_HANDLER,
42003   	ZEND_ECHO_SPEC_VAR_HANDLER,
42004   	ZEND_ECHO_SPEC_VAR_HANDLER,
42005   	ZEND_ECHO_SPEC_VAR_HANDLER,
42006   	ZEND_ECHO_SPEC_VAR_HANDLER,
42007   	ZEND_ECHO_SPEC_VAR_HANDLER,
42008   	ZEND_NULL_HANDLER,
42009   	ZEND_NULL_HANDLER,
42010   	ZEND_NULL_HANDLER,
42011   	ZEND_NULL_HANDLER,
42012   	ZEND_NULL_HANDLER,
42013   	ZEND_ECHO_SPEC_CV_HANDLER,
42014   	ZEND_ECHO_SPEC_CV_HANDLER,
42015   	ZEND_ECHO_SPEC_CV_HANDLER,
42016   	ZEND_ECHO_SPEC_CV_HANDLER,
42017   	ZEND_ECHO_SPEC_CV_HANDLER,
42018   	ZEND_PRINT_SPEC_CONST_HANDLER,
42019   	ZEND_PRINT_SPEC_CONST_HANDLER,
42020   	ZEND_PRINT_SPEC_CONST_HANDLER,
42021   	ZEND_PRINT_SPEC_CONST_HANDLER,
42022   	ZEND_PRINT_SPEC_CONST_HANDLER,
42023   	ZEND_PRINT_SPEC_TMP_HANDLER,
42024   	ZEND_PRINT_SPEC_TMP_HANDLER,
42025   	ZEND_PRINT_SPEC_TMP_HANDLER,
42026   	ZEND_PRINT_SPEC_TMP_HANDLER,
42027   	ZEND_PRINT_SPEC_TMP_HANDLER,
42028   	ZEND_PRINT_SPEC_VAR_HANDLER,
42029   	ZEND_PRINT_SPEC_VAR_HANDLER,
42030   	ZEND_PRINT_SPEC_VAR_HANDLER,
42031   	ZEND_PRINT_SPEC_VAR_HANDLER,
42032   	ZEND_PRINT_SPEC_VAR_HANDLER,
42033   	ZEND_NULL_HANDLER,
42034   	ZEND_NULL_HANDLER,
42035   	ZEND_NULL_HANDLER,
42036   	ZEND_NULL_HANDLER,
42037   	ZEND_NULL_HANDLER,
42038   	ZEND_PRINT_SPEC_CV_HANDLER,
42039   	ZEND_PRINT_SPEC_CV_HANDLER,
42040   	ZEND_PRINT_SPEC_CV_HANDLER,
42041   	ZEND_PRINT_SPEC_CV_HANDLER,
42042   	ZEND_PRINT_SPEC_CV_HANDLER,
42043   	ZEND_JMP_SPEC_HANDLER,
42044   	ZEND_JMP_SPEC_HANDLER,
42045   	ZEND_JMP_SPEC_HANDLER,
42046   	ZEND_JMP_SPEC_HANDLER,
42047   	ZEND_JMP_SPEC_HANDLER,
42048   	ZEND_JMP_SPEC_HANDLER,
42049   	ZEND_JMP_SPEC_HANDLER,
42050   	ZEND_JMP_SPEC_HANDLER,
42051   	ZEND_JMP_SPEC_HANDLER,
42052   	ZEND_JMP_SPEC_HANDLER,
42053   	ZEND_JMP_SPEC_HANDLER,
42054   	ZEND_JMP_SPEC_HANDLER,
42055   	ZEND_JMP_SPEC_HANDLER,
42056   	ZEND_JMP_SPEC_HANDLER,
42057   	ZEND_JMP_SPEC_HANDLER,
42058   	ZEND_JMP_SPEC_HANDLER,
42059   	ZEND_JMP_SPEC_HANDLER,
42060   	ZEND_JMP_SPEC_HANDLER,
42061   	ZEND_JMP_SPEC_HANDLER,
42062   	ZEND_JMP_SPEC_HANDLER,
42063   	ZEND_JMP_SPEC_HANDLER,
42064   	ZEND_JMP_SPEC_HANDLER,
42065   	ZEND_JMP_SPEC_HANDLER,
42066   	ZEND_JMP_SPEC_HANDLER,
42067   	ZEND_JMP_SPEC_HANDLER,
42068   	ZEND_JMPZ_SPEC_CONST_HANDLER,
42069   	ZEND_JMPZ_SPEC_CONST_HANDLER,
42070   	ZEND_JMPZ_SPEC_CONST_HANDLER,
42071   	ZEND_JMPZ_SPEC_CONST_HANDLER,
42072   	ZEND_JMPZ_SPEC_CONST_HANDLER,
42073   	ZEND_JMPZ_SPEC_TMP_HANDLER,
42074   	ZEND_JMPZ_SPEC_TMP_HANDLER,
42075   	ZEND_JMPZ_SPEC_TMP_HANDLER,
42076   	ZEND_JMPZ_SPEC_TMP_HANDLER,
42077   	ZEND_JMPZ_SPEC_TMP_HANDLER,
42078   	ZEND_JMPZ_SPEC_VAR_HANDLER,
42079   	ZEND_JMPZ_SPEC_VAR_HANDLER,
42080   	ZEND_JMPZ_SPEC_VAR_HANDLER,
42081   	ZEND_JMPZ_SPEC_VAR_HANDLER,
42082   	ZEND_JMPZ_SPEC_VAR_HANDLER,
42083   	ZEND_NULL_HANDLER,
42084   	ZEND_NULL_HANDLER,
42085   	ZEND_NULL_HANDLER,
42086   	ZEND_NULL_HANDLER,
42087   	ZEND_NULL_HANDLER,
42088   	ZEND_JMPZ_SPEC_CV_HANDLER,
42089   	ZEND_JMPZ_SPEC_CV_HANDLER,
42090   	ZEND_JMPZ_SPEC_CV_HANDLER,
42091   	ZEND_JMPZ_SPEC_CV_HANDLER,
42092   	ZEND_JMPZ_SPEC_CV_HANDLER,
42093   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
42094   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
42095   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
42096   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
42097   	ZEND_JMPNZ_SPEC_CONST_HANDLER,
42098   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
42099   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
42100   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
42101   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
42102   	ZEND_JMPNZ_SPEC_TMP_HANDLER,
42103   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
42104   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
42105   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
42106   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
42107   	ZEND_JMPNZ_SPEC_VAR_HANDLER,
42108   	ZEND_NULL_HANDLER,
42109   	ZEND_NULL_HANDLER,
42110   	ZEND_NULL_HANDLER,
42111   	ZEND_NULL_HANDLER,
42112   	ZEND_NULL_HANDLER,
42113   	ZEND_JMPNZ_SPEC_CV_HANDLER,
42114   	ZEND_JMPNZ_SPEC_CV_HANDLER,
42115   	ZEND_JMPNZ_SPEC_CV_HANDLER,
42116   	ZEND_JMPNZ_SPEC_CV_HANDLER,
42117   	ZEND_JMPNZ_SPEC_CV_HANDLER,
42118   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
42119   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
42120   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
42121   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
42122   	ZEND_JMPZNZ_SPEC_CONST_HANDLER,
42123   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
42124   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
42125   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
42126   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
42127   	ZEND_JMPZNZ_SPEC_TMP_HANDLER,
42128   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
42129   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
42130   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
42131   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
42132   	ZEND_JMPZNZ_SPEC_VAR_HANDLER,
42133   	ZEND_NULL_HANDLER,
42134   	ZEND_NULL_HANDLER,
42135   	ZEND_NULL_HANDLER,
42136   	ZEND_NULL_HANDLER,
42137   	ZEND_NULL_HANDLER,
42138   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
42139   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
42140   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
42141   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
42142   	ZEND_JMPZNZ_SPEC_CV_HANDLER,
42143   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
42144   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
42145   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
42146   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
42147   	ZEND_JMPZ_EX_SPEC_CONST_HANDLER,
42148   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
42149   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
42150   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
42151   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
42152   	ZEND_JMPZ_EX_SPEC_TMP_HANDLER,
42153   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
42154   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
42155   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
42156   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
42157   	ZEND_JMPZ_EX_SPEC_VAR_HANDLER,
42158   	ZEND_NULL_HANDLER,
42159   	ZEND_NULL_HANDLER,
42160   	ZEND_NULL_HANDLER,
42161   	ZEND_NULL_HANDLER,
42162   	ZEND_NULL_HANDLER,
42163   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
42164   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
42165   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
42166   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
42167   	ZEND_JMPZ_EX_SPEC_CV_HANDLER,
42168   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
42169   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
42170   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
42171   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
42172   	ZEND_JMPNZ_EX_SPEC_CONST_HANDLER,
42173   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
42174   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
42175   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
42176   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
42177   	ZEND_JMPNZ_EX_SPEC_TMP_HANDLER,
42178   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
42179   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
42180   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
42181   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
42182   	ZEND_JMPNZ_EX_SPEC_VAR_HANDLER,
42183   	ZEND_NULL_HANDLER,
42184   	ZEND_NULL_HANDLER,
42185   	ZEND_NULL_HANDLER,
42186   	ZEND_NULL_HANDLER,
42187   	ZEND_NULL_HANDLER,
42188   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
42189   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
42190   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
42191   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
42192   	ZEND_JMPNZ_EX_SPEC_CV_HANDLER,
42193   	ZEND_CASE_SPEC_CONST_CONST_HANDLER,
42194   	ZEND_CASE_SPEC_CONST_TMP_HANDLER,
42195   	ZEND_CASE_SPEC_CONST_VAR_HANDLER,
42196   	ZEND_NULL_HANDLER,
42197   	ZEND_CASE_SPEC_CONST_CV_HANDLER,
42198   	ZEND_CASE_SPEC_TMP_CONST_HANDLER,
42199   	ZEND_CASE_SPEC_TMP_TMP_HANDLER,
42200   	ZEND_CASE_SPEC_TMP_VAR_HANDLER,
42201   	ZEND_NULL_HANDLER,
42202   	ZEND_CASE_SPEC_TMP_CV_HANDLER,
42203   	ZEND_CASE_SPEC_VAR_CONST_HANDLER,
42204   	ZEND_CASE_SPEC_VAR_TMP_HANDLER,
42205   	ZEND_CASE_SPEC_VAR_VAR_HANDLER,
42206   	ZEND_NULL_HANDLER,
42207   	ZEND_CASE_SPEC_VAR_CV_HANDLER,
42208   	ZEND_NULL_HANDLER,
42209   	ZEND_NULL_HANDLER,
42210   	ZEND_NULL_HANDLER,
42211   	ZEND_NULL_HANDLER,
42212   	ZEND_NULL_HANDLER,
42213   	ZEND_CASE_SPEC_CV_CONST_HANDLER,
42214   	ZEND_CASE_SPEC_CV_TMP_HANDLER,
42215   	ZEND_CASE_SPEC_CV_VAR_HANDLER,
42216   	ZEND_NULL_HANDLER,
42217   	ZEND_CASE_SPEC_CV_CV_HANDLER,
42218   	ZEND_NULL_HANDLER,
42219   	ZEND_NULL_HANDLER,
42220   	ZEND_NULL_HANDLER,
42221   	ZEND_NULL_HANDLER,
42222   	ZEND_NULL_HANDLER,
42223   	ZEND_NULL_HANDLER,
42224   	ZEND_NULL_HANDLER,
42225   	ZEND_NULL_HANDLER,
42226   	ZEND_NULL_HANDLER,
42227   	ZEND_NULL_HANDLER,
42228   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
42229   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
42230   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
42231   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
42232   	ZEND_SWITCH_FREE_SPEC_VAR_HANDLER,
42233   	ZEND_NULL_HANDLER,
42234   	ZEND_NULL_HANDLER,
42235   	ZEND_NULL_HANDLER,
42236   	ZEND_NULL_HANDLER,
42237   	ZEND_NULL_HANDLER,
42238   	ZEND_NULL_HANDLER,
42239   	ZEND_NULL_HANDLER,
42240   	ZEND_NULL_HANDLER,
42241   	ZEND_NULL_HANDLER,
42242   	ZEND_NULL_HANDLER,
42243   	ZEND_BRK_SPEC_CONST_HANDLER,
42244   	ZEND_NULL_HANDLER,
42245   	ZEND_NULL_HANDLER,
42246   	ZEND_NULL_HANDLER,
42247   	ZEND_NULL_HANDLER,
42248   	ZEND_BRK_SPEC_CONST_HANDLER,
42249   	ZEND_NULL_HANDLER,
42250   	ZEND_NULL_HANDLER,
42251   	ZEND_NULL_HANDLER,
42252   	ZEND_NULL_HANDLER,
42253   	ZEND_BRK_SPEC_CONST_HANDLER,
42254   	ZEND_NULL_HANDLER,
42255   	ZEND_NULL_HANDLER,
42256   	ZEND_NULL_HANDLER,
42257   	ZEND_NULL_HANDLER,
42258   	ZEND_BRK_SPEC_CONST_HANDLER,
42259   	ZEND_NULL_HANDLER,
42260   	ZEND_NULL_HANDLER,
42261   	ZEND_NULL_HANDLER,
42262   	ZEND_NULL_HANDLER,
42263   	ZEND_BRK_SPEC_CONST_HANDLER,
42264   	ZEND_NULL_HANDLER,
42265   	ZEND_NULL_HANDLER,
42266   	ZEND_NULL_HANDLER,
42267   	ZEND_NULL_HANDLER,
42268   	ZEND_CONT_SPEC_CONST_HANDLER,
42269   	ZEND_NULL_HANDLER,
42270   	ZEND_NULL_HANDLER,
42271   	ZEND_NULL_HANDLER,
42272   	ZEND_NULL_HANDLER,
42273   	ZEND_CONT_SPEC_CONST_HANDLER,
42274   	ZEND_NULL_HANDLER,
42275   	ZEND_NULL_HANDLER,
42276   	ZEND_NULL_HANDLER,
42277   	ZEND_NULL_HANDLER,
42278   	ZEND_CONT_SPEC_CONST_HANDLER,
42279   	ZEND_NULL_HANDLER,
42280   	ZEND_NULL_HANDLER,
42281   	ZEND_NULL_HANDLER,
42282   	ZEND_NULL_HANDLER,
42283   	ZEND_CONT_SPEC_CONST_HANDLER,
42284   	ZEND_NULL_HANDLER,
42285   	ZEND_NULL_HANDLER,
42286   	ZEND_NULL_HANDLER,
42287   	ZEND_NULL_HANDLER,
42288   	ZEND_CONT_SPEC_CONST_HANDLER,
42289   	ZEND_NULL_HANDLER,
42290   	ZEND_NULL_HANDLER,
42291   	ZEND_NULL_HANDLER,
42292   	ZEND_NULL_HANDLER,
42293   	ZEND_BOOL_SPEC_CONST_HANDLER,
42294   	ZEND_BOOL_SPEC_CONST_HANDLER,
42295   	ZEND_BOOL_SPEC_CONST_HANDLER,
42296   	ZEND_BOOL_SPEC_CONST_HANDLER,
42297   	ZEND_BOOL_SPEC_CONST_HANDLER,
42298   	ZEND_BOOL_SPEC_TMP_HANDLER,
42299   	ZEND_BOOL_SPEC_TMP_HANDLER,
42300   	ZEND_BOOL_SPEC_TMP_HANDLER,
42301   	ZEND_BOOL_SPEC_TMP_HANDLER,
42302   	ZEND_BOOL_SPEC_TMP_HANDLER,
42303   	ZEND_BOOL_SPEC_VAR_HANDLER,
42304   	ZEND_BOOL_SPEC_VAR_HANDLER,
42305   	ZEND_BOOL_SPEC_VAR_HANDLER,
42306   	ZEND_BOOL_SPEC_VAR_HANDLER,
42307   	ZEND_BOOL_SPEC_VAR_HANDLER,
42308   	ZEND_NULL_HANDLER,
42309   	ZEND_NULL_HANDLER,
42310   	ZEND_NULL_HANDLER,
42311   	ZEND_NULL_HANDLER,
42312   	ZEND_NULL_HANDLER,
42313   	ZEND_BOOL_SPEC_CV_HANDLER,
42314   	ZEND_BOOL_SPEC_CV_HANDLER,
42315   	ZEND_BOOL_SPEC_CV_HANDLER,
42316   	ZEND_BOOL_SPEC_CV_HANDLER,
42317   	ZEND_BOOL_SPEC_CV_HANDLER,
42318   	ZEND_INIT_STRING_SPEC_HANDLER,
42319   	ZEND_INIT_STRING_SPEC_HANDLER,
42320   	ZEND_INIT_STRING_SPEC_HANDLER,
42321   	ZEND_INIT_STRING_SPEC_HANDLER,
42322   	ZEND_INIT_STRING_SPEC_HANDLER,
42323   	ZEND_INIT_STRING_SPEC_HANDLER,
42324   	ZEND_INIT_STRING_SPEC_HANDLER,
42325   	ZEND_INIT_STRING_SPEC_HANDLER,
42326   	ZEND_INIT_STRING_SPEC_HANDLER,
42327   	ZEND_INIT_STRING_SPEC_HANDLER,
42328   	ZEND_INIT_STRING_SPEC_HANDLER,
42329   	ZEND_INIT_STRING_SPEC_HANDLER,
42330   	ZEND_INIT_STRING_SPEC_HANDLER,
42331   	ZEND_INIT_STRING_SPEC_HANDLER,
42332   	ZEND_INIT_STRING_SPEC_HANDLER,
42333   	ZEND_INIT_STRING_SPEC_HANDLER,
42334   	ZEND_INIT_STRING_SPEC_HANDLER,
42335   	ZEND_INIT_STRING_SPEC_HANDLER,
42336   	ZEND_INIT_STRING_SPEC_HANDLER,
42337   	ZEND_INIT_STRING_SPEC_HANDLER,
42338   	ZEND_INIT_STRING_SPEC_HANDLER,
42339   	ZEND_INIT_STRING_SPEC_HANDLER,
42340   	ZEND_INIT_STRING_SPEC_HANDLER,
42341   	ZEND_INIT_STRING_SPEC_HANDLER,
42342   	ZEND_INIT_STRING_SPEC_HANDLER,
42343   	ZEND_NULL_HANDLER,
42344   	ZEND_NULL_HANDLER,
42345   	ZEND_NULL_HANDLER,
42346   	ZEND_NULL_HANDLER,
42347   	ZEND_NULL_HANDLER,
42348   	ZEND_ADD_CHAR_SPEC_TMP_CONST_HANDLER,
42349   	ZEND_NULL_HANDLER,
42350   	ZEND_NULL_HANDLER,
42351   	ZEND_NULL_HANDLER,
42352   	ZEND_NULL_HANDLER,
42353   	ZEND_NULL_HANDLER,
42354   	ZEND_NULL_HANDLER,
42355   	ZEND_NULL_HANDLER,
42356   	ZEND_NULL_HANDLER,
42357   	ZEND_NULL_HANDLER,
42358   	ZEND_ADD_CHAR_SPEC_UNUSED_CONST_HANDLER,
42359   	ZEND_NULL_HANDLER,
42360   	ZEND_NULL_HANDLER,
42361   	ZEND_NULL_HANDLER,
42362   	ZEND_NULL_HANDLER,
42363   	ZEND_NULL_HANDLER,
42364   	ZEND_NULL_HANDLER,
42365   	ZEND_NULL_HANDLER,
42366   	ZEND_NULL_HANDLER,
42367   	ZEND_NULL_HANDLER,
42368   	ZEND_NULL_HANDLER,
42369   	ZEND_NULL_HANDLER,
42370   	ZEND_NULL_HANDLER,
42371   	ZEND_NULL_HANDLER,
42372   	ZEND_NULL_HANDLER,
42373   	ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER,
42374   	ZEND_NULL_HANDLER,
42375   	ZEND_NULL_HANDLER,
42376   	ZEND_NULL_HANDLER,
42377   	ZEND_NULL_HANDLER,
42378   	ZEND_NULL_HANDLER,
42379   	ZEND_NULL_HANDLER,
42380   	ZEND_NULL_HANDLER,
42381   	ZEND_NULL_HANDLER,
42382   	ZEND_NULL_HANDLER,
42383   	ZEND_ADD_STRING_SPEC_UNUSED_CONST_HANDLER,
42384   	ZEND_NULL_HANDLER,
42385   	ZEND_NULL_HANDLER,
42386   	ZEND_NULL_HANDLER,
42387   	ZEND_NULL_HANDLER,
42388   	ZEND_NULL_HANDLER,
42389   	ZEND_NULL_HANDLER,
42390   	ZEND_NULL_HANDLER,
42391   	ZEND_NULL_HANDLER,
42392   	ZEND_NULL_HANDLER,
42393   	ZEND_NULL_HANDLER,
42394   	ZEND_NULL_HANDLER,
42395   	ZEND_NULL_HANDLER,
42396   	ZEND_NULL_HANDLER,
42397   	ZEND_NULL_HANDLER,
42398   	ZEND_NULL_HANDLER,
42399   	ZEND_ADD_VAR_SPEC_TMP_TMP_HANDLER,
42400   	ZEND_ADD_VAR_SPEC_TMP_VAR_HANDLER,
42401   	ZEND_NULL_HANDLER,
42402   	ZEND_ADD_VAR_SPEC_TMP_CV_HANDLER,
42403   	ZEND_NULL_HANDLER,
42404   	ZEND_NULL_HANDLER,
42405   	ZEND_NULL_HANDLER,
42406   	ZEND_NULL_HANDLER,
42407   	ZEND_NULL_HANDLER,
42408   	ZEND_NULL_HANDLER,
42409   	ZEND_ADD_VAR_SPEC_UNUSED_TMP_HANDLER,
42410   	ZEND_ADD_VAR_SPEC_UNUSED_VAR_HANDLER,
42411   	ZEND_NULL_HANDLER,
42412   	ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER,
42413   	ZEND_NULL_HANDLER,
42414   	ZEND_NULL_HANDLER,
42415   	ZEND_NULL_HANDLER,
42416   	ZEND_NULL_HANDLER,
42417   	ZEND_NULL_HANDLER,
42418   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42419   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42420   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42421   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42422   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42423   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42424   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42425   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42426   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42427   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42428   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42429   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42430   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42431   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42432   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42433   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42434   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42435   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42436   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42437   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42438   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42439   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42440   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42441   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42442   	ZEND_BEGIN_SILENCE_SPEC_HANDLER,
42443   	ZEND_NULL_HANDLER,
42444   	ZEND_NULL_HANDLER,
42445   	ZEND_NULL_HANDLER,
42446   	ZEND_NULL_HANDLER,
42447   	ZEND_NULL_HANDLER,
42448   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
42449   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
42450   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
42451   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
42452   	ZEND_END_SILENCE_SPEC_TMP_HANDLER,
42453   	ZEND_NULL_HANDLER,
42454   	ZEND_NULL_HANDLER,
42455   	ZEND_NULL_HANDLER,
42456   	ZEND_NULL_HANDLER,
42457   	ZEND_NULL_HANDLER,
42458   	ZEND_NULL_HANDLER,
42459   	ZEND_NULL_HANDLER,
42460   	ZEND_NULL_HANDLER,
42461   	ZEND_NULL_HANDLER,
42462   	ZEND_NULL_HANDLER,
42463   	ZEND_NULL_HANDLER,
42464   	ZEND_NULL_HANDLER,
42465   	ZEND_NULL_HANDLER,
42466   	ZEND_NULL_HANDLER,
42467   	ZEND_NULL_HANDLER,
42468   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42469   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
42470   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
42471   	ZEND_NULL_HANDLER,
42472   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
42473   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42474   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
42475   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
42476   	ZEND_NULL_HANDLER,
42477   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
42478   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42479   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
42480   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
42481   	ZEND_NULL_HANDLER,
42482   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
42483   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42484   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
42485   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
42486   	ZEND_NULL_HANDLER,
42487   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
42488   	ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42489   	ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER,
42490   	ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER,
42491   	ZEND_NULL_HANDLER,
42492   	ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER,
42493   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
42494   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
42495   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
42496   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
42497   	ZEND_DO_FCALL_SPEC_CONST_HANDLER,
42498   	ZEND_NULL_HANDLER,
42499   	ZEND_NULL_HANDLER,
42500   	ZEND_NULL_HANDLER,
42501   	ZEND_NULL_HANDLER,
42502   	ZEND_NULL_HANDLER,
42503   	ZEND_NULL_HANDLER,
42504   	ZEND_NULL_HANDLER,
42505   	ZEND_NULL_HANDLER,
42506   	ZEND_NULL_HANDLER,
42507   	ZEND_NULL_HANDLER,
42508   	ZEND_NULL_HANDLER,
42509   	ZEND_NULL_HANDLER,
42510   	ZEND_NULL_HANDLER,
42511   	ZEND_NULL_HANDLER,
42512   	ZEND_NULL_HANDLER,
42513   	ZEND_NULL_HANDLER,
42514   	ZEND_NULL_HANDLER,
42515   	ZEND_NULL_HANDLER,
42516   	ZEND_NULL_HANDLER,
42517   	ZEND_NULL_HANDLER,
42518   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42519   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42520   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42521   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42522   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42523   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42524   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42525   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42526   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42527   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42528   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42529   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42530   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42531   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42532   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42533   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42534   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42535   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42536   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42537   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42538   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42539   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42540   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42541   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42542   	ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER,
42543   	ZEND_RETURN_SPEC_CONST_HANDLER,
42544   	ZEND_RETURN_SPEC_CONST_HANDLER,
42545   	ZEND_RETURN_SPEC_CONST_HANDLER,
42546   	ZEND_RETURN_SPEC_CONST_HANDLER,
42547   	ZEND_RETURN_SPEC_CONST_HANDLER,
42548   	ZEND_RETURN_SPEC_TMP_HANDLER,
42549   	ZEND_RETURN_SPEC_TMP_HANDLER,
42550   	ZEND_RETURN_SPEC_TMP_HANDLER,
42551   	ZEND_RETURN_SPEC_TMP_HANDLER,
42552   	ZEND_RETURN_SPEC_TMP_HANDLER,
42553   	ZEND_RETURN_SPEC_VAR_HANDLER,
42554   	ZEND_RETURN_SPEC_VAR_HANDLER,
42555   	ZEND_RETURN_SPEC_VAR_HANDLER,
42556   	ZEND_RETURN_SPEC_VAR_HANDLER,
42557   	ZEND_RETURN_SPEC_VAR_HANDLER,
42558   	ZEND_NULL_HANDLER,
42559   	ZEND_NULL_HANDLER,
42560   	ZEND_NULL_HANDLER,
42561   	ZEND_NULL_HANDLER,
42562   	ZEND_NULL_HANDLER,
42563   	ZEND_RETURN_SPEC_CV_HANDLER,
42564   	ZEND_RETURN_SPEC_CV_HANDLER,
42565   	ZEND_RETURN_SPEC_CV_HANDLER,
42566   	ZEND_RETURN_SPEC_CV_HANDLER,
42567   	ZEND_RETURN_SPEC_CV_HANDLER,
42568   	ZEND_RECV_SPEC_HANDLER,
42569   	ZEND_RECV_SPEC_HANDLER,
42570   	ZEND_RECV_SPEC_HANDLER,
42571   	ZEND_RECV_SPEC_HANDLER,
42572   	ZEND_RECV_SPEC_HANDLER,
42573   	ZEND_RECV_SPEC_HANDLER,
42574   	ZEND_RECV_SPEC_HANDLER,
42575   	ZEND_RECV_SPEC_HANDLER,
42576   	ZEND_RECV_SPEC_HANDLER,
42577   	ZEND_RECV_SPEC_HANDLER,
42578   	ZEND_RECV_SPEC_HANDLER,
42579   	ZEND_RECV_SPEC_HANDLER,
42580   	ZEND_RECV_SPEC_HANDLER,
42581   	ZEND_RECV_SPEC_HANDLER,
42582   	ZEND_RECV_SPEC_HANDLER,
42583   	ZEND_RECV_SPEC_HANDLER,
42584   	ZEND_RECV_SPEC_HANDLER,
42585   	ZEND_RECV_SPEC_HANDLER,
42586   	ZEND_RECV_SPEC_HANDLER,
42587   	ZEND_RECV_SPEC_HANDLER,
42588   	ZEND_RECV_SPEC_HANDLER,
42589   	ZEND_RECV_SPEC_HANDLER,
42590   	ZEND_RECV_SPEC_HANDLER,
42591   	ZEND_RECV_SPEC_HANDLER,
42592   	ZEND_RECV_SPEC_HANDLER,
42593   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
42594   	ZEND_NULL_HANDLER,
42595   	ZEND_NULL_HANDLER,
42596   	ZEND_NULL_HANDLER,
42597   	ZEND_NULL_HANDLER,
42598   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
42599   	ZEND_NULL_HANDLER,
42600   	ZEND_NULL_HANDLER,
42601   	ZEND_NULL_HANDLER,
42602   	ZEND_NULL_HANDLER,
42603   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
42604   	ZEND_NULL_HANDLER,
42605   	ZEND_NULL_HANDLER,
42606   	ZEND_NULL_HANDLER,
42607   	ZEND_NULL_HANDLER,
42608   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
42609   	ZEND_NULL_HANDLER,
42610   	ZEND_NULL_HANDLER,
42611   	ZEND_NULL_HANDLER,
42612   	ZEND_NULL_HANDLER,
42613   	ZEND_RECV_INIT_SPEC_CONST_HANDLER,
42614   	ZEND_NULL_HANDLER,
42615   	ZEND_NULL_HANDLER,
42616   	ZEND_NULL_HANDLER,
42617   	ZEND_NULL_HANDLER,
42618   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
42619   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
42620   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
42621   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
42622   	ZEND_SEND_VAL_SPEC_CONST_HANDLER,
42623   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
42624   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
42625   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
42626   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
42627   	ZEND_SEND_VAL_SPEC_TMP_HANDLER,
42628   	ZEND_NULL_HANDLER,
42629   	ZEND_NULL_HANDLER,
42630   	ZEND_NULL_HANDLER,
42631   	ZEND_NULL_HANDLER,
42632   	ZEND_NULL_HANDLER,
42633   	ZEND_NULL_HANDLER,
42634   	ZEND_NULL_HANDLER,
42635   	ZEND_NULL_HANDLER,
42636   	ZEND_NULL_HANDLER,
42637   	ZEND_NULL_HANDLER,
42638   	ZEND_NULL_HANDLER,
42639   	ZEND_NULL_HANDLER,
42640   	ZEND_NULL_HANDLER,
42641   	ZEND_NULL_HANDLER,
42642   	ZEND_NULL_HANDLER,
42643   	ZEND_NULL_HANDLER,
42644   	ZEND_NULL_HANDLER,
42645   	ZEND_NULL_HANDLER,
42646   	ZEND_NULL_HANDLER,
42647   	ZEND_NULL_HANDLER,
42648   	ZEND_NULL_HANDLER,
42649   	ZEND_NULL_HANDLER,
42650   	ZEND_NULL_HANDLER,
42651   	ZEND_NULL_HANDLER,
42652   	ZEND_NULL_HANDLER,
42653   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
42654   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
42655   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
42656   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
42657   	ZEND_SEND_VAR_SPEC_VAR_HANDLER,
42658   	ZEND_NULL_HANDLER,
42659   	ZEND_NULL_HANDLER,
42660   	ZEND_NULL_HANDLER,
42661   	ZEND_NULL_HANDLER,
42662   	ZEND_NULL_HANDLER,
42663   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
42664   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
42665   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
42666   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
42667   	ZEND_SEND_VAR_SPEC_CV_HANDLER,
42668   	ZEND_NULL_HANDLER,
42669   	ZEND_NULL_HANDLER,
42670   	ZEND_NULL_HANDLER,
42671   	ZEND_NULL_HANDLER,
42672   	ZEND_NULL_HANDLER,
42673   	ZEND_NULL_HANDLER,
42674   	ZEND_NULL_HANDLER,
42675   	ZEND_NULL_HANDLER,
42676   	ZEND_NULL_HANDLER,
42677   	ZEND_NULL_HANDLER,
42678   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
42679   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
42680   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
42681   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
42682   	ZEND_SEND_REF_SPEC_VAR_HANDLER,
42683   	ZEND_NULL_HANDLER,
42684   	ZEND_NULL_HANDLER,
42685   	ZEND_NULL_HANDLER,
42686   	ZEND_NULL_HANDLER,
42687   	ZEND_NULL_HANDLER,
42688   	ZEND_SEND_REF_SPEC_CV_HANDLER,
42689   	ZEND_SEND_REF_SPEC_CV_HANDLER,
42690   	ZEND_SEND_REF_SPEC_CV_HANDLER,
42691   	ZEND_SEND_REF_SPEC_CV_HANDLER,
42692   	ZEND_SEND_REF_SPEC_CV_HANDLER,
42693   	ZEND_NEW_SPEC_HANDLER,
42694   	ZEND_NEW_SPEC_HANDLER,
42695   	ZEND_NEW_SPEC_HANDLER,
42696   	ZEND_NEW_SPEC_HANDLER,
42697   	ZEND_NEW_SPEC_HANDLER,
42698   	ZEND_NEW_SPEC_HANDLER,
42699   	ZEND_NEW_SPEC_HANDLER,
42700   	ZEND_NEW_SPEC_HANDLER,
42701   	ZEND_NEW_SPEC_HANDLER,
42702   	ZEND_NEW_SPEC_HANDLER,
42703   	ZEND_NEW_SPEC_HANDLER,
42704   	ZEND_NEW_SPEC_HANDLER,
42705   	ZEND_NEW_SPEC_HANDLER,
42706   	ZEND_NEW_SPEC_HANDLER,
42707   	ZEND_NEW_SPEC_HANDLER,
42708   	ZEND_NEW_SPEC_HANDLER,
42709   	ZEND_NEW_SPEC_HANDLER,
42710   	ZEND_NEW_SPEC_HANDLER,
42711   	ZEND_NEW_SPEC_HANDLER,
42712   	ZEND_NEW_SPEC_HANDLER,
42713   	ZEND_NEW_SPEC_HANDLER,
42714   	ZEND_NEW_SPEC_HANDLER,
42715   	ZEND_NEW_SPEC_HANDLER,
42716   	ZEND_NEW_SPEC_HANDLER,
42717   	ZEND_NEW_SPEC_HANDLER,
42718   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42719   	ZEND_NULL_HANDLER,
42720   	ZEND_NULL_HANDLER,
42721   	ZEND_NULL_HANDLER,
42722   	ZEND_NULL_HANDLER,
42723   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42724   	ZEND_NULL_HANDLER,
42725   	ZEND_NULL_HANDLER,
42726   	ZEND_NULL_HANDLER,
42727   	ZEND_NULL_HANDLER,
42728   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42729   	ZEND_NULL_HANDLER,
42730   	ZEND_NULL_HANDLER,
42731   	ZEND_NULL_HANDLER,
42732   	ZEND_NULL_HANDLER,
42733   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42734   	ZEND_NULL_HANDLER,
42735   	ZEND_NULL_HANDLER,
42736   	ZEND_NULL_HANDLER,
42737   	ZEND_NULL_HANDLER,
42738   	ZEND_INIT_NS_FCALL_BY_NAME_SPEC_CONST_HANDLER,
42739   	ZEND_NULL_HANDLER,
42740   	ZEND_NULL_HANDLER,
42741   	ZEND_NULL_HANDLER,
42742   	ZEND_NULL_HANDLER,
42743   	ZEND_NULL_HANDLER,
42744   	ZEND_NULL_HANDLER,
42745   	ZEND_NULL_HANDLER,
42746   	ZEND_NULL_HANDLER,
42747   	ZEND_NULL_HANDLER,
42748   	ZEND_FREE_SPEC_TMP_HANDLER,
42749   	ZEND_FREE_SPEC_TMP_HANDLER,
42750   	ZEND_FREE_SPEC_TMP_HANDLER,
42751   	ZEND_FREE_SPEC_TMP_HANDLER,
42752   	ZEND_FREE_SPEC_TMP_HANDLER,
42753   	ZEND_FREE_SPEC_VAR_HANDLER,
42754   	ZEND_FREE_SPEC_VAR_HANDLER,
42755   	ZEND_FREE_SPEC_VAR_HANDLER,
42756   	ZEND_FREE_SPEC_VAR_HANDLER,
42757   	ZEND_FREE_SPEC_VAR_HANDLER,
42758   	ZEND_NULL_HANDLER,
42759   	ZEND_NULL_HANDLER,
42760   	ZEND_NULL_HANDLER,
42761   	ZEND_NULL_HANDLER,
42762   	ZEND_NULL_HANDLER,
42763   	ZEND_NULL_HANDLER,
42764   	ZEND_NULL_HANDLER,
42765   	ZEND_NULL_HANDLER,
42766   	ZEND_NULL_HANDLER,
42767   	ZEND_NULL_HANDLER,
42768   	ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER,
42769   	ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER,
42770   	ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER,
42771   	ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER,
42772   	ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER,
42773   	ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER,
42774   	ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER,
42775   	ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER,
42776   	ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER,
42777   	ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER,
42778   	ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER,
42779   	ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER,
42780   	ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER,
42781   	ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER,
42782   	ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER,
42783   	ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER,
42784   	ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER,
42785   	ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER,
42786   	ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER,
42787   	ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER,
42788   	ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER,
42789   	ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER,
42790   	ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER,
42791   	ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER,
42792   	ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER,
42793   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER,
42794   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER,
42795   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER,
42796   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER,
42797   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER,
42798   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER,
42799   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER,
42800   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER,
42801   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER,
42802   	ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER,
42803   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER,
42804   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER,
42805   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER,
42806   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER,
42807   	ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER,
42808   	ZEND_NULL_HANDLER,
42809   	ZEND_NULL_HANDLER,
42810   	ZEND_NULL_HANDLER,
42811   	ZEND_NULL_HANDLER,
42812   	ZEND_NULL_HANDLER,
42813   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER,
42814   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER,
42815   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER,
42816   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER,
42817   	ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER,
42818   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
42819   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
42820   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
42821   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
42822   	ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER,
42823   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
42824   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
42825   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
42826   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
42827   	ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER,
42828   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
42829   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
42830   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
42831   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
42832   	ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER,
42833   	ZEND_NULL_HANDLER,
42834   	ZEND_NULL_HANDLER,
42835   	ZEND_NULL_HANDLER,
42836   	ZEND_NULL_HANDLER,
42837   	ZEND_NULL_HANDLER,
42838   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
42839   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
42840   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
42841   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
42842   	ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER,
42843   	ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER,
42844   	ZEND_NULL_HANDLER,
42845   	ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER,
42846   	ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER,
42847   	ZEND_NULL_HANDLER,
42848   	ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER,
42849   	ZEND_NULL_HANDLER,
42850   	ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER,
42851   	ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER,
42852   	ZEND_NULL_HANDLER,
42853   	ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER,
42854   	ZEND_NULL_HANDLER,
42855   	ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER,
42856   	ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER,
42857   	ZEND_NULL_HANDLER,
42858   	ZEND_NULL_HANDLER,
42859   	ZEND_NULL_HANDLER,
42860   	ZEND_NULL_HANDLER,
42861   	ZEND_NULL_HANDLER,
42862   	ZEND_NULL_HANDLER,
42863   	ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER,
42864   	ZEND_NULL_HANDLER,
42865   	ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER,
42866   	ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER,
42867   	ZEND_NULL_HANDLER,
42868   	ZEND_NULL_HANDLER,
42869   	ZEND_NULL_HANDLER,
42870   	ZEND_NULL_HANDLER,
42871   	ZEND_NULL_HANDLER,
42872   	ZEND_NULL_HANDLER,
42873   	ZEND_NULL_HANDLER,
42874   	ZEND_NULL_HANDLER,
42875   	ZEND_NULL_HANDLER,
42876   	ZEND_NULL_HANDLER,
42877   	ZEND_NULL_HANDLER,
42878   	ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER,
42879   	ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER,
42880   	ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER,
42881   	ZEND_NULL_HANDLER,
42882   	ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER,
42883   	ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER,
42884   	ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER,
42885   	ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER,
42886   	ZEND_NULL_HANDLER,
42887   	ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER,
42888   	ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER,
42889   	ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER,
42890   	ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER,
42891   	ZEND_NULL_HANDLER,
42892   	ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER,
42893   	ZEND_NULL_HANDLER,
42894   	ZEND_NULL_HANDLER,
42895   	ZEND_NULL_HANDLER,
42896   	ZEND_NULL_HANDLER,
42897   	ZEND_NULL_HANDLER,
42898   	ZEND_NULL_HANDLER,
42899   	ZEND_NULL_HANDLER,
42900   	ZEND_NULL_HANDLER,
42901   	ZEND_NULL_HANDLER,
42902   	ZEND_NULL_HANDLER,
42903   	ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER,
42904   	ZEND_UNSET_OBJ_SPEC_VAR_TMP_HANDLER,
42905   	ZEND_UNSET_OBJ_SPEC_VAR_VAR_HANDLER,
42906   	ZEND_NULL_HANDLER,
42907   	ZEND_UNSET_OBJ_SPEC_VAR_CV_HANDLER,
42908   	ZEND_UNSET_OBJ_SPEC_UNUSED_CONST_HANDLER,
42909   	ZEND_UNSET_OBJ_SPEC_UNUSED_TMP_HANDLER,
42910   	ZEND_UNSET_OBJ_SPEC_UNUSED_VAR_HANDLER,
42911   	ZEND_NULL_HANDLER,
42912   	ZEND_UNSET_OBJ_SPEC_UNUSED_CV_HANDLER,
42913   	ZEND_UNSET_OBJ_SPEC_CV_CONST_HANDLER,
42914   	ZEND_UNSET_OBJ_SPEC_CV_TMP_HANDLER,
42915   	ZEND_UNSET_OBJ_SPEC_CV_VAR_HANDLER,
42916   	ZEND_NULL_HANDLER,
42917   	ZEND_UNSET_OBJ_SPEC_CV_CV_HANDLER,
42918   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
42919   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
42920   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
42921   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
42922   	ZEND_FE_RESET_SPEC_CONST_HANDLER,
42923   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
42924   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
42925   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
42926   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
42927   	ZEND_FE_RESET_SPEC_TMP_HANDLER,
42928   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
42929   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
42930   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
42931   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
42932   	ZEND_FE_RESET_SPEC_VAR_HANDLER,
42933   	ZEND_NULL_HANDLER,
42934   	ZEND_NULL_HANDLER,
42935   	ZEND_NULL_HANDLER,
42936   	ZEND_NULL_HANDLER,
42937   	ZEND_NULL_HANDLER,
42938   	ZEND_FE_RESET_SPEC_CV_HANDLER,
42939   	ZEND_FE_RESET_SPEC_CV_HANDLER,
42940   	ZEND_FE_RESET_SPEC_CV_HANDLER,
42941   	ZEND_FE_RESET_SPEC_CV_HANDLER,
42942   	ZEND_FE_RESET_SPEC_CV_HANDLER,
42943   	ZEND_NULL_HANDLER,
42944   	ZEND_NULL_HANDLER,
42945   	ZEND_NULL_HANDLER,
42946   	ZEND_NULL_HANDLER,
42947   	ZEND_NULL_HANDLER,
42948   	ZEND_NULL_HANDLER,
42949   	ZEND_NULL_HANDLER,
42950   	ZEND_NULL_HANDLER,
42951   	ZEND_NULL_HANDLER,
42952   	ZEND_NULL_HANDLER,
42953   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
42954   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
42955   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
42956   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
42957   	ZEND_FE_FETCH_SPEC_VAR_HANDLER,
42958   	ZEND_NULL_HANDLER,
42959   	ZEND_NULL_HANDLER,
42960   	ZEND_NULL_HANDLER,
42961   	ZEND_NULL_HANDLER,
42962   	ZEND_NULL_HANDLER,
42963   	ZEND_NULL_HANDLER,
42964   	ZEND_NULL_HANDLER,
42965   	ZEND_NULL_HANDLER,
42966   	ZEND_NULL_HANDLER,
42967   	ZEND_NULL_HANDLER,
42968   	ZEND_EXIT_SPEC_CONST_HANDLER,
42969   	ZEND_EXIT_SPEC_CONST_HANDLER,
42970   	ZEND_EXIT_SPEC_CONST_HANDLER,
42971   	ZEND_EXIT_SPEC_CONST_HANDLER,
42972   	ZEND_EXIT_SPEC_CONST_HANDLER,
42973   	ZEND_EXIT_SPEC_TMP_HANDLER,
42974   	ZEND_EXIT_SPEC_TMP_HANDLER,
42975   	ZEND_EXIT_SPEC_TMP_HANDLER,
42976   	ZEND_EXIT_SPEC_TMP_HANDLER,
42977   	ZEND_EXIT_SPEC_TMP_HANDLER,
42978   	ZEND_EXIT_SPEC_VAR_HANDLER,
42979   	ZEND_EXIT_SPEC_VAR_HANDLER,
42980   	ZEND_EXIT_SPEC_VAR_HANDLER,
42981   	ZEND_EXIT_SPEC_VAR_HANDLER,
42982   	ZEND_EXIT_SPEC_VAR_HANDLER,
42983   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
42984   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
42985   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
42986   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
42987   	ZEND_EXIT_SPEC_UNUSED_HANDLER,
42988   	ZEND_EXIT_SPEC_CV_HANDLER,
42989   	ZEND_EXIT_SPEC_CV_HANDLER,
42990   	ZEND_EXIT_SPEC_CV_HANDLER,
42991   	ZEND_EXIT_SPEC_CV_HANDLER,
42992   	ZEND_EXIT_SPEC_CV_HANDLER,
42993   	ZEND_FETCH_R_SPEC_CONST_CONST_HANDLER,
42994   	ZEND_NULL_HANDLER,
42995   	ZEND_FETCH_R_SPEC_CONST_VAR_HANDLER,
42996   	ZEND_FETCH_R_SPEC_CONST_UNUSED_HANDLER,
42997   	ZEND_NULL_HANDLER,
42998   	ZEND_FETCH_R_SPEC_TMP_CONST_HANDLER,
42999   	ZEND_NULL_HANDLER,
43000   	ZEND_FETCH_R_SPEC_TMP_VAR_HANDLER,
43001   	ZEND_FETCH_R_SPEC_TMP_UNUSED_HANDLER,
43002   	ZEND_NULL_HANDLER,
43003   	ZEND_FETCH_R_SPEC_VAR_CONST_HANDLER,
43004   	ZEND_NULL_HANDLER,
43005   	ZEND_FETCH_R_SPEC_VAR_VAR_HANDLER,
43006   	ZEND_FETCH_R_SPEC_VAR_UNUSED_HANDLER,
43007   	ZEND_NULL_HANDLER,
43008   	ZEND_NULL_HANDLER,
43009   	ZEND_NULL_HANDLER,
43010   	ZEND_NULL_HANDLER,
43011   	ZEND_NULL_HANDLER,
43012   	ZEND_NULL_HANDLER,
43013   	ZEND_FETCH_R_SPEC_CV_CONST_HANDLER,
43014   	ZEND_NULL_HANDLER,
43015   	ZEND_FETCH_R_SPEC_CV_VAR_HANDLER,
43016   	ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER,
43017   	ZEND_NULL_HANDLER,
43018   	ZEND_FETCH_DIM_R_SPEC_CONST_CONST_HANDLER,
43019   	ZEND_FETCH_DIM_R_SPEC_CONST_TMP_HANDLER,
43020   	ZEND_FETCH_DIM_R_SPEC_CONST_VAR_HANDLER,
43021   	ZEND_NULL_HANDLER,
43022   	ZEND_FETCH_DIM_R_SPEC_CONST_CV_HANDLER,
43023   	ZEND_FETCH_DIM_R_SPEC_TMP_CONST_HANDLER,
43024   	ZEND_FETCH_DIM_R_SPEC_TMP_TMP_HANDLER,
43025   	ZEND_FETCH_DIM_R_SPEC_TMP_VAR_HANDLER,
43026   	ZEND_NULL_HANDLER,
43027   	ZEND_FETCH_DIM_R_SPEC_TMP_CV_HANDLER,
43028   	ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER,
43029   	ZEND_FETCH_DIM_R_SPEC_VAR_TMP_HANDLER,
43030   	ZEND_FETCH_DIM_R_SPEC_VAR_VAR_HANDLER,
43031   	ZEND_NULL_HANDLER,
43032   	ZEND_FETCH_DIM_R_SPEC_VAR_CV_HANDLER,
43033   	ZEND_NULL_HANDLER,
43034   	ZEND_NULL_HANDLER,
43035   	ZEND_NULL_HANDLER,
43036   	ZEND_NULL_HANDLER,
43037   	ZEND_NULL_HANDLER,
43038   	ZEND_FETCH_DIM_R_SPEC_CV_CONST_HANDLER,
43039   	ZEND_FETCH_DIM_R_SPEC_CV_TMP_HANDLER,
43040   	ZEND_FETCH_DIM_R_SPEC_CV_VAR_HANDLER,
43041   	ZEND_NULL_HANDLER,
43042   	ZEND_FETCH_DIM_R_SPEC_CV_CV_HANDLER,
43043   	ZEND_NULL_HANDLER,
43044   	ZEND_NULL_HANDLER,
43045   	ZEND_NULL_HANDLER,
43046   	ZEND_NULL_HANDLER,
43047   	ZEND_NULL_HANDLER,
43048   	ZEND_NULL_HANDLER,
43049   	ZEND_NULL_HANDLER,
43050   	ZEND_NULL_HANDLER,
43051   	ZEND_NULL_HANDLER,
43052   	ZEND_NULL_HANDLER,
43053   	ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER,
43054   	ZEND_FETCH_OBJ_R_SPEC_VAR_TMP_HANDLER,
43055   	ZEND_FETCH_OBJ_R_SPEC_VAR_VAR_HANDLER,
43056   	ZEND_NULL_HANDLER,
43057   	ZEND_FETCH_OBJ_R_SPEC_VAR_CV_HANDLER,
43058   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER,
43059   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_TMP_HANDLER,
43060   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_VAR_HANDLER,
43061   	ZEND_NULL_HANDLER,
43062   	ZEND_FETCH_OBJ_R_SPEC_UNUSED_CV_HANDLER,
43063   	ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER,
43064   	ZEND_FETCH_OBJ_R_SPEC_CV_TMP_HANDLER,
43065   	ZEND_FETCH_OBJ_R_SPEC_CV_VAR_HANDLER,
43066   	ZEND_NULL_HANDLER,
43067   	ZEND_FETCH_OBJ_R_SPEC_CV_CV_HANDLER,
43068   	ZEND_FETCH_W_SPEC_CONST_CONST_HANDLER,
43069   	ZEND_NULL_HANDLER,
43070   	ZEND_FETCH_W_SPEC_CONST_VAR_HANDLER,
43071   	ZEND_FETCH_W_SPEC_CONST_UNUSED_HANDLER,
43072   	ZEND_NULL_HANDLER,
43073   	ZEND_FETCH_W_SPEC_TMP_CONST_HANDLER,
43074   	ZEND_NULL_HANDLER,
43075   	ZEND_FETCH_W_SPEC_TMP_VAR_HANDLER,
43076   	ZEND_FETCH_W_SPEC_TMP_UNUSED_HANDLER,
43077   	ZEND_NULL_HANDLER,
43078   	ZEND_FETCH_W_SPEC_VAR_CONST_HANDLER,
43079   	ZEND_NULL_HANDLER,
43080   	ZEND_FETCH_W_SPEC_VAR_VAR_HANDLER,
43081   	ZEND_FETCH_W_SPEC_VAR_UNUSED_HANDLER,
43082   	ZEND_NULL_HANDLER,
43083   	ZEND_NULL_HANDLER,
43084   	ZEND_NULL_HANDLER,
43085   	ZEND_NULL_HANDLER,
43086   	ZEND_NULL_HANDLER,
43087   	ZEND_NULL_HANDLER,
43088   	ZEND_FETCH_W_SPEC_CV_CONST_HANDLER,
43089   	ZEND_NULL_HANDLER,
43090   	ZEND_FETCH_W_SPEC_CV_VAR_HANDLER,
43091   	ZEND_FETCH_W_SPEC_CV_UNUSED_HANDLER,
43092   	ZEND_NULL_HANDLER,
43093   	ZEND_NULL_HANDLER,
43094   	ZEND_NULL_HANDLER,
43095   	ZEND_NULL_HANDLER,
43096   	ZEND_NULL_HANDLER,
43097   	ZEND_NULL_HANDLER,
43098   	ZEND_NULL_HANDLER,
43099   	ZEND_NULL_HANDLER,
43100   	ZEND_NULL_HANDLER,
43101   	ZEND_NULL_HANDLER,
43102   	ZEND_NULL_HANDLER,
43103   	ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER,
43104   	ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER,
43105   	ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER,
43106   	ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER,
43107   	ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER,
43108   	ZEND_NULL_HANDLER,
43109   	ZEND_NULL_HANDLER,
43110   	ZEND_NULL_HANDLER,
43111   	ZEND_NULL_HANDLER,
43112   	ZEND_NULL_HANDLER,
43113   	ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER,
43114   	ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER,
43115   	ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER,
43116   	ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER,
43117   	ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER,
43118   	ZEND_NULL_HANDLER,
43119   	ZEND_NULL_HANDLER,
43120   	ZEND_NULL_HANDLER,
43121   	ZEND_NULL_HANDLER,
43122   	ZEND_NULL_HANDLER,
43123   	ZEND_NULL_HANDLER,
43124   	ZEND_NULL_HANDLER,
43125   	ZEND_NULL_HANDLER,
43126   	ZEND_NULL_HANDLER,
43127   	ZEND_NULL_HANDLER,
43128   	ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER,
43129   	ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER,
43130   	ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER,
43131   	ZEND_NULL_HANDLER,
43132   	ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER,
43133   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER,
43134   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER,
43135   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER,
43136   	ZEND_NULL_HANDLER,
43137   	ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER,
43138   	ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER,
43139   	ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER,
43140   	ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER,
43141   	ZEND_NULL_HANDLER,
43142   	ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER,
43143   	ZEND_FETCH_RW_SPEC_CONST_CONST_HANDLER,
43144   	ZEND_NULL_HANDLER,
43145   	ZEND_FETCH_RW_SPEC_CONST_VAR_HANDLER,
43146   	ZEND_FETCH_RW_SPEC_CONST_UNUSED_HANDLER,
43147   	ZEND_NULL_HANDLER,
43148   	ZEND_FETCH_RW_SPEC_TMP_CONST_HANDLER,
43149   	ZEND_NULL_HANDLER,
43150   	ZEND_FETCH_RW_SPEC_TMP_VAR_HANDLER,
43151   	ZEND_FETCH_RW_SPEC_TMP_UNUSED_HANDLER,
43152   	ZEND_NULL_HANDLER,
43153   	ZEND_FETCH_RW_SPEC_VAR_CONST_HANDLER,
43154   	ZEND_NULL_HANDLER,
43155   	ZEND_FETCH_RW_SPEC_VAR_VAR_HANDLER,
43156   	ZEND_FETCH_RW_SPEC_VAR_UNUSED_HANDLER,
43157   	ZEND_NULL_HANDLER,
43158   	ZEND_NULL_HANDLER,
43159   	ZEND_NULL_HANDLER,
43160   	ZEND_NULL_HANDLER,
43161   	ZEND_NULL_HANDLER,
43162   	ZEND_NULL_HANDLER,
43163   	ZEND_FETCH_RW_SPEC_CV_CONST_HANDLER,
43164   	ZEND_NULL_HANDLER,
43165   	ZEND_FETCH_RW_SPEC_CV_VAR_HANDLER,
43166   	ZEND_FETCH_RW_SPEC_CV_UNUSED_HANDLER,
43167   	ZEND_NULL_HANDLER,
43168   	ZEND_NULL_HANDLER,
43169   	ZEND_NULL_HANDLER,
43170   	ZEND_NULL_HANDLER,
43171   	ZEND_NULL_HANDLER,
43172   	ZEND_NULL_HANDLER,
43173   	ZEND_NULL_HANDLER,
43174   	ZEND_NULL_HANDLER,
43175   	ZEND_NULL_HANDLER,
43176   	ZEND_NULL_HANDLER,
43177   	ZEND_NULL_HANDLER,
43178   	ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER,
43179   	ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER,
43180   	ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER,
43181   	ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER,
43182   	ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER,
43183   	ZEND_NULL_HANDLER,
43184   	ZEND_NULL_HANDLER,
43185   	ZEND_NULL_HANDLER,
43186   	ZEND_NULL_HANDLER,
43187   	ZEND_NULL_HANDLER,
43188   	ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER,
43189   	ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER,
43190   	ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER,
43191   	ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER,
43192   	ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER,
43193   	ZEND_NULL_HANDLER,
43194   	ZEND_NULL_HANDLER,
43195   	ZEND_NULL_HANDLER,
43196   	ZEND_NULL_HANDLER,
43197   	ZEND_NULL_HANDLER,
43198   	ZEND_NULL_HANDLER,
43199   	ZEND_NULL_HANDLER,
43200   	ZEND_NULL_HANDLER,
43201   	ZEND_NULL_HANDLER,
43202   	ZEND_NULL_HANDLER,
43203   	ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER,
43204   	ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER,
43205   	ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER,
43206   	ZEND_NULL_HANDLER,
43207   	ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER,
43208   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER,
43209   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER,
43210   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER,
43211   	ZEND_NULL_HANDLER,
43212   	ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER,
43213   	ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER,
43214   	ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER,
43215   	ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER,
43216   	ZEND_NULL_HANDLER,
43217   	ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER,
43218   	ZEND_FETCH_IS_SPEC_CONST_CONST_HANDLER,
43219   	ZEND_NULL_HANDLER,
43220   	ZEND_FETCH_IS_SPEC_CONST_VAR_HANDLER,
43221   	ZEND_FETCH_IS_SPEC_CONST_UNUSED_HANDLER,
43222   	ZEND_NULL_HANDLER,
43223   	ZEND_FETCH_IS_SPEC_TMP_CONST_HANDLER,
43224   	ZEND_NULL_HANDLER,
43225   	ZEND_FETCH_IS_SPEC_TMP_VAR_HANDLER,
43226   	ZEND_FETCH_IS_SPEC_TMP_UNUSED_HANDLER,
43227   	ZEND_NULL_HANDLER,
43228   	ZEND_FETCH_IS_SPEC_VAR_CONST_HANDLER,
43229   	ZEND_NULL_HANDLER,
43230   	ZEND_FETCH_IS_SPEC_VAR_VAR_HANDLER,
43231   	ZEND_FETCH_IS_SPEC_VAR_UNUSED_HANDLER,
43232   	ZEND_NULL_HANDLER,
43233   	ZEND_NULL_HANDLER,
43234   	ZEND_NULL_HANDLER,
43235   	ZEND_NULL_HANDLER,
43236   	ZEND_NULL_HANDLER,
43237   	ZEND_NULL_HANDLER,
43238   	ZEND_FETCH_IS_SPEC_CV_CONST_HANDLER,
43239   	ZEND_NULL_HANDLER,
43240   	ZEND_FETCH_IS_SPEC_CV_VAR_HANDLER,
43241   	ZEND_FETCH_IS_SPEC_CV_UNUSED_HANDLER,
43242   	ZEND_NULL_HANDLER,
43243   	ZEND_NULL_HANDLER,
43244   	ZEND_NULL_HANDLER,
43245   	ZEND_NULL_HANDLER,
43246   	ZEND_NULL_HANDLER,
43247   	ZEND_NULL_HANDLER,
43248   	ZEND_NULL_HANDLER,
43249   	ZEND_NULL_HANDLER,
43250   	ZEND_NULL_HANDLER,
43251   	ZEND_NULL_HANDLER,
43252   	ZEND_NULL_HANDLER,
43253   	ZEND_FETCH_DIM_IS_SPEC_VAR_CONST_HANDLER,
43254   	ZEND_FETCH_DIM_IS_SPEC_VAR_TMP_HANDLER,
43255   	ZEND_FETCH_DIM_IS_SPEC_VAR_VAR_HANDLER,
43256   	ZEND_NULL_HANDLER,
43257   	ZEND_FETCH_DIM_IS_SPEC_VAR_CV_HANDLER,
43258   	ZEND_NULL_HANDLER,
43259   	ZEND_NULL_HANDLER,
43260   	ZEND_NULL_HANDLER,
43261   	ZEND_NULL_HANDLER,
43262   	ZEND_NULL_HANDLER,
43263   	ZEND_FETCH_DIM_IS_SPEC_CV_CONST_HANDLER,
43264   	ZEND_FETCH_DIM_IS_SPEC_CV_TMP_HANDLER,
43265   	ZEND_FETCH_DIM_IS_SPEC_CV_VAR_HANDLER,
43266   	ZEND_NULL_HANDLER,
43267   	ZEND_FETCH_DIM_IS_SPEC_CV_CV_HANDLER,
43268   	ZEND_NULL_HANDLER,
43269   	ZEND_NULL_HANDLER,
43270   	ZEND_NULL_HANDLER,
43271   	ZEND_NULL_HANDLER,
43272   	ZEND_NULL_HANDLER,
43273   	ZEND_NULL_HANDLER,
43274   	ZEND_NULL_HANDLER,
43275   	ZEND_NULL_HANDLER,
43276   	ZEND_NULL_HANDLER,
43277   	ZEND_NULL_HANDLER,
43278   	ZEND_FETCH_OBJ_IS_SPEC_VAR_CONST_HANDLER,
43279   	ZEND_FETCH_OBJ_IS_SPEC_VAR_TMP_HANDLER,
43280   	ZEND_FETCH_OBJ_IS_SPEC_VAR_VAR_HANDLER,
43281   	ZEND_NULL_HANDLER,
43282   	ZEND_FETCH_OBJ_IS_SPEC_VAR_CV_HANDLER,
43283   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CONST_HANDLER,
43284   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_TMP_HANDLER,
43285   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_VAR_HANDLER,
43286   	ZEND_NULL_HANDLER,
43287   	ZEND_FETCH_OBJ_IS_SPEC_UNUSED_CV_HANDLER,
43288   	ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER,
43289   	ZEND_FETCH_OBJ_IS_SPEC_CV_TMP_HANDLER,
43290   	ZEND_FETCH_OBJ_IS_SPEC_CV_VAR_HANDLER,
43291   	ZEND_NULL_HANDLER,
43292   	ZEND_FETCH_OBJ_IS_SPEC_CV_CV_HANDLER,
43293   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_CONST_HANDLER,
43294   	ZEND_NULL_HANDLER,
43295   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_VAR_HANDLER,
43296   	ZEND_FETCH_FUNC_ARG_SPEC_CONST_UNUSED_HANDLER,
43297   	ZEND_NULL_HANDLER,
43298   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_CONST_HANDLER,
43299   	ZEND_NULL_HANDLER,
43300   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_VAR_HANDLER,
43301   	ZEND_FETCH_FUNC_ARG_SPEC_TMP_UNUSED_HANDLER,
43302   	ZEND_NULL_HANDLER,
43303   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
43304   	ZEND_NULL_HANDLER,
43305   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
43306   	ZEND_FETCH_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER,
43307   	ZEND_NULL_HANDLER,
43308   	ZEND_NULL_HANDLER,
43309   	ZEND_NULL_HANDLER,
43310   	ZEND_NULL_HANDLER,
43311   	ZEND_NULL_HANDLER,
43312   	ZEND_NULL_HANDLER,
43313   	ZEND_FETCH_FUNC_ARG_SPEC_CV_CONST_HANDLER,
43314   	ZEND_NULL_HANDLER,
43315   	ZEND_FETCH_FUNC_ARG_SPEC_CV_VAR_HANDLER,
43316   	ZEND_FETCH_FUNC_ARG_SPEC_CV_UNUSED_HANDLER,
43317   	ZEND_NULL_HANDLER,
43318   	ZEND_NULL_HANDLER,
43319   	ZEND_NULL_HANDLER,
43320   	ZEND_NULL_HANDLER,
43321   	ZEND_NULL_HANDLER,
43322   	ZEND_NULL_HANDLER,
43323   	ZEND_NULL_HANDLER,
43324   	ZEND_NULL_HANDLER,
43325   	ZEND_NULL_HANDLER,
43326   	ZEND_NULL_HANDLER,
43327   	ZEND_NULL_HANDLER,
43328   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
43329   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER,
43330   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
43331   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER,
43332   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER,
43333   	ZEND_NULL_HANDLER,
43334   	ZEND_NULL_HANDLER,
43335   	ZEND_NULL_HANDLER,
43336   	ZEND_NULL_HANDLER,
43337   	ZEND_NULL_HANDLER,
43338   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER,
43339   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER,
43340   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER,
43341   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER,
43342   	ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER,
43343   	ZEND_NULL_HANDLER,
43344   	ZEND_NULL_HANDLER,
43345   	ZEND_NULL_HANDLER,
43346   	ZEND_NULL_HANDLER,
43347   	ZEND_NULL_HANDLER,
43348   	ZEND_NULL_HANDLER,
43349   	ZEND_NULL_HANDLER,
43350   	ZEND_NULL_HANDLER,
43351   	ZEND_NULL_HANDLER,
43352   	ZEND_NULL_HANDLER,
43353   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER,
43354   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER,
43355   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER,
43356   	ZEND_NULL_HANDLER,
43357   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER,
43358   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER,
43359   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER,
43360   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER,
43361   	ZEND_NULL_HANDLER,
43362   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER,
43363   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER,
43364   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER,
43365   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER,
43366   	ZEND_NULL_HANDLER,
43367   	ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER,
43368   	ZEND_FETCH_UNSET_SPEC_CONST_CONST_HANDLER,
43369   	ZEND_NULL_HANDLER,
43370   	ZEND_FETCH_UNSET_SPEC_CONST_VAR_HANDLER,
43371   	ZEND_FETCH_UNSET_SPEC_CONST_UNUSED_HANDLER,
43372   	ZEND_NULL_HANDLER,
43373   	ZEND_FETCH_UNSET_SPEC_TMP_CONST_HANDLER,
43374   	ZEND_NULL_HANDLER,
43375   	ZEND_FETCH_UNSET_SPEC_TMP_VAR_HANDLER,
43376   	ZEND_FETCH_UNSET_SPEC_TMP_UNUSED_HANDLER,
43377   	ZEND_NULL_HANDLER,
43378   	ZEND_FETCH_UNSET_SPEC_VAR_CONST_HANDLER,
43379   	ZEND_NULL_HANDLER,
43380   	ZEND_FETCH_UNSET_SPEC_VAR_VAR_HANDLER,
43381   	ZEND_FETCH_UNSET_SPEC_VAR_UNUSED_HANDLER,
43382   	ZEND_NULL_HANDLER,
43383   	ZEND_NULL_HANDLER,
43384   	ZEND_NULL_HANDLER,
43385   	ZEND_NULL_HANDLER,
43386   	ZEND_NULL_HANDLER,
43387   	ZEND_NULL_HANDLER,
43388   	ZEND_FETCH_UNSET_SPEC_CV_CONST_HANDLER,
43389   	ZEND_NULL_HANDLER,
43390   	ZEND_FETCH_UNSET_SPEC_CV_VAR_HANDLER,
43391   	ZEND_FETCH_UNSET_SPEC_CV_UNUSED_HANDLER,
43392   	ZEND_NULL_HANDLER,
43393   	ZEND_NULL_HANDLER,
43394   	ZEND_NULL_HANDLER,
43395   	ZEND_NULL_HANDLER,
43396   	ZEND_NULL_HANDLER,
43397   	ZEND_NULL_HANDLER,
43398   	ZEND_NULL_HANDLER,
43399   	ZEND_NULL_HANDLER,
43400   	ZEND_NULL_HANDLER,
43401   	ZEND_NULL_HANDLER,
43402   	ZEND_NULL_HANDLER,
43403   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER,
43404   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER,
43405   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER,
43406   	ZEND_NULL_HANDLER,
43407   	ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER,
43408   	ZEND_NULL_HANDLER,
43409   	ZEND_NULL_HANDLER,
43410   	ZEND_NULL_HANDLER,
43411   	ZEND_NULL_HANDLER,
43412   	ZEND_NULL_HANDLER,
43413   	ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER,
43414   	ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER,
43415   	ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER,
43416   	ZEND_NULL_HANDLER,
43417   	ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER,
43418   	ZEND_NULL_HANDLER,
43419   	ZEND_NULL_HANDLER,
43420   	ZEND_NULL_HANDLER,
43421   	ZEND_NULL_HANDLER,
43422   	ZEND_NULL_HANDLER,
43423   	ZEND_NULL_HANDLER,
43424   	ZEND_NULL_HANDLER,
43425   	ZEND_NULL_HANDLER,
43426   	ZEND_NULL_HANDLER,
43427   	ZEND_NULL_HANDLER,
43428   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER,
43429   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER,
43430   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER,
43431   	ZEND_NULL_HANDLER,
43432   	ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER,
43433   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER,
43434   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER,
43435   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER,
43436   	ZEND_NULL_HANDLER,
43437   	ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER,
43438   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER,
43439   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER,
43440   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER,
43441   	ZEND_NULL_HANDLER,
43442   	ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER,
43443   	ZEND_FETCH_DIM_TMP_VAR_SPEC_CONST_CONST_HANDLER,
43444   	ZEND_NULL_HANDLER,
43445   	ZEND_NULL_HANDLER,
43446   	ZEND_NULL_HANDLER,
43447   	ZEND_NULL_HANDLER,
43448   	ZEND_FETCH_DIM_TMP_VAR_SPEC_TMP_CONST_HANDLER,
43449   	ZEND_NULL_HANDLER,
43450   	ZEND_NULL_HANDLER,
43451   	ZEND_NULL_HANDLER,
43452   	ZEND_NULL_HANDLER,
43453   	ZEND_NULL_HANDLER,
43454   	ZEND_NULL_HANDLER,
43455   	ZEND_NULL_HANDLER,
43456   	ZEND_NULL_HANDLER,
43457   	ZEND_NULL_HANDLER,
43458   	ZEND_NULL_HANDLER,
43459   	ZEND_NULL_HANDLER,
43460   	ZEND_NULL_HANDLER,
43461   	ZEND_NULL_HANDLER,
43462   	ZEND_NULL_HANDLER,
43463   	ZEND_NULL_HANDLER,
43464   	ZEND_NULL_HANDLER,
43465   	ZEND_NULL_HANDLER,
43466   	ZEND_NULL_HANDLER,
43467   	ZEND_NULL_HANDLER,
43468   	ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER,
43469   	ZEND_NULL_HANDLER,
43470   	ZEND_NULL_HANDLER,
43471   	ZEND_NULL_HANDLER,
43472   	ZEND_NULL_HANDLER,
43473   	ZEND_NULL_HANDLER,
43474   	ZEND_NULL_HANDLER,
43475   	ZEND_NULL_HANDLER,
43476   	ZEND_NULL_HANDLER,
43477   	ZEND_NULL_HANDLER,
43478   	ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER,
43479   	ZEND_NULL_HANDLER,
43480   	ZEND_NULL_HANDLER,
43481   	ZEND_NULL_HANDLER,
43482   	ZEND_NULL_HANDLER,
43483   	ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER,
43484   	ZEND_NULL_HANDLER,
43485   	ZEND_NULL_HANDLER,
43486   	ZEND_NULL_HANDLER,
43487   	ZEND_NULL_HANDLER,
43488   	ZEND_NULL_HANDLER,
43489   	ZEND_NULL_HANDLER,
43490   	ZEND_NULL_HANDLER,
43491   	ZEND_NULL_HANDLER,
43492   	ZEND_NULL_HANDLER,
43493   	ZEND_GOTO_SPEC_CONST_HANDLER,
43494   	ZEND_NULL_HANDLER,
43495   	ZEND_NULL_HANDLER,
43496   	ZEND_NULL_HANDLER,
43497   	ZEND_NULL_HANDLER,
43498   	ZEND_GOTO_SPEC_CONST_HANDLER,
43499   	ZEND_NULL_HANDLER,
43500   	ZEND_NULL_HANDLER,
43501   	ZEND_NULL_HANDLER,
43502   	ZEND_NULL_HANDLER,
43503   	ZEND_GOTO_SPEC_CONST_HANDLER,
43504   	ZEND_NULL_HANDLER,
43505   	ZEND_NULL_HANDLER,
43506   	ZEND_NULL_HANDLER,
43507   	ZEND_NULL_HANDLER,
43508   	ZEND_GOTO_SPEC_CONST_HANDLER,
43509   	ZEND_NULL_HANDLER,
43510   	ZEND_NULL_HANDLER,
43511   	ZEND_NULL_HANDLER,
43512   	ZEND_NULL_HANDLER,
43513   	ZEND_GOTO_SPEC_CONST_HANDLER,
43514   	ZEND_NULL_HANDLER,
43515   	ZEND_NULL_HANDLER,
43516   	ZEND_NULL_HANDLER,
43517   	ZEND_NULL_HANDLER,
43518   	ZEND_EXT_STMT_SPEC_HANDLER,
43519   	ZEND_EXT_STMT_SPEC_HANDLER,
43520   	ZEND_EXT_STMT_SPEC_HANDLER,
43521   	ZEND_EXT_STMT_SPEC_HANDLER,
43522   	ZEND_EXT_STMT_SPEC_HANDLER,
43523   	ZEND_EXT_STMT_SPEC_HANDLER,
43524   	ZEND_EXT_STMT_SPEC_HANDLER,
43525   	ZEND_EXT_STMT_SPEC_HANDLER,
43526   	ZEND_EXT_STMT_SPEC_HANDLER,
43527   	ZEND_EXT_STMT_SPEC_HANDLER,
43528   	ZEND_EXT_STMT_SPEC_HANDLER,
43529   	ZEND_EXT_STMT_SPEC_HANDLER,
43530   	ZEND_EXT_STMT_SPEC_HANDLER,
43531   	ZEND_EXT_STMT_SPEC_HANDLER,
43532   	ZEND_EXT_STMT_SPEC_HANDLER,
43533   	ZEND_EXT_STMT_SPEC_HANDLER,
43534   	ZEND_EXT_STMT_SPEC_HANDLER,
43535   	ZEND_EXT_STMT_SPEC_HANDLER,
43536   	ZEND_EXT_STMT_SPEC_HANDLER,
43537   	ZEND_EXT_STMT_SPEC_HANDLER,
43538   	ZEND_EXT_STMT_SPEC_HANDLER,
43539   	ZEND_EXT_STMT_SPEC_HANDLER,
43540   	ZEND_EXT_STMT_SPEC_HANDLER,
43541   	ZEND_EXT_STMT_SPEC_HANDLER,
43542   	ZEND_EXT_STMT_SPEC_HANDLER,
43543   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43544   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43545   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43546   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43547   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43548   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43549   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43550   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43551   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43552   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43553   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43554   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43555   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43556   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43557   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43558   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43559   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43560   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43561   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43562   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43563   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43564   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43565   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43566   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43567   	ZEND_EXT_FCALL_BEGIN_SPEC_HANDLER,
43568   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43569   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43570   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43571   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43572   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43573   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43574   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43575   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43576   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43577   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43578   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43579   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43580   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43581   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43582   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43583   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43584   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43585   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43586   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43587   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43588   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43589   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43590   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43591   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43592   	ZEND_EXT_FCALL_END_SPEC_HANDLER,
43593   	ZEND_EXT_NOP_SPEC_HANDLER,
43594   	ZEND_EXT_NOP_SPEC_HANDLER,
43595   	ZEND_EXT_NOP_SPEC_HANDLER,
43596   	ZEND_EXT_NOP_SPEC_HANDLER,
43597   	ZEND_EXT_NOP_SPEC_HANDLER,
43598   	ZEND_EXT_NOP_SPEC_HANDLER,
43599   	ZEND_EXT_NOP_SPEC_HANDLER,
43600   	ZEND_EXT_NOP_SPEC_HANDLER,
43601   	ZEND_EXT_NOP_SPEC_HANDLER,
43602   	ZEND_EXT_NOP_SPEC_HANDLER,
43603   	ZEND_EXT_NOP_SPEC_HANDLER,
43604   	ZEND_EXT_NOP_SPEC_HANDLER,
43605   	ZEND_EXT_NOP_SPEC_HANDLER,
43606   	ZEND_EXT_NOP_SPEC_HANDLER,
43607   	ZEND_EXT_NOP_SPEC_HANDLER,
43608   	ZEND_EXT_NOP_SPEC_HANDLER,
43609   	ZEND_EXT_NOP_SPEC_HANDLER,
43610   	ZEND_EXT_NOP_SPEC_HANDLER,
43611   	ZEND_EXT_NOP_SPEC_HANDLER,
43612   	ZEND_EXT_NOP_SPEC_HANDLER,
43613   	ZEND_EXT_NOP_SPEC_HANDLER,
43614   	ZEND_EXT_NOP_SPEC_HANDLER,
43615   	ZEND_EXT_NOP_SPEC_HANDLER,
43616   	ZEND_EXT_NOP_SPEC_HANDLER,
43617   	ZEND_EXT_NOP_SPEC_HANDLER,
43618   	ZEND_TICKS_SPEC_HANDLER,
43619   	ZEND_TICKS_SPEC_HANDLER,
43620   	ZEND_TICKS_SPEC_HANDLER,
43621   	ZEND_TICKS_SPEC_HANDLER,
43622   	ZEND_TICKS_SPEC_HANDLER,
43623   	ZEND_TICKS_SPEC_HANDLER,
43624   	ZEND_TICKS_SPEC_HANDLER,
43625   	ZEND_TICKS_SPEC_HANDLER,
43626   	ZEND_TICKS_SPEC_HANDLER,
43627   	ZEND_TICKS_SPEC_HANDLER,
43628   	ZEND_TICKS_SPEC_HANDLER,
43629   	ZEND_TICKS_SPEC_HANDLER,
43630   	ZEND_TICKS_SPEC_HANDLER,
43631   	ZEND_TICKS_SPEC_HANDLER,
43632   	ZEND_TICKS_SPEC_HANDLER,
43633   	ZEND_TICKS_SPEC_HANDLER,
43634   	ZEND_TICKS_SPEC_HANDLER,
43635   	ZEND_TICKS_SPEC_HANDLER,
43636   	ZEND_TICKS_SPEC_HANDLER,
43637   	ZEND_TICKS_SPEC_HANDLER,
43638   	ZEND_TICKS_SPEC_HANDLER,
43639   	ZEND_TICKS_SPEC_HANDLER,
43640   	ZEND_TICKS_SPEC_HANDLER,
43641   	ZEND_TICKS_SPEC_HANDLER,
43642   	ZEND_TICKS_SPEC_HANDLER,
43643   	ZEND_NULL_HANDLER,
43644   	ZEND_NULL_HANDLER,
43645   	ZEND_NULL_HANDLER,
43646   	ZEND_NULL_HANDLER,
43647   	ZEND_NULL_HANDLER,
43648   	ZEND_NULL_HANDLER,
43649   	ZEND_NULL_HANDLER,
43650   	ZEND_NULL_HANDLER,
43651   	ZEND_NULL_HANDLER,
43652   	ZEND_NULL_HANDLER,
43653   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
43654   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
43655   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
43656   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
43657   	ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER,
43658   	ZEND_NULL_HANDLER,
43659   	ZEND_NULL_HANDLER,
43660   	ZEND_NULL_HANDLER,
43661   	ZEND_NULL_HANDLER,
43662   	ZEND_NULL_HANDLER,
43663   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
43664   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
43665   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
43666   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
43667   	ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER,
43668   	ZEND_NULL_HANDLER,
43669   	ZEND_NULL_HANDLER,
43670   	ZEND_NULL_HANDLER,
43671   	ZEND_NULL_HANDLER,
43672   	ZEND_CATCH_SPEC_CONST_CV_HANDLER,
43673   	ZEND_NULL_HANDLER,
43674   	ZEND_NULL_HANDLER,
43675   	ZEND_NULL_HANDLER,
43676   	ZEND_NULL_HANDLER,
43677   	ZEND_NULL_HANDLER,
43678   	ZEND_NULL_HANDLER,
43679   	ZEND_NULL_HANDLER,
43680   	ZEND_NULL_HANDLER,
43681   	ZEND_NULL_HANDLER,
43682   	ZEND_NULL_HANDLER,
43683   	ZEND_NULL_HANDLER,
43684   	ZEND_NULL_HANDLER,
43685   	ZEND_NULL_HANDLER,
43686   	ZEND_NULL_HANDLER,
43687   	ZEND_NULL_HANDLER,
43688   	ZEND_NULL_HANDLER,
43689   	ZEND_NULL_HANDLER,
43690   	ZEND_NULL_HANDLER,
43691   	ZEND_NULL_HANDLER,
43692   	ZEND_NULL_HANDLER,
43693   	ZEND_THROW_SPEC_CONST_HANDLER,
43694   	ZEND_THROW_SPEC_CONST_HANDLER,
43695   	ZEND_THROW_SPEC_CONST_HANDLER,
43696   	ZEND_THROW_SPEC_CONST_HANDLER,
43697   	ZEND_THROW_SPEC_CONST_HANDLER,
43698   	ZEND_THROW_SPEC_TMP_HANDLER,
43699   	ZEND_THROW_SPEC_TMP_HANDLER,
43700   	ZEND_THROW_SPEC_TMP_HANDLER,
43701   	ZEND_THROW_SPEC_TMP_HANDLER,
43702   	ZEND_THROW_SPEC_TMP_HANDLER,
43703   	ZEND_THROW_SPEC_VAR_HANDLER,
43704   	ZEND_THROW_SPEC_VAR_HANDLER,
43705   	ZEND_THROW_SPEC_VAR_HANDLER,
43706   	ZEND_THROW_SPEC_VAR_HANDLER,
43707   	ZEND_THROW_SPEC_VAR_HANDLER,
43708   	ZEND_NULL_HANDLER,
43709   	ZEND_NULL_HANDLER,
43710   	ZEND_NULL_HANDLER,
43711   	ZEND_NULL_HANDLER,
43712   	ZEND_NULL_HANDLER,
43713   	ZEND_THROW_SPEC_CV_HANDLER,
43714   	ZEND_THROW_SPEC_CV_HANDLER,
43715   	ZEND_THROW_SPEC_CV_HANDLER,
43716   	ZEND_THROW_SPEC_CV_HANDLER,
43717   	ZEND_THROW_SPEC_CV_HANDLER,
43718   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
43719   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
43720   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
43721   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
43722   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
43723   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
43724   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
43725   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
43726   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
43727   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
43728   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
43729   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
43730   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
43731   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
43732   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
43733   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
43734   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
43735   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
43736   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
43737   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
43738   	ZEND_FETCH_CLASS_SPEC_CONST_HANDLER,
43739   	ZEND_FETCH_CLASS_SPEC_TMP_HANDLER,
43740   	ZEND_FETCH_CLASS_SPEC_VAR_HANDLER,
43741   	ZEND_FETCH_CLASS_SPEC_UNUSED_HANDLER,
43742   	ZEND_FETCH_CLASS_SPEC_CV_HANDLER,
43743   	ZEND_CLONE_SPEC_CONST_HANDLER,
43744   	ZEND_CLONE_SPEC_CONST_HANDLER,
43745   	ZEND_CLONE_SPEC_CONST_HANDLER,
43746   	ZEND_CLONE_SPEC_CONST_HANDLER,
43747   	ZEND_CLONE_SPEC_CONST_HANDLER,
43748   	ZEND_CLONE_SPEC_TMP_HANDLER,
43749   	ZEND_CLONE_SPEC_TMP_HANDLER,
43750   	ZEND_CLONE_SPEC_TMP_HANDLER,
43751   	ZEND_CLONE_SPEC_TMP_HANDLER,
43752   	ZEND_CLONE_SPEC_TMP_HANDLER,
43753   	ZEND_CLONE_SPEC_VAR_HANDLER,
43754   	ZEND_CLONE_SPEC_VAR_HANDLER,
43755   	ZEND_CLONE_SPEC_VAR_HANDLER,
43756   	ZEND_CLONE_SPEC_VAR_HANDLER,
43757   	ZEND_CLONE_SPEC_VAR_HANDLER,
43758   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
43759   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
43760   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
43761   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
43762   	ZEND_CLONE_SPEC_UNUSED_HANDLER,
43763   	ZEND_CLONE_SPEC_CV_HANDLER,
43764   	ZEND_CLONE_SPEC_CV_HANDLER,
43765   	ZEND_CLONE_SPEC_CV_HANDLER,
43766   	ZEND_CLONE_SPEC_CV_HANDLER,
43767   	ZEND_CLONE_SPEC_CV_HANDLER,
43768   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
43769   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
43770   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
43771   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
43772   	ZEND_RETURN_BY_REF_SPEC_CONST_HANDLER,
43773   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
43774   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
43775   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
43776   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
43777   	ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER,
43778   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
43779   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
43780   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
43781   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
43782   	ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER,
43783   	ZEND_NULL_HANDLER,
43784   	ZEND_NULL_HANDLER,
43785   	ZEND_NULL_HANDLER,
43786   	ZEND_NULL_HANDLER,
43787   	ZEND_NULL_HANDLER,
43788   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
43789   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
43790   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
43791   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
43792   	ZEND_RETURN_BY_REF_SPEC_CV_HANDLER,
43793   	ZEND_NULL_HANDLER,
43794   	ZEND_NULL_HANDLER,
43795   	ZEND_NULL_HANDLER,
43796   	ZEND_NULL_HANDLER,
43797   	ZEND_NULL_HANDLER,
43798   	ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER,
43799   	ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER,
43800   	ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER,
43801   	ZEND_NULL_HANDLER,
43802   	ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER,
43803   	ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER,
43804   	ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER,
43805   	ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER,
43806   	ZEND_NULL_HANDLER,
43807   	ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER,
43808   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER,
43809   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER,
43810   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER,
43811   	ZEND_NULL_HANDLER,
43812   	ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER,
43813   	ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER,
43814   	ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER,
43815   	ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER,
43816   	ZEND_NULL_HANDLER,
43817   	ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER,
43818   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER,
43819   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMP_HANDLER,
43820   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_VAR_HANDLER,
43821   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_UNUSED_HANDLER,
43822   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER,
43823   	ZEND_NULL_HANDLER,
43824   	ZEND_NULL_HANDLER,
43825   	ZEND_NULL_HANDLER,
43826   	ZEND_NULL_HANDLER,
43827   	ZEND_NULL_HANDLER,
43828   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CONST_HANDLER,
43829   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_TMP_HANDLER,
43830   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_VAR_HANDLER,
43831   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_UNUSED_HANDLER,
43832   	ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_CV_HANDLER,
43833   	ZEND_NULL_HANDLER,
43834   	ZEND_NULL_HANDLER,
43835   	ZEND_NULL_HANDLER,
43836   	ZEND_NULL_HANDLER,
43837   	ZEND_NULL_HANDLER,
43838   	ZEND_NULL_HANDLER,
43839   	ZEND_NULL_HANDLER,
43840   	ZEND_NULL_HANDLER,
43841   	ZEND_NULL_HANDLER,
43842   	ZEND_NULL_HANDLER,
43843   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_CONST_HANDLER,
43844   	ZEND_NULL_HANDLER,
43845   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_VAR_HANDLER,
43846   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_UNUSED_HANDLER,
43847   	ZEND_NULL_HANDLER,
43848   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_CONST_HANDLER,
43849   	ZEND_NULL_HANDLER,
43850   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_VAR_HANDLER,
43851   	ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_UNUSED_HANDLER,
43852   	ZEND_NULL_HANDLER,
43853   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_CONST_HANDLER,
43854   	ZEND_NULL_HANDLER,
43855   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_VAR_HANDLER,
43856   	ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_UNUSED_HANDLER,
43857   	ZEND_NULL_HANDLER,
43858   	ZEND_NULL_HANDLER,
43859   	ZEND_NULL_HANDLER,
43860   	ZEND_NULL_HANDLER,
43861   	ZEND_NULL_HANDLER,
43862   	ZEND_NULL_HANDLER,
43863   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_CONST_HANDLER,
43864   	ZEND_NULL_HANDLER,
43865   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_VAR_HANDLER,
43866   	ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_UNUSED_HANDLER,
43867   	ZEND_NULL_HANDLER,
43868   	ZEND_NULL_HANDLER,
43869   	ZEND_NULL_HANDLER,
43870   	ZEND_NULL_HANDLER,
43871   	ZEND_NULL_HANDLER,
43872   	ZEND_NULL_HANDLER,
43873   	ZEND_NULL_HANDLER,
43874   	ZEND_NULL_HANDLER,
43875   	ZEND_NULL_HANDLER,
43876   	ZEND_NULL_HANDLER,
43877   	ZEND_NULL_HANDLER,
43878   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER,
43879   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER,
43880   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER,
43881   	ZEND_NULL_HANDLER,
43882   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER,
43883   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER,
43884   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER,
43885   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER,
43886   	ZEND_NULL_HANDLER,
43887   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER,
43888   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER,
43889   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER,
43890   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER,
43891   	ZEND_NULL_HANDLER,
43892   	ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER,
43893   	ZEND_NULL_HANDLER,
43894   	ZEND_NULL_HANDLER,
43895   	ZEND_NULL_HANDLER,
43896   	ZEND_NULL_HANDLER,
43897   	ZEND_NULL_HANDLER,
43898   	ZEND_NULL_HANDLER,
43899   	ZEND_NULL_HANDLER,
43900   	ZEND_NULL_HANDLER,
43901   	ZEND_NULL_HANDLER,
43902   	ZEND_NULL_HANDLER,
43903   	ZEND_NULL_HANDLER,
43904   	ZEND_NULL_HANDLER,
43905   	ZEND_NULL_HANDLER,
43906   	ZEND_NULL_HANDLER,
43907   	ZEND_NULL_HANDLER,
43908   	ZEND_NULL_HANDLER,
43909   	ZEND_NULL_HANDLER,
43910   	ZEND_NULL_HANDLER,
43911   	ZEND_NULL_HANDLER,
43912   	ZEND_NULL_HANDLER,
43913   	ZEND_NULL_HANDLER,
43914   	ZEND_NULL_HANDLER,
43915   	ZEND_NULL_HANDLER,
43916   	ZEND_NULL_HANDLER,
43917   	ZEND_NULL_HANDLER,
43918   	ZEND_NULL_HANDLER,
43919   	ZEND_NULL_HANDLER,
43920   	ZEND_NULL_HANDLER,
43921   	ZEND_NULL_HANDLER,
43922   	ZEND_NULL_HANDLER,
43923   	ZEND_NULL_HANDLER,
43924   	ZEND_NULL_HANDLER,
43925   	ZEND_NULL_HANDLER,
43926   	ZEND_NULL_HANDLER,
43927   	ZEND_NULL_HANDLER,
43928   	ZEND_NULL_HANDLER,
43929   	ZEND_NULL_HANDLER,
43930   	ZEND_NULL_HANDLER,
43931   	ZEND_NULL_HANDLER,
43932   	ZEND_NULL_HANDLER,
43933   	ZEND_NULL_HANDLER,
43934   	ZEND_NULL_HANDLER,
43935   	ZEND_NULL_HANDLER,
43936   	ZEND_NULL_HANDLER,
43937   	ZEND_NULL_HANDLER,
43938   	ZEND_NULL_HANDLER,
43939   	ZEND_NULL_HANDLER,
43940   	ZEND_NULL_HANDLER,
43941   	ZEND_NULL_HANDLER,
43942   	ZEND_NULL_HANDLER,
43943   	ZEND_NULL_HANDLER,
43944   	ZEND_NULL_HANDLER,
43945   	ZEND_NULL_HANDLER,
43946   	ZEND_NULL_HANDLER,
43947   	ZEND_NULL_HANDLER,
43948   	ZEND_NULL_HANDLER,
43949   	ZEND_NULL_HANDLER,
43950   	ZEND_NULL_HANDLER,
43951   	ZEND_NULL_HANDLER,
43952   	ZEND_NULL_HANDLER,
43953   	ZEND_NULL_HANDLER,
43954   	ZEND_NULL_HANDLER,
43955   	ZEND_NULL_HANDLER,
43956   	ZEND_NULL_HANDLER,
43957   	ZEND_NULL_HANDLER,
43958   	ZEND_NULL_HANDLER,
43959   	ZEND_NULL_HANDLER,
43960   	ZEND_NULL_HANDLER,
43961   	ZEND_NULL_HANDLER,
43962   	ZEND_NULL_HANDLER,
43963   	ZEND_NULL_HANDLER,
43964   	ZEND_NULL_HANDLER,
43965   	ZEND_NULL_HANDLER,
43966   	ZEND_NULL_HANDLER,
43967   	ZEND_NULL_HANDLER,
43968   	ZEND_NULL_HANDLER,
43969   	ZEND_NULL_HANDLER,
43970   	ZEND_NULL_HANDLER,
43971   	ZEND_NULL_HANDLER,
43972   	ZEND_NULL_HANDLER,
43973   	ZEND_NULL_HANDLER,
43974   	ZEND_NULL_HANDLER,
43975   	ZEND_NULL_HANDLER,
43976   	ZEND_NULL_HANDLER,
43977   	ZEND_NULL_HANDLER,
43978   	ZEND_NULL_HANDLER,
43979   	ZEND_NULL_HANDLER,
43980   	ZEND_NULL_HANDLER,
43981   	ZEND_NULL_HANDLER,
43982   	ZEND_NULL_HANDLER,
43983   	ZEND_NULL_HANDLER,
43984   	ZEND_NULL_HANDLER,
43985   	ZEND_NULL_HANDLER,
43986   	ZEND_NULL_HANDLER,
43987   	ZEND_NULL_HANDLER,
43988   	ZEND_NULL_HANDLER,
43989   	ZEND_NULL_HANDLER,
43990   	ZEND_NULL_HANDLER,
43991   	ZEND_NULL_HANDLER,
43992   	ZEND_NULL_HANDLER,
43993   	ZEND_NULL_HANDLER,
43994   	ZEND_NULL_HANDLER,
43995   	ZEND_NULL_HANDLER,
43996   	ZEND_NULL_HANDLER,
43997   	ZEND_NULL_HANDLER,
43998   	ZEND_NULL_HANDLER,
43999   	ZEND_NULL_HANDLER,
44000   	ZEND_NULL_HANDLER,
44001   	ZEND_NULL_HANDLER,
44002   	ZEND_NULL_HANDLER,
44003   	ZEND_NULL_HANDLER,
44004   	ZEND_NULL_HANDLER,
44005   	ZEND_NULL_HANDLER,
44006   	ZEND_NULL_HANDLER,
44007   	ZEND_NULL_HANDLER,
44008   	ZEND_NULL_HANDLER,
44009   	ZEND_NULL_HANDLER,
44010   	ZEND_NULL_HANDLER,
44011   	ZEND_NULL_HANDLER,
44012   	ZEND_NULL_HANDLER,
44013   	ZEND_NULL_HANDLER,
44014   	ZEND_NULL_HANDLER,
44015   	ZEND_NULL_HANDLER,
44016   	ZEND_NULL_HANDLER,
44017   	ZEND_NULL_HANDLER,
44018   	ZEND_NULL_HANDLER,
44019   	ZEND_NULL_HANDLER,
44020   	ZEND_NULL_HANDLER,
44021   	ZEND_NULL_HANDLER,
44022   	ZEND_NULL_HANDLER,
44023   	ZEND_NULL_HANDLER,
44024   	ZEND_NULL_HANDLER,
44025   	ZEND_NULL_HANDLER,
44026   	ZEND_NULL_HANDLER,
44027   	ZEND_NULL_HANDLER,
44028   	ZEND_NULL_HANDLER,
44029   	ZEND_NULL_HANDLER,
44030   	ZEND_NULL_HANDLER,
44031   	ZEND_NULL_HANDLER,
44032   	ZEND_NULL_HANDLER,
44033   	ZEND_NULL_HANDLER,
44034   	ZEND_NULL_HANDLER,
44035   	ZEND_NULL_HANDLER,
44036   	ZEND_NULL_HANDLER,
44037   	ZEND_NULL_HANDLER,
44038   	ZEND_NULL_HANDLER,
44039   	ZEND_NULL_HANDLER,
44040   	ZEND_NULL_HANDLER,
44041   	ZEND_NULL_HANDLER,
44042   	ZEND_NULL_HANDLER,
44043   	ZEND_NULL_HANDLER,
44044   	ZEND_NULL_HANDLER,
44045   	ZEND_NULL_HANDLER,
44046   	ZEND_NULL_HANDLER,
44047   	ZEND_NULL_HANDLER,
44048   	ZEND_NULL_HANDLER,
44049   	ZEND_NULL_HANDLER,
44050   	ZEND_NULL_HANDLER,
44051   	ZEND_NULL_HANDLER,
44052   	ZEND_NULL_HANDLER,
44053   	ZEND_NULL_HANDLER,
44054   	ZEND_NULL_HANDLER,
44055   	ZEND_NULL_HANDLER,
44056   	ZEND_NULL_HANDLER,
44057   	ZEND_NULL_HANDLER,
44058   	ZEND_NULL_HANDLER,
44059   	ZEND_NULL_HANDLER,
44060   	ZEND_NULL_HANDLER,
44061   	ZEND_NULL_HANDLER,
44062   	ZEND_NULL_HANDLER,
44063   	ZEND_NULL_HANDLER,
44064   	ZEND_NULL_HANDLER,
44065   	ZEND_NULL_HANDLER,
44066   	ZEND_NULL_HANDLER,
44067   	ZEND_NULL_HANDLER,
44068   	ZEND_NULL_HANDLER,
44069   	ZEND_NULL_HANDLER,
44070   	ZEND_NULL_HANDLER,
44071   	ZEND_NULL_HANDLER,
44072   	ZEND_NULL_HANDLER,
44073   	ZEND_NULL_HANDLER,
44074   	ZEND_NULL_HANDLER,
44075   	ZEND_NULL_HANDLER,
44076   	ZEND_NULL_HANDLER,
44077   	ZEND_NULL_HANDLER,
44078   	ZEND_NULL_HANDLER,
44079   	ZEND_NULL_HANDLER,
44080   	ZEND_NULL_HANDLER,
44081   	ZEND_NULL_HANDLER,
44082   	ZEND_NULL_HANDLER,
44083   	ZEND_NULL_HANDLER,
44084   	ZEND_NULL_HANDLER,
44085   	ZEND_NULL_HANDLER,
44086   	ZEND_NULL_HANDLER,
44087   	ZEND_NULL_HANDLER,
44088   	ZEND_NULL_HANDLER,
44089   	ZEND_NULL_HANDLER,
44090   	ZEND_NULL_HANDLER,
44091   	ZEND_NULL_HANDLER,
44092   	ZEND_NULL_HANDLER,
44093   	ZEND_NULL_HANDLER,
44094   	ZEND_NULL_HANDLER,
44095   	ZEND_NULL_HANDLER,
44096   	ZEND_NULL_HANDLER,
44097   	ZEND_NULL_HANDLER,
44098   	ZEND_NULL_HANDLER,
44099   	ZEND_NULL_HANDLER,
44100   	ZEND_NULL_HANDLER,
44101   	ZEND_NULL_HANDLER,
44102   	ZEND_NULL_HANDLER,
44103   	ZEND_NULL_HANDLER,
44104   	ZEND_NULL_HANDLER,
44105   	ZEND_NULL_HANDLER,
44106   	ZEND_NULL_HANDLER,
44107   	ZEND_NULL_HANDLER,
44108   	ZEND_NULL_HANDLER,
44109   	ZEND_NULL_HANDLER,
44110   	ZEND_NULL_HANDLER,
44111   	ZEND_NULL_HANDLER,
44112   	ZEND_NULL_HANDLER,
44113   	ZEND_NULL_HANDLER,
44114   	ZEND_NULL_HANDLER,
44115   	ZEND_NULL_HANDLER,
44116   	ZEND_NULL_HANDLER,
44117   	ZEND_NULL_HANDLER,
44118   	ZEND_NULL_HANDLER,
44119   	ZEND_NULL_HANDLER,
44120   	ZEND_NULL_HANDLER,
44121   	ZEND_NULL_HANDLER,
44122   	ZEND_NULL_HANDLER,
44123   	ZEND_NULL_HANDLER,
44124   	ZEND_NULL_HANDLER,
44125   	ZEND_NULL_HANDLER,
44126   	ZEND_NULL_HANDLER,
44127   	ZEND_NULL_HANDLER,
44128   	ZEND_NULL_HANDLER,
44129   	ZEND_NULL_HANDLER,
44130   	ZEND_NULL_HANDLER,
44131   	ZEND_NULL_HANDLER,
44132   	ZEND_NULL_HANDLER,
44133   	ZEND_NULL_HANDLER,
44134   	ZEND_NULL_HANDLER,
44135   	ZEND_NULL_HANDLER,
44136   	ZEND_NULL_HANDLER,
44137   	ZEND_NULL_HANDLER,
44138   	ZEND_NULL_HANDLER,
44139   	ZEND_NULL_HANDLER,
44140   	ZEND_NULL_HANDLER,
44141   	ZEND_NULL_HANDLER,
44142   	ZEND_NULL_HANDLER,
44143   	ZEND_NULL_HANDLER,
44144   	ZEND_NULL_HANDLER,
44145   	ZEND_NULL_HANDLER,
44146   	ZEND_NULL_HANDLER,
44147   	ZEND_NULL_HANDLER,
44148   	ZEND_NULL_HANDLER,
44149   	ZEND_NULL_HANDLER,
44150   	ZEND_NULL_HANDLER,
44151   	ZEND_NULL_HANDLER,
44152   	ZEND_NULL_HANDLER,
44153   	ZEND_NULL_HANDLER,
44154   	ZEND_NULL_HANDLER,
44155   	ZEND_NULL_HANDLER,
44156   	ZEND_NULL_HANDLER,
44157   	ZEND_NULL_HANDLER,
44158   	ZEND_NULL_HANDLER,
44159   	ZEND_NULL_HANDLER,
44160   	ZEND_NULL_HANDLER,
44161   	ZEND_NULL_HANDLER,
44162   	ZEND_NULL_HANDLER,
44163   	ZEND_NULL_HANDLER,
44164   	ZEND_NULL_HANDLER,
44165   	ZEND_NULL_HANDLER,
44166   	ZEND_NULL_HANDLER,
44167   	ZEND_NULL_HANDLER,
44168   	ZEND_NULL_HANDLER,
44169   	ZEND_NULL_HANDLER,
44170   	ZEND_NULL_HANDLER,
44171   	ZEND_NULL_HANDLER,
44172   	ZEND_NULL_HANDLER,
44173   	ZEND_NULL_HANDLER,
44174   	ZEND_NULL_HANDLER,
44175   	ZEND_NULL_HANDLER,
44176   	ZEND_NULL_HANDLER,
44177   	ZEND_NULL_HANDLER,
44178   	ZEND_NULL_HANDLER,
44179   	ZEND_NULL_HANDLER,
44180   	ZEND_NULL_HANDLER,
44181   	ZEND_NULL_HANDLER,
44182   	ZEND_NULL_HANDLER,
44183   	ZEND_NULL_HANDLER,
44184   	ZEND_NULL_HANDLER,
44185   	ZEND_NULL_HANDLER,
44186   	ZEND_NULL_HANDLER,
44187   	ZEND_NULL_HANDLER,
44188   	ZEND_NULL_HANDLER,
44189   	ZEND_NULL_HANDLER,
44190   	ZEND_NULL_HANDLER,
44191   	ZEND_NULL_HANDLER,
44192   	ZEND_NULL_HANDLER,
44193   	ZEND_NULL_HANDLER,
44194   	ZEND_NULL_HANDLER,
44195   	ZEND_NULL_HANDLER,
44196   	ZEND_NULL_HANDLER,
44197   	ZEND_NULL_HANDLER,
44198   	ZEND_NULL_HANDLER,
44199   	ZEND_NULL_HANDLER,
44200   	ZEND_NULL_HANDLER,
44201   	ZEND_NULL_HANDLER,
44202   	ZEND_NULL_HANDLER,
44203   	ZEND_NULL_HANDLER,
44204   	ZEND_NULL_HANDLER,
44205   	ZEND_NULL_HANDLER,
44206   	ZEND_NULL_HANDLER,
44207   	ZEND_NULL_HANDLER,
44208   	ZEND_NULL_HANDLER,
44209   	ZEND_NULL_HANDLER,
44210   	ZEND_NULL_HANDLER,
44211   	ZEND_NULL_HANDLER,
44212   	ZEND_NULL_HANDLER,
44213   	ZEND_NULL_HANDLER,
44214   	ZEND_NULL_HANDLER,
44215   	ZEND_NULL_HANDLER,
44216   	ZEND_NULL_HANDLER,
44217   	ZEND_NULL_HANDLER,
44218   	ZEND_NULL_HANDLER,
44219   	ZEND_NULL_HANDLER,
44220   	ZEND_NULL_HANDLER,
44221   	ZEND_NULL_HANDLER,
44222   	ZEND_NULL_HANDLER,
44223   	ZEND_NULL_HANDLER,
44224   	ZEND_NULL_HANDLER,
44225   	ZEND_NULL_HANDLER,
44226   	ZEND_NULL_HANDLER,
44227   	ZEND_NULL_HANDLER,
44228   	ZEND_NULL_HANDLER,
44229   	ZEND_NULL_HANDLER,
44230   	ZEND_NULL_HANDLER,
44231   	ZEND_NULL_HANDLER,
44232   	ZEND_NULL_HANDLER,
44233   	ZEND_NULL_HANDLER,
44234   	ZEND_NULL_HANDLER,
44235   	ZEND_NULL_HANDLER,
44236   	ZEND_NULL_HANDLER,
44237   	ZEND_NULL_HANDLER,
44238   	ZEND_NULL_HANDLER,
44239   	ZEND_NULL_HANDLER,
44240   	ZEND_NULL_HANDLER,
44241   	ZEND_NULL_HANDLER,
44242   	ZEND_NULL_HANDLER,
44243   	ZEND_NULL_HANDLER,
44244   	ZEND_NULL_HANDLER,
44245   	ZEND_NULL_HANDLER,
44246   	ZEND_NULL_HANDLER,
44247   	ZEND_NULL_HANDLER,
44248   	ZEND_NULL_HANDLER,
44249   	ZEND_NULL_HANDLER,
44250   	ZEND_NULL_HANDLER,
44251   	ZEND_NULL_HANDLER,
44252   	ZEND_NULL_HANDLER,
44253   	ZEND_NULL_HANDLER,
44254   	ZEND_NULL_HANDLER,
44255   	ZEND_NULL_HANDLER,
44256   	ZEND_NULL_HANDLER,
44257   	ZEND_NULL_HANDLER,
44258   	ZEND_NULL_HANDLER,
44259   	ZEND_NULL_HANDLER,
44260   	ZEND_NULL_HANDLER,
44261   	ZEND_NULL_HANDLER,
44262   	ZEND_NULL_HANDLER,
44263   	ZEND_NULL_HANDLER,
44264   	ZEND_NULL_HANDLER,
44265   	ZEND_NULL_HANDLER,
44266   	ZEND_NULL_HANDLER,
44267   	ZEND_NULL_HANDLER,
44268   	ZEND_NULL_HANDLER,
44269   	ZEND_NULL_HANDLER,
44270   	ZEND_NULL_HANDLER,
44271   	ZEND_NULL_HANDLER,
44272   	ZEND_NULL_HANDLER,
44273   	ZEND_NULL_HANDLER,
44274   	ZEND_NULL_HANDLER,
44275   	ZEND_NULL_HANDLER,
44276   	ZEND_NULL_HANDLER,
44277   	ZEND_NULL_HANDLER,
44278   	ZEND_NULL_HANDLER,
44279   	ZEND_NULL_HANDLER,
44280   	ZEND_NULL_HANDLER,
44281   	ZEND_NULL_HANDLER,
44282   	ZEND_NULL_HANDLER,
44283   	ZEND_NULL_HANDLER,
44284   	ZEND_NULL_HANDLER,
44285   	ZEND_NULL_HANDLER,
44286   	ZEND_NULL_HANDLER,
44287   	ZEND_NULL_HANDLER,
44288   	ZEND_NULL_HANDLER,
44289   	ZEND_NULL_HANDLER,
44290   	ZEND_NULL_HANDLER,
44291   	ZEND_NULL_HANDLER,
44292   	ZEND_NULL_HANDLER,
44293   	ZEND_NULL_HANDLER,
44294   	ZEND_NULL_HANDLER,
44295   	ZEND_NULL_HANDLER,
44296   	ZEND_NULL_HANDLER,
44297   	ZEND_NULL_HANDLER,
44298   	ZEND_NULL_HANDLER,
44299   	ZEND_NULL_HANDLER,
44300   	ZEND_NULL_HANDLER,
44301   	ZEND_NULL_HANDLER,
44302   	ZEND_NULL_HANDLER,
44303   	ZEND_PRE_INC_OBJ_SPEC_VAR_CONST_HANDLER,
44304   	ZEND_PRE_INC_OBJ_SPEC_VAR_TMP_HANDLER,
44305   	ZEND_PRE_INC_OBJ_SPEC_VAR_VAR_HANDLER,
44306   	ZEND_NULL_HANDLER,
44307   	ZEND_PRE_INC_OBJ_SPEC_VAR_CV_HANDLER,
44308   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_CONST_HANDLER,
44309   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_TMP_HANDLER,
44310   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_VAR_HANDLER,
44311   	ZEND_NULL_HANDLER,
44312   	ZEND_PRE_INC_OBJ_SPEC_UNUSED_CV_HANDLER,
44313   	ZEND_PRE_INC_OBJ_SPEC_CV_CONST_HANDLER,
44314   	ZEND_PRE_INC_OBJ_SPEC_CV_TMP_HANDLER,
44315   	ZEND_PRE_INC_OBJ_SPEC_CV_VAR_HANDLER,
44316   	ZEND_NULL_HANDLER,
44317   	ZEND_PRE_INC_OBJ_SPEC_CV_CV_HANDLER,
44318   	ZEND_NULL_HANDLER,
44319   	ZEND_NULL_HANDLER,
44320   	ZEND_NULL_HANDLER,
44321   	ZEND_NULL_HANDLER,
44322   	ZEND_NULL_HANDLER,
44323   	ZEND_NULL_HANDLER,
44324   	ZEND_NULL_HANDLER,
44325   	ZEND_NULL_HANDLER,
44326   	ZEND_NULL_HANDLER,
44327   	ZEND_NULL_HANDLER,
44328   	ZEND_PRE_DEC_OBJ_SPEC_VAR_CONST_HANDLER,
44329   	ZEND_PRE_DEC_OBJ_SPEC_VAR_TMP_HANDLER,
44330   	ZEND_PRE_DEC_OBJ_SPEC_VAR_VAR_HANDLER,
44331   	ZEND_NULL_HANDLER,
44332   	ZEND_PRE_DEC_OBJ_SPEC_VAR_CV_HANDLER,
44333   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER,
44334   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER,
44335   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER,
44336   	ZEND_NULL_HANDLER,
44337   	ZEND_PRE_DEC_OBJ_SPEC_UNUSED_CV_HANDLER,
44338   	ZEND_PRE_DEC_OBJ_SPEC_CV_CONST_HANDLER,
44339   	ZEND_PRE_DEC_OBJ_SPEC_CV_TMP_HANDLER,
44340   	ZEND_PRE_DEC_OBJ_SPEC_CV_VAR_HANDLER,
44341   	ZEND_NULL_HANDLER,
44342   	ZEND_PRE_DEC_OBJ_SPEC_CV_CV_HANDLER,
44343   	ZEND_NULL_HANDLER,
44344   	ZEND_NULL_HANDLER,
44345   	ZEND_NULL_HANDLER,
44346   	ZEND_NULL_HANDLER,
44347   	ZEND_NULL_HANDLER,
44348   	ZEND_NULL_HANDLER,
44349   	ZEND_NULL_HANDLER,
44350   	ZEND_NULL_HANDLER,
44351   	ZEND_NULL_HANDLER,
44352   	ZEND_NULL_HANDLER,
44353   	ZEND_POST_INC_OBJ_SPEC_VAR_CONST_HANDLER,
44354   	ZEND_POST_INC_OBJ_SPEC_VAR_TMP_HANDLER,
44355   	ZEND_POST_INC_OBJ_SPEC_VAR_VAR_HANDLER,
44356   	ZEND_NULL_HANDLER,
44357   	ZEND_POST_INC_OBJ_SPEC_VAR_CV_HANDLER,
44358   	ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER,
44359   	ZEND_POST_INC_OBJ_SPEC_UNUSED_TMP_HANDLER,
44360   	ZEND_POST_INC_OBJ_SPEC_UNUSED_VAR_HANDLER,
44361   	ZEND_NULL_HANDLER,
44362   	ZEND_POST_INC_OBJ_SPEC_UNUSED_CV_HANDLER,
44363   	ZEND_POST_INC_OBJ_SPEC_CV_CONST_HANDLER,
44364   	ZEND_POST_INC_OBJ_SPEC_CV_TMP_HANDLER,
44365   	ZEND_POST_INC_OBJ_SPEC_CV_VAR_HANDLER,
44366   	ZEND_NULL_HANDLER,
44367   	ZEND_POST_INC_OBJ_SPEC_CV_CV_HANDLER,
44368   	ZEND_NULL_HANDLER,
44369   	ZEND_NULL_HANDLER,
44370   	ZEND_NULL_HANDLER,
44371   	ZEND_NULL_HANDLER,
44372   	ZEND_NULL_HANDLER,
44373   	ZEND_NULL_HANDLER,
44374   	ZEND_NULL_HANDLER,
44375   	ZEND_NULL_HANDLER,
44376   	ZEND_NULL_HANDLER,
44377   	ZEND_NULL_HANDLER,
44378   	ZEND_POST_DEC_OBJ_SPEC_VAR_CONST_HANDLER,
44379   	ZEND_POST_DEC_OBJ_SPEC_VAR_TMP_HANDLER,
44380   	ZEND_POST_DEC_OBJ_SPEC_VAR_VAR_HANDLER,
44381   	ZEND_NULL_HANDLER,
44382   	ZEND_POST_DEC_OBJ_SPEC_VAR_CV_HANDLER,
44383   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_CONST_HANDLER,
44384   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_TMP_HANDLER,
44385   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_VAR_HANDLER,
44386   	ZEND_NULL_HANDLER,
44387   	ZEND_POST_DEC_OBJ_SPEC_UNUSED_CV_HANDLER,
44388   	ZEND_POST_DEC_OBJ_SPEC_CV_CONST_HANDLER,
44389   	ZEND_POST_DEC_OBJ_SPEC_CV_TMP_HANDLER,
44390   	ZEND_POST_DEC_OBJ_SPEC_CV_VAR_HANDLER,
44391   	ZEND_NULL_HANDLER,
44392   	ZEND_POST_DEC_OBJ_SPEC_CV_CV_HANDLER,
44393   	ZEND_NULL_HANDLER,
44394   	ZEND_NULL_HANDLER,
44395   	ZEND_NULL_HANDLER,
44396   	ZEND_NULL_HANDLER,
44397   	ZEND_NULL_HANDLER,
44398   	ZEND_NULL_HANDLER,
44399   	ZEND_NULL_HANDLER,
44400   	ZEND_NULL_HANDLER,
44401   	ZEND_NULL_HANDLER,
44402   	ZEND_NULL_HANDLER,
44403   	ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_HANDLER,
44404   	ZEND_ASSIGN_OBJ_SPEC_VAR_TMP_HANDLER,
44405   	ZEND_ASSIGN_OBJ_SPEC_VAR_VAR_HANDLER,
44406   	ZEND_NULL_HANDLER,
44407   	ZEND_ASSIGN_OBJ_SPEC_VAR_CV_HANDLER,
44408   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_CONST_HANDLER,
44409   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_TMP_HANDLER,
44410   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_VAR_HANDLER,
44411   	ZEND_NULL_HANDLER,
44412   	ZEND_ASSIGN_OBJ_SPEC_UNUSED_CV_HANDLER,
44413   	ZEND_ASSIGN_OBJ_SPEC_CV_CONST_HANDLER,
44414   	ZEND_ASSIGN_OBJ_SPEC_CV_TMP_HANDLER,
44415   	ZEND_ASSIGN_OBJ_SPEC_CV_VAR_HANDLER,
44416   	ZEND_NULL_HANDLER,
44417   	ZEND_ASSIGN_OBJ_SPEC_CV_CV_HANDLER,
44418   	ZEND_NULL_HANDLER,
44419   	ZEND_NULL_HANDLER,
44420   	ZEND_NULL_HANDLER,
44421   	ZEND_NULL_HANDLER,
44422   	ZEND_NULL_HANDLER,
44423   	ZEND_NULL_HANDLER,
44424   	ZEND_NULL_HANDLER,
44425   	ZEND_NULL_HANDLER,
44426   	ZEND_NULL_HANDLER,
44427   	ZEND_NULL_HANDLER,
44428   	ZEND_NULL_HANDLER,
44429   	ZEND_NULL_HANDLER,
44430   	ZEND_NULL_HANDLER,
44431   	ZEND_NULL_HANDLER,
44432   	ZEND_NULL_HANDLER,
44433   	ZEND_NULL_HANDLER,
44434   	ZEND_NULL_HANDLER,
44435   	ZEND_NULL_HANDLER,
44436   	ZEND_NULL_HANDLER,
44437   	ZEND_NULL_HANDLER,
44438   	ZEND_NULL_HANDLER,
44439   	ZEND_NULL_HANDLER,
44440   	ZEND_NULL_HANDLER,
44441   	ZEND_NULL_HANDLER,
44442   	ZEND_NULL_HANDLER,
44443   	ZEND_NULL_HANDLER,
44444   	ZEND_NULL_HANDLER,
44445   	ZEND_NULL_HANDLER,
44446   	ZEND_NULL_HANDLER,
44447   	ZEND_NULL_HANDLER,
44448   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
44449   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
44450   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
44451   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
44452   	ZEND_INSTANCEOF_SPEC_TMP_HANDLER,
44453   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
44454   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
44455   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
44456   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
44457   	ZEND_INSTANCEOF_SPEC_VAR_HANDLER,
44458   	ZEND_NULL_HANDLER,
44459   	ZEND_NULL_HANDLER,
44460   	ZEND_NULL_HANDLER,
44461   	ZEND_NULL_HANDLER,
44462   	ZEND_NULL_HANDLER,
44463   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
44464   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
44465   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
44466   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
44467   	ZEND_INSTANCEOF_SPEC_CV_HANDLER,
44468   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44469   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44470   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44471   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44472   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44473   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44474   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44475   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44476   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44477   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44478   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44479   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44480   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44481   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44482   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44483   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44484   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44485   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44486   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44487   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44488   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44489   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44490   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44491   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44492   	ZEND_DECLARE_CLASS_SPEC_HANDLER,
44493   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44494   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44495   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44496   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44497   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44498   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44499   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44500   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44501   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44502   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44503   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44504   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44505   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44506   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44507   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44508   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44509   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44510   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44511   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44512   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44513   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44514   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44515   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44516   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44517   	ZEND_DECLARE_INHERITED_CLASS_SPEC_HANDLER,
44518   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44519   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44520   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44521   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44522   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44523   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44524   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44525   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44526   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44527   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44528   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44529   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44530   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44531   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44532   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44533   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44534   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44535   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44536   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44537   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44538   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44539   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44540   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44541   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44542   	ZEND_DECLARE_FUNCTION_SPEC_HANDLER,
44543   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44544   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44545   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44546   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44547   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44548   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44549   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44550   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44551   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44552   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44553   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44554   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44555   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44556   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44557   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44558   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44559   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44560   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44561   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44562   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44563   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44564   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44565   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44566   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44567   	ZEND_RAISE_ABSTRACT_ERROR_SPEC_HANDLER,
44568   	ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER,
44569   	ZEND_NULL_HANDLER,
44570   	ZEND_NULL_HANDLER,
44571   	ZEND_NULL_HANDLER,
44572   	ZEND_NULL_HANDLER,
44573   	ZEND_NULL_HANDLER,
44574   	ZEND_NULL_HANDLER,
44575   	ZEND_NULL_HANDLER,
44576   	ZEND_NULL_HANDLER,
44577   	ZEND_NULL_HANDLER,
44578   	ZEND_NULL_HANDLER,
44579   	ZEND_NULL_HANDLER,
44580   	ZEND_NULL_HANDLER,
44581   	ZEND_NULL_HANDLER,
44582   	ZEND_NULL_HANDLER,
44583   	ZEND_NULL_HANDLER,
44584   	ZEND_NULL_HANDLER,
44585   	ZEND_NULL_HANDLER,
44586   	ZEND_NULL_HANDLER,
44587   	ZEND_NULL_HANDLER,
44588   	ZEND_NULL_HANDLER,
44589   	ZEND_NULL_HANDLER,
44590   	ZEND_NULL_HANDLER,
44591   	ZEND_NULL_HANDLER,
44592   	ZEND_NULL_HANDLER,
44593   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
44594   	ZEND_NULL_HANDLER,
44595   	ZEND_NULL_HANDLER,
44596   	ZEND_NULL_HANDLER,
44597   	ZEND_NULL_HANDLER,
44598   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
44599   	ZEND_NULL_HANDLER,
44600   	ZEND_NULL_HANDLER,
44601   	ZEND_NULL_HANDLER,
44602   	ZEND_NULL_HANDLER,
44603   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
44604   	ZEND_NULL_HANDLER,
44605   	ZEND_NULL_HANDLER,
44606   	ZEND_NULL_HANDLER,
44607   	ZEND_NULL_HANDLER,
44608   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
44609   	ZEND_NULL_HANDLER,
44610   	ZEND_NULL_HANDLER,
44611   	ZEND_NULL_HANDLER,
44612   	ZEND_NULL_HANDLER,
44613   	ZEND_ADD_INTERFACE_SPEC_CONST_HANDLER,
44614   	ZEND_NULL_HANDLER,
44615   	ZEND_NULL_HANDLER,
44616   	ZEND_NULL_HANDLER,
44617   	ZEND_NULL_HANDLER,
44618   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44619   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44620   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44621   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44622   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44623   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44624   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44625   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44626   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44627   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44628   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44629   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44630   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44631   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44632   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44633   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44634   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44635   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44636   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44637   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44638   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44639   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44640   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44641   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44642   	ZEND_DECLARE_INHERITED_CLASS_DELAYED_SPEC_HANDLER,
44643   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44644   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44645   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44646   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44647   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44648   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44649   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44650   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44651   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44652   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44653   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44654   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44655   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44656   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44657   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44658   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44659   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44660   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44661   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44662   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44663   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44664   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44665   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44666   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44667   	ZEND_VERIFY_ABSTRACT_CLASS_SPEC_HANDLER,
44668   	ZEND_NULL_HANDLER,
44669   	ZEND_NULL_HANDLER,
44670   	ZEND_NULL_HANDLER,
44671   	ZEND_NULL_HANDLER,
44672   	ZEND_NULL_HANDLER,
44673   	ZEND_NULL_HANDLER,
44674   	ZEND_NULL_HANDLER,
44675   	ZEND_NULL_HANDLER,
44676   	ZEND_NULL_HANDLER,
44677   	ZEND_NULL_HANDLER,
44678   	ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER,
44679   	ZEND_ASSIGN_DIM_SPEC_VAR_TMP_HANDLER,
44680   	ZEND_ASSIGN_DIM_SPEC_VAR_VAR_HANDLER,
44681   	ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER,
44682   	ZEND_ASSIGN_DIM_SPEC_VAR_CV_HANDLER,
44683   	ZEND_NULL_HANDLER,
44684   	ZEND_NULL_HANDLER,
44685   	ZEND_NULL_HANDLER,
44686   	ZEND_NULL_HANDLER,
44687   	ZEND_NULL_HANDLER,
44688   	ZEND_ASSIGN_DIM_SPEC_CV_CONST_HANDLER,
44689   	ZEND_ASSIGN_DIM_SPEC_CV_TMP_HANDLER,
44690   	ZEND_ASSIGN_DIM_SPEC_CV_VAR_HANDLER,
44691   	ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER,
44692   	ZEND_ASSIGN_DIM_SPEC_CV_CV_HANDLER,
44693   	ZEND_NULL_HANDLER,
44694   	ZEND_NULL_HANDLER,
44695   	ZEND_NULL_HANDLER,
44696   	ZEND_NULL_HANDLER,
44697   	ZEND_NULL_HANDLER,
44698   	ZEND_NULL_HANDLER,
44699   	ZEND_NULL_HANDLER,
44700   	ZEND_NULL_HANDLER,
44701   	ZEND_NULL_HANDLER,
44702   	ZEND_NULL_HANDLER,
44703   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CONST_HANDLER,
44704   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_TMP_HANDLER,
44705   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_VAR_HANDLER,
44706   	ZEND_NULL_HANDLER,
44707   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_VAR_CV_HANDLER,
44708   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CONST_HANDLER,
44709   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_TMP_HANDLER,
44710   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_VAR_HANDLER,
44711   	ZEND_NULL_HANDLER,
44712   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_UNUSED_CV_HANDLER,
44713   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER,
44714   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_TMP_HANDLER,
44715   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_VAR_HANDLER,
44716   	ZEND_NULL_HANDLER,
44717   	ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CV_HANDLER,
44718   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44719   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44720   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44721   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44722   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44723   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44724   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44725   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44726   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44727   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44728   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44729   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44730   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44731   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44732   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44733   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44734   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44735   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44736   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44737   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44738   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44739   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44740   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44741   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44742   	ZEND_HANDLE_EXCEPTION_SPEC_HANDLER,
44743   	ZEND_USER_OPCODE_SPEC_HANDLER,
44744   	ZEND_USER_OPCODE_SPEC_HANDLER,
44745   	ZEND_USER_OPCODE_SPEC_HANDLER,
44746   	ZEND_USER_OPCODE_SPEC_HANDLER,
44747   	ZEND_USER_OPCODE_SPEC_HANDLER,
44748   	ZEND_USER_OPCODE_SPEC_HANDLER,
44749   	ZEND_USER_OPCODE_SPEC_HANDLER,
44750   	ZEND_USER_OPCODE_SPEC_HANDLER,
44751   	ZEND_USER_OPCODE_SPEC_HANDLER,
44752   	ZEND_USER_OPCODE_SPEC_HANDLER,
44753   	ZEND_USER_OPCODE_SPEC_HANDLER,
44754   	ZEND_USER_OPCODE_SPEC_HANDLER,
44755   	ZEND_USER_OPCODE_SPEC_HANDLER,
44756   	ZEND_USER_OPCODE_SPEC_HANDLER,
44757   	ZEND_USER_OPCODE_SPEC_HANDLER,
44758   	ZEND_USER_OPCODE_SPEC_HANDLER,
44759   	ZEND_USER_OPCODE_SPEC_HANDLER,
44760   	ZEND_USER_OPCODE_SPEC_HANDLER,
44761   	ZEND_USER_OPCODE_SPEC_HANDLER,
44762   	ZEND_USER_OPCODE_SPEC_HANDLER,
44763   	ZEND_USER_OPCODE_SPEC_HANDLER,
44764   	ZEND_USER_OPCODE_SPEC_HANDLER,
44765   	ZEND_USER_OPCODE_SPEC_HANDLER,
44766   	ZEND_USER_OPCODE_SPEC_HANDLER,
44767   	ZEND_USER_OPCODE_SPEC_HANDLER,
44768   	ZEND_NULL_HANDLER,
44769   	ZEND_NULL_HANDLER,
44770   	ZEND_NULL_HANDLER,
44771   	ZEND_NULL_HANDLER,
44772   	ZEND_NULL_HANDLER,
44773   	ZEND_NULL_HANDLER,
44774   	ZEND_NULL_HANDLER,
44775   	ZEND_NULL_HANDLER,
44776   	ZEND_NULL_HANDLER,
44777   	ZEND_NULL_HANDLER,
44778   	ZEND_NULL_HANDLER,
44779   	ZEND_NULL_HANDLER,
44780   	ZEND_NULL_HANDLER,
44781   	ZEND_NULL_HANDLER,
44782   	ZEND_NULL_HANDLER,
44783   	ZEND_NULL_HANDLER,
44784   	ZEND_NULL_HANDLER,
44785   	ZEND_NULL_HANDLER,
44786   	ZEND_NULL_HANDLER,
44787   	ZEND_NULL_HANDLER,
44788   	ZEND_NULL_HANDLER,
44789   	ZEND_NULL_HANDLER,
44790   	ZEND_NULL_HANDLER,
44791   	ZEND_NULL_HANDLER,
44792   	ZEND_NULL_HANDLER,
44793   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
44794   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
44795   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
44796   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
44797   	ZEND_JMP_SET_SPEC_CONST_HANDLER,
44798   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
44799   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
44800   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
44801   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
44802   	ZEND_JMP_SET_SPEC_TMP_HANDLER,
44803   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
44804   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
44805   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
44806   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
44807   	ZEND_JMP_SET_SPEC_VAR_HANDLER,
44808   	ZEND_NULL_HANDLER,
44809   	ZEND_NULL_HANDLER,
44810   	ZEND_NULL_HANDLER,
44811   	ZEND_NULL_HANDLER,
44812   	ZEND_NULL_HANDLER,
44813   	ZEND_JMP_SET_SPEC_CV_HANDLER,
44814   	ZEND_JMP_SET_SPEC_CV_HANDLER,
44815   	ZEND_JMP_SET_SPEC_CV_HANDLER,
44816   	ZEND_JMP_SET_SPEC_CV_HANDLER,
44817   	ZEND_JMP_SET_SPEC_CV_HANDLER,
44818   	ZEND_NULL_HANDLER,
44819   	ZEND_NULL_HANDLER,
44820   	ZEND_NULL_HANDLER,
44821   	ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER,
44822   	ZEND_NULL_HANDLER,
44823   	ZEND_NULL_HANDLER,
44824   	ZEND_NULL_HANDLER,
44825   	ZEND_NULL_HANDLER,
44826   	ZEND_NULL_HANDLER,
44827   	ZEND_NULL_HANDLER,
44828   	ZEND_NULL_HANDLER,
44829   	ZEND_NULL_HANDLER,
44830   	ZEND_NULL_HANDLER,
44831   	ZEND_NULL_HANDLER,
44832   	ZEND_NULL_HANDLER,
44833   	ZEND_NULL_HANDLER,
44834   	ZEND_NULL_HANDLER,
44835   	ZEND_NULL_HANDLER,
44836   	ZEND_NULL_HANDLER,
44837   	ZEND_NULL_HANDLER,
44838   	ZEND_NULL_HANDLER,
44839   	ZEND_NULL_HANDLER,
44840   	ZEND_NULL_HANDLER,
44841   	ZEND_NULL_HANDLER,
44842   	ZEND_NULL_HANDLER,
44843   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44844   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44845   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44846   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44847   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44848   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44849   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44850   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44851   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44852   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44853   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44854   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44855   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44856   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44857   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44858   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44859   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44860   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44861   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44862   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44863   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44864   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44865   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44866   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44867   	ZEND_ADD_TRAIT_SPEC_HANDLER,
44868   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44869   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44870   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44871   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44872   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44873   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44874   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44875   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44876   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44877   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44878   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44879   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44880   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44881   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44882   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44883   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44884   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44885   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44886   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44887   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44888   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44889   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44890   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44891   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44892   	ZEND_BIND_TRAITS_SPEC_HANDLER,
44893   	ZEND_NULL_HANDLER,
44894   	ZEND_NULL_HANDLER,
44895   	ZEND_NULL_HANDLER,
44896   	ZEND_NULL_HANDLER,
44897   	ZEND_NULL_HANDLER,
44898   	ZEND_NULL_HANDLER,
44899   	ZEND_NULL_HANDLER,
44900   	ZEND_NULL_HANDLER,
44901   	ZEND_NULL_HANDLER,
44902   	ZEND_NULL_HANDLER,
44903   	ZEND_NULL_HANDLER,
44904   	ZEND_NULL_HANDLER,
44905   	ZEND_NULL_HANDLER,
44906   	ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDLER,
44907   	ZEND_NULL_HANDLER,
44908   	ZEND_NULL_HANDLER,
44909   	ZEND_NULL_HANDLER,
44910   	ZEND_NULL_HANDLER,
44911   	ZEND_NULL_HANDLER,
44912   	ZEND_NULL_HANDLER,
44913   	ZEND_NULL_HANDLER,
44914   	ZEND_NULL_HANDLER,
44915   	ZEND_NULL_HANDLER,
44916   	ZEND_NULL_HANDLER,
44917   	ZEND_NULL_HANDLER,
44918   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
44919   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
44920   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
44921   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
44922   	ZEND_QM_ASSIGN_VAR_SPEC_CONST_HANDLER,
44923   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
44924   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
44925   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
44926   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
44927   	ZEND_QM_ASSIGN_VAR_SPEC_TMP_HANDLER,
44928   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
44929   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
44930   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
44931   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
44932   	ZEND_QM_ASSIGN_VAR_SPEC_VAR_HANDLER,
44933   	ZEND_NULL_HANDLER,
44934   	ZEND_NULL_HANDLER,
44935   	ZEND_NULL_HANDLER,
44936   	ZEND_NULL_HANDLER,
44937   	ZEND_NULL_HANDLER,
44938   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
44939   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
44940   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
44941   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
44942   	ZEND_QM_ASSIGN_VAR_SPEC_CV_HANDLER,
44943   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
44944   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
44945   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
44946   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
44947   	ZEND_JMP_SET_VAR_SPEC_CONST_HANDLER,
44948   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
44949   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
44950   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
44951   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
44952   	ZEND_JMP_SET_VAR_SPEC_TMP_HANDLER,
44953   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
44954   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
44955   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
44956   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
44957   	ZEND_JMP_SET_VAR_SPEC_VAR_HANDLER,
44958   	ZEND_NULL_HANDLER,
44959   	ZEND_NULL_HANDLER,
44960   	ZEND_NULL_HANDLER,
44961   	ZEND_NULL_HANDLER,
44962   	ZEND_NULL_HANDLER,
44963   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
44964   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
44965   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
44966   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
44967   	ZEND_JMP_SET_VAR_SPEC_CV_HANDLER,
44968   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44969   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44970   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44971   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44972   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44973   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44974   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44975   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44976   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44977   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44978   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44979   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44980   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44981   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44982   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44983   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44984   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44985   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44986   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44987   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44988   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44989   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44990   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44991   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44992   	ZEND_DISCARD_EXCEPTION_SPEC_HANDLER,
44993   	ZEND_YIELD_SPEC_CONST_CONST_HANDLER,
44994   	ZEND_YIELD_SPEC_CONST_TMP_HANDLER,
44995   	ZEND_YIELD_SPEC_CONST_VAR_HANDLER,
44996   	ZEND_YIELD_SPEC_CONST_UNUSED_HANDLER,
44997   	ZEND_YIELD_SPEC_CONST_CV_HANDLER,
44998   	ZEND_YIELD_SPEC_TMP_CONST_HANDLER,
44999   	ZEND_YIELD_SPEC_TMP_TMP_HANDLER,
45000   	ZEND_YIELD_SPEC_TMP_VAR_HANDLER,
45001   	ZEND_YIELD_SPEC_TMP_UNUSED_HANDLER,
45002   	ZEND_YIELD_SPEC_TMP_CV_HANDLER,
45003   	ZEND_YIELD_SPEC_VAR_CONST_HANDLER,
45004   	ZEND_YIELD_SPEC_VAR_TMP_HANDLER,
45005   	ZEND_YIELD_SPEC_VAR_VAR_HANDLER,
45006   	ZEND_YIELD_SPEC_VAR_UNUSED_HANDLER,
45007   	ZEND_YIELD_SPEC_VAR_CV_HANDLER,
45008   	ZEND_YIELD_SPEC_UNUSED_CONST_HANDLER,
45009   	ZEND_YIELD_SPEC_UNUSED_TMP_HANDLER,
45010   	ZEND_YIELD_SPEC_UNUSED_VAR_HANDLER,
45011   	ZEND_YIELD_SPEC_UNUSED_UNUSED_HANDLER,
45012   	ZEND_YIELD_SPEC_UNUSED_CV_HANDLER,
45013   	ZEND_YIELD_SPEC_CV_CONST_HANDLER,
45014   	ZEND_YIELD_SPEC_CV_TMP_HANDLER,
45015   	ZEND_YIELD_SPEC_CV_VAR_HANDLER,
45016   	ZEND_YIELD_SPEC_CV_UNUSED_HANDLER,
45017   	ZEND_YIELD_SPEC_CV_CV_HANDLER,
45018   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45019   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45020   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45021   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45022   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45023   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45024   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45025   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45026   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45027   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45028   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45029   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45030   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45031   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45032   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45033   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45034   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45035   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45036   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45037   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45038   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45039   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45040   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45041   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45042   	ZEND_GENERATOR_RETURN_SPEC_HANDLER,
45043   	ZEND_FAST_CALL_SPEC_HANDLER,
45044   	ZEND_FAST_CALL_SPEC_HANDLER,
45045   	ZEND_FAST_CALL_SPEC_HANDLER,
45046   	ZEND_FAST_CALL_SPEC_HANDLER,
45047   	ZEND_FAST_CALL_SPEC_HANDLER,
45048   	ZEND_FAST_CALL_SPEC_HANDLER,
45049   	ZEND_FAST_CALL_SPEC_HANDLER,
45050   	ZEND_FAST_CALL_SPEC_HANDLER,
45051   	ZEND_FAST_CALL_SPEC_HANDLER,
45052   	ZEND_FAST_CALL_SPEC_HANDLER,
45053   	ZEND_FAST_CALL_SPEC_HANDLER,
45054   	ZEND_FAST_CALL_SPEC_HANDLER,
45055   	ZEND_FAST_CALL_SPEC_HANDLER,
45056   	ZEND_FAST_CALL_SPEC_HANDLER,
45057   	ZEND_FAST_CALL_SPEC_HANDLER,
45058   	ZEND_FAST_CALL_SPEC_HANDLER,
45059   	ZEND_FAST_CALL_SPEC_HANDLER,
45060   	ZEND_FAST_CALL_SPEC_HANDLER,
45061   	ZEND_FAST_CALL_SPEC_HANDLER,
45062   	ZEND_FAST_CALL_SPEC_HANDLER,
45063   	ZEND_FAST_CALL_SPEC_HANDLER,
45064   	ZEND_FAST_CALL_SPEC_HANDLER,
45065   	ZEND_FAST_CALL_SPEC_HANDLER,
45066   	ZEND_FAST_CALL_SPEC_HANDLER,
45067   	ZEND_FAST_CALL_SPEC_HANDLER,
45068   	ZEND_FAST_RET_SPEC_HANDLER,
45069   	ZEND_FAST_RET_SPEC_HANDLER,
45070   	ZEND_FAST_RET_SPEC_HANDLER,
45071   	ZEND_FAST_RET_SPEC_HANDLER,
45072   	ZEND_FAST_RET_SPEC_HANDLER,
45073   	ZEND_FAST_RET_SPEC_HANDLER,
45074   	ZEND_FAST_RET_SPEC_HANDLER,
45075   	ZEND_FAST_RET_SPEC_HANDLER,
45076   	ZEND_FAST_RET_SPEC_HANDLER,
45077   	ZEND_FAST_RET_SPEC_HANDLER,
45078   	ZEND_FAST_RET_SPEC_HANDLER,
45079   	ZEND_FAST_RET_SPEC_HANDLER,
45080   	ZEND_FAST_RET_SPEC_HANDLER,
45081   	ZEND_FAST_RET_SPEC_HANDLER,
45082   	ZEND_FAST_RET_SPEC_HANDLER,
45083   	ZEND_FAST_RET_SPEC_HANDLER,
45084   	ZEND_FAST_RET_SPEC_HANDLER,
45085   	ZEND_FAST_RET_SPEC_HANDLER,
45086   	ZEND_FAST_RET_SPEC_HANDLER,
45087   	ZEND_FAST_RET_SPEC_HANDLER,
45088   	ZEND_FAST_RET_SPEC_HANDLER,
45089   	ZEND_FAST_RET_SPEC_HANDLER,
45090   	ZEND_FAST_RET_SPEC_HANDLER,
45091   	ZEND_FAST_RET_SPEC_HANDLER,
45092   	ZEND_FAST_RET_SPEC_HANDLER,
45093   	ZEND_NULL_HANDLER
45094   };
45095   zend_opcode_handlers = (opcode_handler_t*)labels;
45096 }
zend_vm_get_opcode_handler(zend_uchar opcode,zend_op * op)45097 static opcode_handler_t zend_vm_get_opcode_handler(zend_uchar opcode, zend_op* op)
45098 {
45099 		static const int zend_vm_decode[] = {
45100 			_UNUSED_CODE, /* 0              */
45101 			_CONST_CODE,  /* 1 = IS_CONST   */
45102 			_TMP_CODE,    /* 2 = IS_TMP_VAR */
45103 			_UNUSED_CODE, /* 3              */
45104 			_VAR_CODE,    /* 4 = IS_VAR     */
45105 			_UNUSED_CODE, /* 5              */
45106 			_UNUSED_CODE, /* 6              */
45107 			_UNUSED_CODE, /* 7              */
45108 			_UNUSED_CODE, /* 8 = IS_UNUSED  */
45109 			_UNUSED_CODE, /* 9              */
45110 			_UNUSED_CODE, /* 10             */
45111 			_UNUSED_CODE, /* 11             */
45112 			_UNUSED_CODE, /* 12             */
45113 			_UNUSED_CODE, /* 13             */
45114 			_UNUSED_CODE, /* 14             */
45115 			_UNUSED_CODE, /* 15             */
45116 			_CV_CODE      /* 16 = IS_CV     */
45117 		};
45118 		return zend_opcode_handlers[opcode * 25 + zend_vm_decode[op->op1_type] * 5 + zend_vm_decode[op->op2_type]];
45119 }
45120 
zend_vm_set_opcode_handler(zend_op * op)45121 ZEND_API void zend_vm_set_opcode_handler(zend_op* op)
45122 {
45123 	op->handler = zend_vm_get_opcode_handler(zend_user_opcodes[op->opcode], op);
45124 }
45125 
zend_do_fcall(ZEND_OPCODE_HANDLER_ARGS)45126 ZEND_API int zend_do_fcall(ZEND_OPCODE_HANDLER_ARGS)
45127 {
45128 	return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
45129 }
45130 
45131