diff options
Diffstat (limited to 'Zend/zend_vm_execute.h')
| -rw-r--r-- | Zend/zend_vm_execute.h | 462 | 
1 files changed, 260 insertions, 202 deletions
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 8605333d05..3568e03ae6 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -564,7 +564,7 @@ static int ZEND_FASTCALL  ZEND_DO_FCALL_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		EG(current_execute_data) = call;  		if (fbc->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) { -			zend_uint i; +			uint32_t i;  			zval *p = ZEND_CALL_ARG(call, 1);  			for (i = 0; i < call->num_args; ++i) { @@ -661,7 +661,7 @@ static int ZEND_FASTCALL  ZEND_DO_FCALL_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		zend_vm_stack_free_call_frame(call TSRMLS_CC);  		if (fbc->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) { -			STR_RELEASE(fbc->common.function_name); +			zend_string_release(fbc->common.function_name);  		}  		efree(fbc); @@ -904,7 +904,7 @@ static int ZEND_FASTCALL  ZEND_SEND_ARRAY_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		EX(call)->called_scope = NULL;  		EX(call)->object = NULL;  	} else { -		zend_uint arg_num = 1; +		uint32_t arg_num = 1;  		HashTable *ht = Z_ARRVAL_P(args);  		zval *arg, *param, tmp; @@ -912,7 +912,7 @@ static int ZEND_FASTCALL  ZEND_SEND_ARRAY_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		zend_vm_stack_extend_call_frame(&EX(call), 0, zend_hash_num_elements(ht) TSRMLS_CC);  		if (opline->op1_type != IS_CONST && opline->op1_type != IS_TMP_VAR && Z_IMMUTABLE_P(args)) { -			zend_uint i; +			uint32_t i;  			int separate = 0;  			/* check if any of arguments are going to be passed by reference */ @@ -1003,7 +1003,7 @@ static int ZEND_FASTCALL  ZEND_SEND_ARRAY_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  static int ZEND_FASTCALL  ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	USE_OPLINE -	zend_uint arg_num = opline->op1.num; +	uint32_t arg_num = opline->op1.num;  	SAVE_OPLINE();  	if (UNEXPECTED(arg_num > EX(num_args))) { @@ -1022,8 +1022,8 @@ static int ZEND_FASTCALL  ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  static int ZEND_FASTCALL  ZEND_RECV_VARIADIC_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	USE_OPLINE -	zend_uint arg_num = opline->op1.num; -	zend_uint arg_count = EX(num_args); +	uint32_t arg_num = opline->op1.num; +	uint32_t arg_count = EX(num_args);  	zval *params;  	SAVE_OPLINE(); @@ -1297,9 +1297,9 @@ static int ZEND_FASTCALL  ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS  static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  { -	zend_uint op_num = EG(opline_before_exception) - EX(func)->op_array.opcodes; +	uint32_t op_num = EG(opline_before_exception) - EX(func)->op_array.opcodes;  	int i; -	zend_uint catch_op_num = 0, finally_op_num = 0, finally_op_end = 0; +	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0;  	for (i = 0; i < EX(func)->op_array.last_try_catch; i++) {  		if (EX(func)->op_array.try_catch_array[i].try_op > op_num) { @@ -1373,9 +1373,9 @@ static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER  		ZVAL_LONG(&restored_error_reporting, Z_LVAL(EX(old_error_reporting)));  		convert_to_string(&restored_error_reporting); -		key = STR_INIT("error_reporting", sizeof("error_reporting")-1, 0); +		key = zend_string_init("error_reporting", sizeof("error_reporting")-1, 0);  		zend_alter_ini_entry_ex(key, Z_STRVAL(restored_error_reporting), Z_STRLEN(restored_error_reporting), ZEND_INI_USER, ZEND_INI_STAGE_RUNTIME, 1 TSRMLS_CC); -		STR_FREE(key); +		zend_string_free(key);  		zval_dtor(&restored_error_reporting);  	}  	ZVAL_UNDEF(&EX(old_error_reporting)); @@ -1583,16 +1583,16 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE  		ZVAL_DEREF(function_name);  		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {  			if (Z_STRVAL_P(function_name)[0] == '\\') { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name) - 1, 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name) - 1, 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name) + 1, Z_STRLEN_P(function_name) - 1);  			} else { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name), 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name), 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name), Z_STRLEN_P(function_name));  			}  			if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {  				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(function_name));  			} -			STR_FREE(lcname); +			zend_string_free(lcname);  			fbc = Z_FUNC_P(func);  			called_scope = NULL; @@ -1737,7 +1737,7 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER  static int ZEND_FASTCALL  ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	USE_OPLINE -	zend_uint arg_num = opline->op1.num; +	uint32_t arg_num = opline->op1.num;  	zval *param;  	SAVE_OPLINE(); @@ -1911,16 +1911,16 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_H  		ZVAL_DEREF(function_name);  		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {  			if (Z_STRVAL_P(function_name)[0] == '\\') { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name) - 1, 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name) - 1, 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name) + 1, Z_STRLEN_P(function_name) - 1);  			} else { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name), 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name), 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name), Z_STRLEN_P(function_name));  			}  			if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {  				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(function_name));  			} -			STR_FREE(lcname); +			zend_string_free(lcname);  			zval_dtor(free_op2.var);  			fbc = Z_FUNC_P(func); @@ -2085,16 +2085,16 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_H  		ZVAL_DEREF(function_name);  		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {  			if (Z_STRVAL_P(function_name)[0] == '\\') { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name) - 1, 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name) - 1, 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name) + 1, Z_STRLEN_P(function_name) - 1);  			} else { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name), 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name), 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name), Z_STRLEN_P(function_name));  			}  			if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {  				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(function_name));  			} -			STR_FREE(lcname); +			zend_string_free(lcname);  			zval_ptr_dtor_nogc(free_op2.var);  			fbc = Z_FUNC_P(func); @@ -2297,16 +2297,16 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HA  		ZVAL_DEREF(function_name);  		if (EXPECTED(Z_TYPE_P(function_name) == IS_STRING)) {  			if (Z_STRVAL_P(function_name)[0] == '\\') { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name) - 1, 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name) - 1, 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name) + 1, Z_STRLEN_P(function_name) - 1);  			} else { -				lcname = STR_ALLOC(Z_STRLEN_P(function_name), 0); +				lcname = zend_string_alloc(Z_STRLEN_P(function_name), 0);  				zend_str_tolower_copy(lcname->val, Z_STRVAL_P(function_name), Z_STRLEN_P(function_name));  			}  			if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {  				zend_error_noreturn(E_ERROR, "Call to undefined function %s()", Z_STRVAL_P(function_name));  			} -			STR_FREE(lcname); +			zend_string_free(lcname);  			fbc = Z_FUNC_P(func);  			called_scope = NULL; @@ -3154,15 +3154,23 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A  				}  				ZVAL_DUP(&tmp, array_ref);  				array_ptr = array_ref = &tmp; -			} else if (IS_CONST == IS_CV) { +			} else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {  				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {  					ZVAL_UNREF(array_ref);  					array_ptr = array_ref;  				} -				if (Z_IMMUTABLE_P(array_ptr)) { +				if (Z_IMMUTABLE_P(array_ptr) || +				    (Z_ISREF_P(array_ref) && +				     Z_REFCOUNTED_P(array_ptr) && +				     Z_REFCOUNT_P(array_ptr) > 1)) { +					if (!Z_IMMUTABLE_P(array_ptr)) { +						Z_DELREF_P(array_ptr); +					}  					zval_copy_ctor(array_ptr);  				} -				Z_ADDREF_P(array_ref); +				if (IS_CONST == IS_CV) { +					Z_ADDREF_P(array_ref); +				}  			}  		}  	} @@ -3217,7 +3225,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A  			zend_object *zobj = Z_OBJ_P(array_ptr);  			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {  				zend_string *str_key; -				ulong int_key; +				zend_ulong int_key;  				zend_uchar key_type;  				key_type = zend_hash_get_current_key(fe_ht, &str_key, &int_key, 0); @@ -3377,7 +3385,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG  		} else if (Z_TYPE_P(value) <= IS_DOUBLE) {  			zend_string *str = zval_get_string(value);  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else if (Z_TYPE_P(value) == IS_OBJECT) {  			zend_string *str; @@ -3385,7 +3393,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG  				goto strlen_error;  			}  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else {  strlen_error:  			zend_error(E_WARNING, "strlen() expects parameter 1 to be string, %s given", zend_get_type_by_const(Z_TYPE_P(value))); @@ -3759,7 +3767,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_CONST(int type  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -3774,7 +3782,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_CONST(int type  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CONST != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -3841,7 +3849,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_CONST(int type  	}  	if (IS_CONST != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -4345,7 +4353,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_CONST_CONST_HANDLER(ZEND_OPCO  		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && memcmp(Z_STRVAL_P(opline->op2.zv), "class", sizeof("class") - 1) == 0) {  			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */  			ZVAL_STR(EX_VAR(opline->result.var), ce->name); -			STR_ADDREF(ce->name); +			zend_string_addref(ce->name);  		} else {  			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));  		} @@ -4394,7 +4402,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_O  		zval *offset = opline->op2.zv;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -4446,7 +4454,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -4632,7 +4640,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CONST_CONST_HANDLER(ZE  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -4687,7 +4695,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -4706,11 +4715,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_CONST == IS_CV || IS_CONST == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -4789,7 +4801,7 @@ static int ZEND_FASTCALL  ZEND_DECLARE_CONST_SPEC_CONST_CONST_HANDLER(ZEND_OPCOD  		}  	}  	c.flags = CONST_CS; /* non persistent, case sensetive */ -	c.name = STR_DUP(Z_STR_P(name), 0); +	c.name = zend_string_dup(Z_STR_P(name), 0);  	c.module_number = PHP_USER_CONSTANT;  	if (zend_register_constant(&c TSRMLS_CC) == FAILURE) { @@ -5603,7 +5615,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPC  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -5655,7 +5667,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -5689,7 +5701,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CONST_TMP_HANDLER(ZEND  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -5744,7 +5756,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -5763,11 +5776,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_CONST == IS_CV || IS_CONST == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -6262,7 +6278,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -6277,7 +6293,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CONST != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -6344,7 +6360,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_VAR(int type,  	}  	if (IS_CONST != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -6782,7 +6798,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPC  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -6834,7 +6850,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -7020,7 +7036,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CONST_VAR_HANDLER(ZEND  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -7075,7 +7091,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -7094,11 +7111,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_CONST == IS_CV || IS_CONST == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -7318,7 +7338,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int typ  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -7333,7 +7353,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int typ  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CONST != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -7400,7 +7420,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CONST_UNUSED(int typ  	}  	if (IS_CONST != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -7645,7 +7665,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_  		zval *offset = NULL;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -7697,7 +7717,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -8739,7 +8759,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCO  		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -8791,7 +8811,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -8825,7 +8845,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CONST_CV_HANDLER(ZEND_  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -8880,7 +8900,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -8899,11 +8920,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_CONST == IS_CV || IS_CONST == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -9882,15 +9906,23 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG  				}  				ZVAL_DUP(&tmp, array_ref);  				array_ptr = array_ref = &tmp; -			} else if (IS_TMP_VAR == IS_CV) { +			} else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {  				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {  					ZVAL_UNREF(array_ref);  					array_ptr = array_ref;  				} -				if (Z_IMMUTABLE_P(array_ptr)) { +				if (Z_IMMUTABLE_P(array_ptr) || +				    (Z_ISREF_P(array_ref) && +				     Z_REFCOUNTED_P(array_ptr) && +				     Z_REFCOUNT_P(array_ptr) > 1)) { +					if (!Z_IMMUTABLE_P(array_ptr)) { +						Z_DELREF_P(array_ptr); +					}  					zval_copy_ctor(array_ptr);  				} -				Z_ADDREF_P(array_ref); +				if (IS_TMP_VAR == IS_CV) { +					Z_ADDREF_P(array_ref); +				}  			}  		}  	} @@ -9945,7 +9977,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG  			zend_object *zobj = Z_OBJ_P(array_ptr);  			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {  				zend_string *str_key; -				ulong int_key; +				zend_ulong int_key;  				zend_uchar key_type;  				key_type = zend_hash_get_current_key(fe_ht, &str_key, &int_key, 0); @@ -10006,7 +10038,7 @@ static int ZEND_FASTCALL  ZEND_END_SILENCE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_  	SAVE_OPLINE();  	if (!EG(error_reporting) && Z_LVAL_P(EX_VAR(opline->op1.var)) != 0) {  		EG(error_reporting) = Z_LVAL_P(EX_VAR(opline->op1.var)); -		_zend_print_signed_to_buf(buf + sizeof(buf) - 1, EG(error_reporting), unsigned long, res); +		_zend_print_signed_to_buf(buf + sizeof(buf) - 1, EG(error_reporting), zend_ulong, res);  		if (EXPECTED(EG(error_reporting_ini_entry) != NULL)) {  			if (EXPECTED(EG(error_reporting_ini_entry)->modified &&  			    EG(error_reporting_ini_entry)->value != EG(error_reporting_ini_entry)->orig_value)) { @@ -10154,7 +10186,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		} else if (Z_TYPE_P(value) <= IS_DOUBLE) {  			zend_string *str = zval_get_string(value);  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else if (Z_TYPE_P(value) == IS_OBJECT) {  			zend_string *str; @@ -10162,7 +10194,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  				goto strlen_error;  			}  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else {  strlen_error:  			zend_error(E_WARNING, "strlen() expects parameter 1 to be string, %s given", zend_get_type_by_const(Z_TYPE_P(value))); @@ -10516,7 +10548,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_CONST(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -10531,7 +10563,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_CONST(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_TMP_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_dtor(free_op1.var);  					CHECK_EXCEPTION(); @@ -10598,7 +10630,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_CONST(int type,  	}  	if (IS_TMP_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -11005,7 +11037,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPC  		zval *offset = opline->op2.zv;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -11057,7 +11089,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -11243,7 +11275,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMP_CONST_HANDLER(ZEND  	zend_free_op free_op1;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -11298,7 +11330,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -11317,11 +11350,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -12138,7 +12174,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCOD  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -12190,7 +12226,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -12224,7 +12260,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMP_TMP_HANDLER(ZEND_O  	zend_free_op free_op1, free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -12279,7 +12315,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -12298,11 +12335,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -12797,7 +12837,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_VAR(int type, ZE  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -12812,7 +12852,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_VAR(int type, ZE  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_TMP_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_dtor(free_op1.var);  					CHECK_EXCEPTION(); @@ -12879,7 +12919,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_VAR(int type, ZE  	}  	if (IS_TMP_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -13274,7 +13314,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCOD  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -13326,7 +13366,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -13512,7 +13552,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMP_VAR_HANDLER(ZEND_O  	zend_free_op free_op1, free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -13567,7 +13607,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -13586,11 +13627,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -13810,7 +13854,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -13825,7 +13869,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_TMP_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_dtor(free_op1.var);  					CHECK_EXCEPTION(); @@ -13892,7 +13936,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_TMP_UNUSED(int type,  	}  	if (IS_TMP_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -14021,7 +14065,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OP  		zval *offset = NULL;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -14073,7 +14117,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -14993,7 +15037,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE  		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -15045,7 +15089,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -15079,7 +15123,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMP_CV_HANDLER(ZEND_OP  	zend_free_op free_op1;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -15134,7 +15178,8 @@ num_index_prop:  		if (opline->extended_value & ZEND_ISSET) {  			/* > IS_NULL means not IS_UNDEF and not IS_NULL */ -			result = (value != NULL && Z_TYPE_P(value) > IS_NULL); +			result = value != NULL && Z_TYPE_P(value) > IS_NULL && +			    (!Z_ISREF_P(value) || Z_TYPE_P(Z_REFVAL_P(value)) != IS_NULL);  		} else /* if (opline->extended_value & ZEND_ISEMPTY) */ {  			result = (value == NULL || !i_zend_is_true(value TSRMLS_CC));  		} @@ -15153,11 +15198,14 @@ num_index_prop:  		result = 0;  		if (UNEXPECTED(Z_TYPE_P(offset) != IS_LONG)) { +			if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) { +				ZVAL_DEREF(offset); +			}  			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -15962,10 +16010,7 @@ static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HAND  	varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);  	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||  	     (Z_VAR_FLAGS_P(varptr) & IS_VAR_RET_REF)) && -	    ((!Z_REFCOUNTED_P(varptr) && Z_TYPE_P(varptr) != IS_STRING) || -	     Z_ISREF_P(varptr) || -	     Z_TYPE_P(varptr) == IS_OBJECT || -	     (Z_REFCOUNTED_P(varptr) && Z_REFCOUNT_P(varptr) == 1))) { +	    (Z_ISREF_P(varptr) || Z_TYPE_P(varptr) == IS_OBJECT)) {  		ZVAL_MAKE_REF(varptr);  		if (IS_VAR == IS_CV) { @@ -16533,15 +16578,23 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG  				}  				ZVAL_DUP(&tmp, array_ref);  				array_ptr = array_ref = &tmp; -			} else if (IS_VAR == IS_CV) { +			} else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {  				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {  					ZVAL_UNREF(array_ref);  					array_ptr = array_ref;  				} -				if (Z_IMMUTABLE_P(array_ptr)) { +				if (Z_IMMUTABLE_P(array_ptr) || +				    (Z_ISREF_P(array_ref) && +				     Z_REFCOUNTED_P(array_ptr) && +				     Z_REFCOUNT_P(array_ptr) > 1)) { +					if (!Z_IMMUTABLE_P(array_ptr)) { +						Z_DELREF_P(array_ptr); +					}  					zval_copy_ctor(array_ptr);  				} -				Z_ADDREF_P(array_ref); +				if (IS_VAR == IS_CV) { +					Z_ADDREF_P(array_ref); +				}  			}  		}  	} @@ -16596,7 +16649,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG  			zend_object *zobj = Z_OBJ_P(array_ptr);  			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {  				zend_string *str_key; -				ulong int_key; +				zend_ulong int_key;  				zend_uchar key_type;  				key_type = zend_hash_get_current_key(fe_ht, &str_key, &int_key, 0); @@ -16927,7 +16980,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		} else if (Z_TYPE_P(value) <= IS_DOUBLE) {  			zend_string *str = zval_get_string(value);  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else if (Z_TYPE_P(value) == IS_OBJECT) {  			zend_string *str; @@ -16935,7 +16988,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  				goto strlen_error;  			}  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else {  strlen_error:  			zend_error(E_WARNING, "strlen() expects parameter 1 to be string, %s given", zend_get_type_by_const(Z_TYPE_P(value))); @@ -17818,7 +17871,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_CONST(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -17833,7 +17886,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_CONST(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_ptr_dtor_nogc(free_op1.var);  					CHECK_EXCEPTION(); @@ -17900,7 +17953,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_CONST(int type,  	}  	if (IS_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -18680,7 +18733,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE  		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && memcmp(Z_STRVAL_P(opline->op2.zv), "class", sizeof("class") - 1) == 0) {  			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */  			ZVAL_STR(EX_VAR(opline->result.var), ce->name); -			STR_ADDREF(ce->name); +			zend_string_addref(ce->name);  		} else {  			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));  		} @@ -18729,7 +18782,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPC  		zval *offset = opline->op2.zv;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -18781,7 +18834,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -18887,7 +18940,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND  	zend_free_op free_op1;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); @@ -19095,7 +19148,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CONST_HANDLER(ZEND  	zend_free_op free_op1;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -19177,7 +19230,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -20874,7 +20927,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCOD  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -20926,7 +20979,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -20960,7 +21013,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE  	zend_free_op free_op1, free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); @@ -21088,7 +21141,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_TMP_HANDLER(ZEND_O  	zend_free_op free_op1, free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -21170,7 +21223,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -22203,7 +22256,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_VAR(int type, ZE  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -22218,7 +22271,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_VAR(int type, ZE  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_ptr_dtor_nogc(free_op1.var);  					CHECK_EXCEPTION(); @@ -22285,7 +22338,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_VAR(int type, ZE  	}  	if (IS_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -23086,7 +23139,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCOD  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -23138,7 +23191,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -23244,7 +23297,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE  	zend_free_op free_op1, free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); @@ -23452,7 +23505,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_VAR_HANDLER(ZEND_O  	zend_free_op free_op1, free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -23534,7 +23587,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -24111,7 +24164,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -24126,7 +24179,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_VAR != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					zval_ptr_dtor_nogc(free_op1.var);  					CHECK_EXCEPTION(); @@ -24193,7 +24246,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_VAR_UNUSED(int type,  	}  	if (IS_VAR != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -24549,7 +24602,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OP  		zval *offset = NULL;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -24601,7 +24654,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -26478,7 +26531,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE  		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -26530,7 +26583,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -26564,7 +26617,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER  	zend_free_op free_op1;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); @@ -26692,7 +26745,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_VAR_CV_HANDLER(ZEND_OP  	zend_free_op free_op1;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -26774,7 +26827,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -27981,7 +28034,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPC  		} else if (Z_STRLEN_P(opline->op2.zv) == sizeof("class")-1 && memcmp(Z_STRVAL_P(opline->op2.zv), "class", sizeof("class") - 1) == 0) {  			/* "class" is assigned as a case-sensitive keyword from zend_do_resolve_class_name */  			ZVAL_STR(EX_VAR(opline->result.var), ce->name); -			STR_ADDREF(ce->name); +			zend_string_addref(ce->name);  		} else {  			zend_error_noreturn(E_ERROR, "Undefined class constant '%s'", Z_STRVAL_P(opline->op2.zv));  		} @@ -27994,7 +28047,7 @@ constant_fetch_end:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -28028,7 +28081,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_obj_zval_ptr_unused(TSRMLS_C); @@ -28156,7 +28209,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CONST_HANDLER(Z  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -28238,7 +28291,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -29277,7 +29330,7 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPC  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -29311,7 +29364,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN  	zend_free_op free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_obj_zval_ptr_unused(TSRMLS_C); @@ -29439,7 +29492,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_TMP_HANDLER(ZEN  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -29521,7 +29574,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -30562,7 +30615,7 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPC  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -30596,7 +30649,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN  	zend_free_op free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_obj_zval_ptr_unused(TSRMLS_C); @@ -30724,7 +30777,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_VAR_HANDLER(ZEN  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -30806,7 +30859,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -31353,7 +31406,7 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_BW_XOR_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPC  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -32356,7 +32409,7 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCO  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -32390,7 +32443,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_obj_zval_ptr_unused(TSRMLS_C); @@ -32518,7 +32571,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_UNUSED_CV_HANDLER(ZEND  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -32600,7 +32653,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -33375,10 +33428,7 @@ static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDL  	varptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);  	if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||  	     (Z_VAR_FLAGS_P(varptr) & IS_VAR_RET_REF)) && -	    ((!Z_REFCOUNTED_P(varptr) && Z_TYPE_P(varptr) != IS_STRING) || -	     Z_ISREF_P(varptr) || -	     Z_TYPE_P(varptr) == IS_OBJECT || -	     (Z_REFCOUNTED_P(varptr) && Z_REFCOUNT_P(varptr) == 1))) { +	    (Z_ISREF_P(varptr) || Z_TYPE_P(varptr) == IS_OBJECT)) {  		ZVAL_MAKE_REF(varptr);  		if (IS_CV == IS_CV) { @@ -33930,15 +33980,23 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS  				}  				ZVAL_DUP(&tmp, array_ref);  				array_ptr = array_ref = &tmp; -			} else if (IS_CV == IS_CV) { +			} else if (IS_CV == IS_CV || IS_CV == IS_VAR) {  				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {  					ZVAL_UNREF(array_ref);  					array_ptr = array_ref;  				} -				if (Z_IMMUTABLE_P(array_ptr)) { +				if (Z_IMMUTABLE_P(array_ptr) || +				    (Z_ISREF_P(array_ref) && +				     Z_REFCOUNTED_P(array_ptr) && +				     Z_REFCOUNT_P(array_ptr) > 1)) { +					if (!Z_IMMUTABLE_P(array_ptr)) { +						Z_DELREF_P(array_ptr); +					}  					zval_copy_ctor(array_ptr);  				} -				Z_ADDREF_P(array_ref); +				if (IS_CV == IS_CV) { +					Z_ADDREF_P(array_ref); +				}  			}  		}  	} @@ -33993,7 +34051,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS  			zend_object *zobj = Z_OBJ_P(array_ptr);  			while (zend_hash_has_more_elements(fe_ht) == SUCCESS) {  				zend_string *str_key; -				ulong int_key; +				zend_ulong int_key;  				zend_uchar key_type;  				key_type = zend_hash_get_current_key(fe_ht, &str_key, &int_key, 0); @@ -34174,7 +34232,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  		} else if (Z_TYPE_P(value) <= IS_DOUBLE) {  			zend_string *str = zval_get_string(value);  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else if (Z_TYPE_P(value) == IS_OBJECT) {  			zend_string *str; @@ -34182,7 +34240,7 @@ static int ZEND_FASTCALL  ZEND_STRLEN_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  				goto strlen_error;  			}  			ZVAL_LONG(EX_VAR(opline->result.var), str->len); -			STR_RELEASE(str); +			zend_string_release(str);  		} else {  strlen_error:  			zend_error(E_WARNING, "strlen() expects parameter 1 to be string, %s given", zend_get_type_by_const(Z_TYPE_P(value))); @@ -35064,7 +35122,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_CONST(int type, Z  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -35079,7 +35137,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_CONST(int type, Z  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CV != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -35146,7 +35204,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_CONST(int type, Z  	}  	if (IS_CV != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -35761,7 +35819,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCO  		zval *offset = opline->op2.zv;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -35813,7 +35871,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -35919,7 +35977,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC); @@ -36127,7 +36185,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CONST_HANDLER(ZEND_  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -36209,7 +36267,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -37817,7 +37875,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -37869,7 +37927,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -37903,7 +37961,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER  	zend_free_op free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC); @@ -38031,7 +38089,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_TMP_HANDLER(ZEND_OP  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -38113,7 +38171,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -39144,7 +39202,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type, ZEN  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -39159,7 +39217,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type, ZEN  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CV != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -39226,7 +39284,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_VAR(int type, ZEN  	}  	if (IS_CV != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -39909,7 +39967,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE  		zend_free_op free_op2;  		zval *offset = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -39961,7 +40019,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -40067,7 +40125,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER  	zend_free_op free_op2;  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC); @@ -40275,7 +40333,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_VAR_HANDLER(ZEND_OP  	zend_free_op free_op2;  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -40357,7 +40415,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		} @@ -40932,7 +40990,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type,  		name = Z_STR_P(varname);  	} else if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {  		name = Z_STR_P(varname); -		STR_ADDREF(name); +		zend_string_addref(name);  	} else {  		name = zval_get_string(varname);  	} @@ -40947,7 +41005,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type,  				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.zv + 1, 0 TSRMLS_CC);  				if (UNEXPECTED(ce == NULL)) {  					if (IS_CV != IS_CONST) { -						STR_RELEASE(name); +						zend_string_release(name);  					}  					CHECK_EXCEPTION(); @@ -41014,7 +41072,7 @@ static int ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_CV_UNUSED(int type,  	}  	if (IS_CV != IS_CONST) { -		STR_RELEASE(name); +		zend_string_release(name);  	}  	ZEND_ASSERT(retval != NULL); @@ -41254,7 +41312,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPC  		zval *offset = NULL;  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -41306,7 +41364,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -43045,7 +43103,7 @@ static int ZEND_FASTCALL  ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_  		zval *offset = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);  		zend_string *str; -		ulong hval; +		zend_ulong hval;  add_again:  		switch (Z_TYPE_P(offset)) { @@ -43097,7 +43155,7 @@ str_index:  static int ZEND_FASTCALL  ZEND_INIT_ARRAY_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)  {  	zval *array; -	zend_uint size; +	uint32_t size;  	USE_OPLINE  	array = EX_VAR(opline->result.var); @@ -43131,7 +43189,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_  	zval *container;  	zval *offset; -	ulong hval; +	zend_ulong hval;  	SAVE_OPLINE();  	container = _get_zval_ptr_cv_BP_VAR_UNSET(execute_data, opline->op1.var TSRMLS_CC); @@ -43259,7 +43317,7 @@ static int ZEND_FASTCALL  ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_CV_CV_HANDLER(ZEND_OPC  	zval *container;  	int result; -	ulong hval; +	zend_ulong hval;  	zval *offset;  	SAVE_OPLINE(); @@ -43341,7 +43399,7 @@ num_index_prop:  					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */  						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {  				ZVAL_DUP(&tmp, offset); -				convert_to_long(&tmp); +				convert_to_int(&tmp);  				offset = &tmp;  			}  		}  | 
