Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/zend_execute.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 2.00 of the Zend license,     |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | http://www.zend.com/license/2_00.txt.                                |
11
   | If you did not receive a copy of the Zend license and are unable to  |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@zend.com so we can mail you a copy immediately.              |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Dmitry Stogov <dmitry@php.net>                              |
18
   +----------------------------------------------------------------------+
19
*/
20
21
#define ZEND_INTENSIVE_DEBUGGING 0
22
23
#include <stdio.h>
24
#include <signal.h>
25
26
#include "zend.h"
27
#include "zend_compile.h"
28
#include "zend_execute.h"
29
#include "zend_API.h"
30
#include "zend_ptr_stack.h"
31
#include "zend_constants.h"
32
#include "zend_extensions.h"
33
#include "zend_ini.h"
34
#include "zend_exceptions.h"
35
#include "zend_interfaces.h"
36
#include "zend_closures.h"
37
#include "zend_generators.h"
38
#include "zend_vm.h"
39
#include "zend_dtrace.h"
40
#include "zend_inheritance.h"
41
#include "zend_type_info.h"
42
#include "zend_smart_str.h"
43
#include "zend_observer.h"
44
#include "zend_system_id.h"
45
#include "zend_call_stack.h"
46
#include "zend_attributes.h"
47
#include "Optimizer/zend_func_info.h"
48
49
/* Virtual current working directory support */
50
#include "zend_virtual_cwd.h"
51
52
#ifdef HAVE_GCC_GLOBAL_REGS
53
# if defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(i386)
54
#  define ZEND_VM_FP_GLOBAL_REG "%esi"
55
#  define ZEND_VM_IP_GLOBAL_REG "%edi"
56
# elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__x86_64__)
57
#  define ZEND_VM_FP_GLOBAL_REG "%r14"
58
#  define ZEND_VM_IP_GLOBAL_REG "%r15"
59
# elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
60
#  define ZEND_VM_FP_GLOBAL_REG "r14"
61
#  define ZEND_VM_IP_GLOBAL_REG "r15"
62
# elif defined(__IBMC__) && ZEND_GCC_VERSION >= 4002 && defined(__powerpc64__)
63
#  define ZEND_VM_FP_GLOBAL_REG "r14"
64
#  define ZEND_VM_IP_GLOBAL_REG "r15"
65
# elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
66
#  define ZEND_VM_FP_GLOBAL_REG "x27"
67
#  define ZEND_VM_IP_GLOBAL_REG "x28"
68
#elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__riscv) && __riscv_xlen == 64
69
#  define ZEND_VM_FP_GLOBAL_REG "x18"
70
#  define ZEND_VM_IP_GLOBAL_REG "x19"
71
# endif
72
#endif
73
74
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
75
# pragma GCC diagnostic ignored "-Wvolatile-register-var"
76
  register zend_execute_data* volatile execute_data __asm__(ZEND_VM_FP_GLOBAL_REG);
77
# pragma GCC diagnostic warning "-Wvolatile-register-var"
78
#endif
79
80
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
81
# define EXECUTE_DATA_D     void
82
# define EXECUTE_DATA_C
83
# define EXECUTE_DATA_DC
84
# define EXECUTE_DATA_CC
85
# define NO_EXECUTE_DATA_CC
86
#else
87
# define EXECUTE_DATA_D     zend_execute_data* execute_data
88
12.3M
# define EXECUTE_DATA_C     execute_data
89
# define EXECUTE_DATA_DC    , EXECUTE_DATA_D
90
10.7M
# define EXECUTE_DATA_CC    , EXECUTE_DATA_C
91
312
# define NO_EXECUTE_DATA_CC , NULL
92
#endif
93
94
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
95
# define OPLINE_D           void
96
# define OPLINE_C
97
# define OPLINE_DC
98
# define OPLINE_CC
99
#else
100
# define OPLINE_D           const zend_op* opline
101
2.41M
# define OPLINE_C           opline
102
# define OPLINE_DC          , OPLINE_D
103
2.41M
# define OPLINE_CC          , OPLINE_C
104
#endif
105
106
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
107
# pragma GCC diagnostic ignored "-Wvolatile-register-var"
108
  register const zend_op* volatile opline __asm__(ZEND_VM_IP_GLOBAL_REG);
109
# pragma GCC diagnostic warning "-Wvolatile-register-var"
110
#else
111
#endif
112
113
9.19M
#define _CONST_CODE  0
114
9.19M
#define _TMP_CODE    1
115
9.19M
#define _VAR_CODE    2
116
45.9M
#define _UNUSED_CODE 3
117
9.19M
#define _CV_CODE     4
118
119
typedef int (ZEND_FASTCALL *incdec_t)(zval *);
120
121
1.26k
#define get_zval_ptr(op_type, node, type) _get_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
122
70
#define get_zval_ptr_deref(op_type, node, type) _get_zval_ptr_deref(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
123
1.81k
#define get_zval_ptr_undef(op_type, node, type) _get_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
124
6.05k
#define get_op_data_zval_ptr_r(op_type, node) _get_op_data_zval_ptr_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
125
0
#define get_op_data_zval_ptr_deref_r(op_type, node) _get_op_data_zval_ptr_deref_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
126
239
#define get_zval_ptr_ptr(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
127
#define get_zval_ptr_ptr_undef(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
128
#define get_obj_zval_ptr(op_type, node, type) _get_obj_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
129
#define get_obj_zval_ptr_deref(op_type, node, type) _get_obj_zval_ptr_deref(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
130
#define get_obj_zval_ptr_undef(op_type, node, type) _get_obj_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
131
#define get_obj_zval_ptr_ptr(op_type, node, type) _get_obj_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
132
133
766k
#define RETURN_VALUE_USED(opline) ((opline)->result_type != IS_UNUSED)
134
135
static ZEND_FUNCTION(pass)
136
142
{
137
142
}
138
139
ZEND_BEGIN_ARG_INFO_EX(zend_pass_function_arg_info, 0, 0, 0)
140
ZEND_END_ARG_INFO()
141
142
ZEND_API const zend_internal_function zend_pass_function = {
143
  ZEND_INTERNAL_FUNCTION, /* type              */
144
  {0, 0, 0},              /* arg_flags         */
145
  0,                      /* fn_flags          */
146
  NULL,                   /* name              */
147
  NULL,                   /* scope             */
148
  NULL,                   /* prototype         */
149
  0,                      /* num_args          */
150
  0,                      /* required_num_args */
151
  (zend_internal_arg_info *) zend_pass_function_arg_info + 1, /* arg_info */
152
  NULL,                   /* attributes        */
153
  NULL,                   /* run_time_cache    */
154
  NULL,                   /* doc_comment       */
155
  0,                      /* T                 */
156
  NULL,                   /* prop_info */
157
  ZEND_FN(pass),          /* handler           */
158
  NULL,                   /* module            */
159
  NULL,                   /* frameless_function_infos */
160
  {NULL,NULL,NULL,NULL}   /* reserved          */
161
};
162
163
2.87k
#define FREE_VAR_PTR_AND_EXTRACT_RESULT_IF_NECESSARY(free_var) do {     \
164
2.87k
  zval *__container_to_free = EX_VAR(free_var);             \
165
2.87k
  if (UNEXPECTED(Z_REFCOUNTED_P(__container_to_free))) {         \
166
304
    zend_refcounted *__ref = Z_COUNTED_P(__container_to_free);      \
167
304
    if (UNEXPECTED(!GC_DELREF(__ref))) {               \
168
157
      zval *__zv = EX_VAR(opline->result.var);           \
169
157
      if (EXPECTED(Z_TYPE_P(__zv) == IS_INDIRECT)) {         \
170
152
        ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));           \
171
152
      }                                \
172
157
      rc_dtor_func(__ref);                      \
173
157
    }                                  \
174
304
  }                                    \
175
2.87k
} while (0)
176
177
#define FREE_OP(type, var) \
178
16.2k
  if ((type) & (IS_TMP_VAR|IS_VAR)) { \
179
7.37k
    zval_ptr_dtor_nogc(EX_VAR(var)); \
180
7.37k
  }
181
182
1.86M
#define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
183
184
600k
#define ZEND_VM_STACK_PAGE_SLOTS (16 * 1024) /* should be a power of 2 */
185
186
600k
#define ZEND_VM_STACK_PAGE_SIZE  (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))
187
188
#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
189
57
  (((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
190
57
    + ((page_size) - 1)) & ~((page_size) - 1))
191
192
ZEND_API void zend_vm_stack_init(void)
193
300k
{
194
300k
  EG(vm_stack_page_size) = ZEND_VM_STACK_PAGE_SIZE;
195
300k
  EG(vm_stack) = zend_vm_stack_new_page(ZEND_VM_STACK_PAGE_SIZE, NULL);
196
300k
  EG(vm_stack_top) = EG(vm_stack)->top;
197
300k
  EG(vm_stack_end) = EG(vm_stack)->end;
198
300k
}
199
200
ZEND_API void zend_vm_stack_init_ex(size_t page_size)
201
0
{
202
  /* page_size must be a power of 2 */
203
0
  ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
204
0
  EG(vm_stack_page_size) = page_size;
205
0
  EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
206
0
  EG(vm_stack_top) = EG(vm_stack)->top;
207
0
  EG(vm_stack_end) = EG(vm_stack)->end;
208
0
}
209
210
ZEND_API void zend_vm_stack_destroy(void)
211
300k
{
212
300k
  zend_vm_stack stack = EG(vm_stack);
213
214
601k
  while (stack != NULL) {
215
300k
    zend_vm_stack p = stack->prev;
216
300k
    efree(stack);
217
300k
    stack = p;
218
300k
  }
219
300k
}
220
221
ZEND_API void* zend_vm_stack_extend(size_t size)
222
80
{
223
80
  zend_vm_stack stack;
224
80
  void *ptr;
225
226
80
  stack = EG(vm_stack);
227
80
  stack->top = EG(vm_stack_top);
228
80
  EG(vm_stack) = stack = zend_vm_stack_new_page(
229
80
    EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
230
57
      EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
231
80
    stack);
232
80
  ptr = stack->top;
233
80
  EG(vm_stack_top) = (void*)(((char*)ptr) + size);
234
80
  EG(vm_stack_end) = stack->end;
235
80
  return ptr;
236
80
}
237
238
ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, uint32_t var)
239
0
{
240
0
  return EX_VAR(var);
241
0
}
242
243
ZEND_API bool zend_gcc_global_regs(void)
244
0
{
245
  #if defined(HAVE_GCC_GLOBAL_REGS)
246
        return 1;
247
  #else
248
0
        return 0;
249
0
  #endif
250
0
}
251
252
static zend_always_inline zval *_get_zval_ptr_tmp(uint32_t var EXECUTE_DATA_DC)
253
1.12M
{
254
1.12M
  zval *ret = EX_VAR(var);
255
256
1.12M
  ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
257
258
1.12M
  return ret;
259
1.12M
}
260
261
static zend_always_inline zval *_get_zval_ptr_var(uint32_t var EXECUTE_DATA_DC)
262
4.20M
{
263
4.20M
  zval *ret = EX_VAR(var);
264
265
4.20M
  return ret;
266
4.20M
}
267
268
static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var EXECUTE_DATA_DC)
269
1.76k
{
270
1.76k
  zval *ret = EX_VAR(var);
271
272
1.76k
  ZVAL_DEREF(ret);
273
1.76k
  return ret;
274
1.76k
}
275
276
static zend_never_inline ZEND_COLD zval* zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)
277
1.86M
{
278
1.86M
  if (EXPECTED(EG(exception) == NULL)) {
279
1.86M
    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
280
1.86M
    zend_error_unchecked(E_WARNING, "Undefined variable $%S", cv);
281
1.86M
  }
282
1.86M
  return &EG(uninitialized_zval);
283
1.86M
}
284
285
static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op1(EXECUTE_DATA_D)
286
1.11M
{
287
1.11M
  return zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
288
1.11M
}
289
290
static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op2(EXECUTE_DATA_D)
291
483k
{
292
483k
  return zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
293
483k
}
294
295
1.11M
#define ZVAL_UNDEFINED_OP1() _zval_undefined_op1(EXECUTE_DATA_C)
296
483k
#define ZVAL_UNDEFINED_OP2() _zval_undefined_op2(EXECUTE_DATA_C)
297
298
static zend_never_inline ZEND_COLD zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type EXECUTE_DATA_DC)
299
103
{
300
103
  switch (type) {
301
103
    case BP_VAR_R:
302
103
    case BP_VAR_UNSET:
303
103
      ptr = zval_undefined_cv(var EXECUTE_DATA_CC);
304
103
      break;
305
0
    case BP_VAR_IS:
306
0
      ptr = &EG(uninitialized_zval);
307
0
      break;
308
0
    case BP_VAR_RW:
309
0
      zval_undefined_cv(var EXECUTE_DATA_CC);
310
0
      ZEND_FALLTHROUGH;
311
0
    case BP_VAR_W:
312
0
      ZVAL_NULL(ptr);
313
0
      break;
314
103
  }
315
103
  return ptr;
316
103
}
317
318
static zend_always_inline zval *_get_zval_ptr_cv(uint32_t var, int type EXECUTE_DATA_DC)
319
864
{
320
864
  zval *ret = EX_VAR(var);
321
322
864
  if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
323
37
    if (type == BP_VAR_W) {
324
14
      ZVAL_NULL(ret);
325
23
    } else {
326
23
      return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
327
23
    }
328
37
  }
329
841
  return ret;
330
864
}
331
332
static zend_always_inline zval *_get_zval_ptr_cv_deref(uint32_t var, int type EXECUTE_DATA_DC)
333
360
{
334
360
  zval *ret = EX_VAR(var);
335
336
360
  if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
337
80
    if (type == BP_VAR_W) {
338
0
      ZVAL_NULL(ret);
339
0
      return ret;
340
80
    } else {
341
80
      return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
342
80
    }
343
80
  }
344
280
  ZVAL_DEREF(ret);
345
280
  return ret;
346
360
}
347
348
static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
349
85.6k
{
350
85.6k
  zval *ret = EX_VAR(var);
351
352
85.6k
  if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
353
10.3k
    return zval_undefined_cv(var EXECUTE_DATA_CC);
354
10.3k
  }
355
75.2k
  return ret;
356
85.6k
}
357
358
static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
359
28.1k
{
360
28.1k
  zval *ret = EX_VAR(var);
361
362
28.1k
  if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
363
2.37k
    return zval_undefined_cv(var EXECUTE_DATA_CC);
364
2.37k
  }
365
25.8k
  ZVAL_DEREF(ret);
366
25.8k
  return ret;
367
28.1k
}
368
369
static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)
370
1.45k
{
371
1.45k
  zval *ret = EX_VAR(var);
372
373
1.45k
  return ret;
374
1.45k
}
375
376
static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)
377
2.25M
{
378
2.25M
  zval *ret = EX_VAR(var);
379
380
2.25M
  if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
381
258k
    zval_undefined_cv(var EXECUTE_DATA_CC);
382
258k
    ZVAL_NULL(ret);
383
258k
    return ret;
384
258k
  }
385
1.99M
  return ret;
386
2.25M
}
387
388
static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)
389
19.9k
{
390
19.9k
  zval *ret = EX_VAR(var);
391
392
19.9k
  if (Z_TYPE_P(ret) == IS_UNDEF) {
393
1.14k
    ZVAL_NULL(ret);
394
1.14k
  }
395
19.9k
  return ret;
396
19.9k
}
397
398
static zend_always_inline zval *_get_zval_ptr_tmpvarcv(int op_type, znode_op node, int type EXECUTE_DATA_DC)
399
425
{
400
425
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
401
144
    if (op_type == IS_TMP_VAR) {
402
42
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
403
102
    } else {
404
102
      ZEND_ASSERT(op_type == IS_VAR);
405
102
      return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
406
102
    }
407
281
  } else {
408
281
    ZEND_ASSERT(op_type == IS_CV);
409
281
    return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
410
281
  }
411
425
}
412
413
static zend_always_inline zval *_get_zval_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
414
1.26k
{
415
1.26k
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
416
250
    if (!ZEND_DEBUG || op_type == IS_VAR) {
417
104
      return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
418
146
    } else {
419
146
      ZEND_ASSERT(op_type == IS_TMP_VAR);
420
146
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
421
146
    }
422
1.01k
  } else {
423
1.01k
    if (op_type == IS_CONST) {
424
202
      return RT_CONSTANT(opline, node);
425
815
    } else if (op_type == IS_CV) {
426
815
      return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
427
815
    } else {
428
0
      return NULL;
429
0
    }
430
1.01k
  }
431
1.26k
}
432
433
static zend_always_inline zval *_get_op_data_zval_ptr_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
434
6.19k
{
435
6.19k
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
436
1.01k
    if (!ZEND_DEBUG || op_type == IS_VAR) {
437
31
      return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
438
986
    } else {
439
986
      ZEND_ASSERT(op_type == IS_TMP_VAR);
440
986
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
441
986
    }
442
5.17k
  } else {
443
5.17k
    if (op_type == IS_CONST) {
444
3.81k
      return RT_CONSTANT(opline + 1, node);
445
3.81k
    } else if (op_type == IS_CV) {
446
1.36k
      return _get_zval_ptr_cv_BP_VAR_R(node.var EXECUTE_DATA_CC);
447
1.36k
    } else {
448
0
      return NULL;
449
0
    }
450
5.17k
  }
451
6.19k
}
452
453
static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_zval_ptr_deref(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
454
289
{
455
289
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
456
202
    if (op_type == IS_TMP_VAR) {
457
121
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
458
121
    } else {
459
81
      ZEND_ASSERT(op_type == IS_VAR);
460
81
      return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
461
81
    }
462
202
  } else {
463
87
    if (op_type == IS_CONST) {
464
8
      return RT_CONSTANT(opline, node);
465
79
    } else if (op_type == IS_CV) {
466
79
      return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
467
79
    } else {
468
0
      return NULL;
469
0
    }
470
87
  }
471
289
}
472
473
static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_op_data_zval_ptr_deref_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
474
0
{
475
0
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
476
0
    if (op_type == IS_TMP_VAR) {
477
0
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
478
0
    } else {
479
0
      ZEND_ASSERT(op_type == IS_VAR);
480
0
      return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
481
0
    }
482
0
  } else {
483
0
    if (op_type == IS_CONST) {
484
0
      return RT_CONSTANT(opline + 1, node);
485
0
    } else if (op_type == IS_CV) {
486
0
      return _get_zval_ptr_cv_deref_BP_VAR_R(node.var EXECUTE_DATA_CC);
487
0
    } else {
488
0
      return NULL;
489
0
    }
490
0
  }
491
0
}
492
493
static zend_always_inline zval *_get_zval_ptr_undef(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
494
1.81k
{
495
1.81k
  if (op_type & (IS_TMP_VAR|IS_VAR)) {
496
290
    if (!ZEND_DEBUG || op_type == IS_VAR) {
497
275
      return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
498
275
    } else {
499
15
      ZEND_ASSERT(op_type == IS_TMP_VAR);
500
15
      return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
501
15
    }
502
1.52k
  } else {
503
1.52k
    if (op_type == IS_CONST) {
504
377
      return RT_CONSTANT(opline, node);
505
1.14k
    } else if (op_type == IS_CV) {
506
1.14k
      return EX_VAR(node.var);
507
1.14k
    } else {
508
0
      return NULL;
509
0
    }
510
1.52k
  }
511
1.81k
}
512
513
static zend_always_inline zval *_get_zval_ptr_ptr_var(uint32_t var EXECUTE_DATA_DC)
514
59.0k
{
515
59.0k
  zval *ret = EX_VAR(var);
516
517
59.0k
  if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
518
54.0k
    ret = Z_INDIRECT_P(ret);
519
54.0k
  }
520
59.0k
  return ret;
521
59.0k
}
522
523
static inline zval *_get_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
524
239
{
525
239
  if (op_type == IS_CV) {
526
49
    return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
527
190
  } else /* if (op_type == IS_VAR) */ {
528
190
    ZEND_ASSERT(op_type == IS_VAR);
529
190
    return _get_zval_ptr_ptr_var(node.var EXECUTE_DATA_CC);
530
190
  }
531
239
}
532
533
static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
534
0
{
535
0
  if (op_type == IS_UNUSED) {
536
0
    return &EX(This);
537
0
  }
538
0
  return get_zval_ptr(op_type, op, type);
539
0
}
540
541
static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_deref(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
542
0
{
543
0
  if (op_type == IS_UNUSED) {
544
0
    return &EX(This);
545
0
  }
546
0
  return get_zval_ptr_deref(op_type, op, type);
547
0
}
548
549
static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_undef(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
550
0
{
551
0
  if (op_type == IS_UNUSED) {
552
0
    return &EX(This);
553
0
  }
554
0
  return get_zval_ptr_undef(op_type, op, type);
555
0
}
556
557
static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
558
0
{
559
0
  if (op_type == IS_UNUSED) {
560
0
    return &EX(This);
561
0
  }
562
0
  return get_zval_ptr_ptr(op_type, node, type);
563
0
}
564
565
static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr, zend_refcounted **garbage_ptr)
566
16.0k
{
567
16.0k
  zend_reference *ref;
568
569
16.0k
  if (EXPECTED(!Z_ISREF_P(value_ptr))) {
570
5.13k
    ZVAL_NEW_REF(value_ptr, value_ptr);
571
10.9k
  } else if (UNEXPECTED(variable_ptr == value_ptr)) {
572
1.47k
    return;
573
1.47k
  }
574
575
14.6k
  ref = Z_REF_P(value_ptr);
576
14.6k
  GC_ADDREF(ref);
577
14.6k
  if (Z_REFCOUNTED_P(variable_ptr)) {
578
5.93k
    *garbage_ptr = Z_COUNTED_P(variable_ptr);
579
5.93k
  }
580
14.6k
  ZVAL_REF(variable_ptr, ref);
581
14.6k
}
582
583
static zend_never_inline zval* zend_assign_to_typed_property_reference(zend_property_info *prop_info, zval *prop, zval *value_ptr, zend_refcounted **garbage_ptr EXECUTE_DATA_DC)
584
780
{
585
780
  if (!zend_verify_prop_assignable_by_ref(prop_info, value_ptr, EX_USES_STRICT_TYPES())) {
586
162
    return &EG(uninitialized_zval);
587
162
  }
588
618
  if (Z_ISREF_P(prop)) {
589
326
    ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(prop), prop_info);
590
326
  }
591
618
  zend_assign_to_variable_reference(prop, value_ptr, garbage_ptr);
592
618
  ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(prop), prop_info);
593
618
  return prop;
594
780
}
595
596
static zend_never_inline ZEND_COLD zval *zend_wrong_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr, zend_refcounted **garbage_ptr OPLINE_DC EXECUTE_DATA_DC)
597
54
{
598
54
  zend_error(E_NOTICE, "Only variables should be assigned by reference");
599
54
  if (UNEXPECTED(EG(exception) != NULL)) {
600
5
    return &EG(uninitialized_zval);
601
5
  }
602
603
  /* Use IS_TMP_VAR instead of IS_VAR to avoid ISREF check */
604
49
  Z_TRY_ADDREF_P(value_ptr);
605
49
  return zend_assign_to_variable_ex(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES(), garbage_ptr);
606
54
}
607
608
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_cannot_pass_by_reference(uint32_t arg_num)
609
118
{
610
118
  const zend_execute_data *execute_data = EG(current_execute_data);
611
118
  zend_string *func_name = get_function_or_method_name(EX(call)->func);
612
118
  const char *param_name = get_function_arg_name(EX(call)->func, arg_num);
613
614
118
  zend_throw_error(NULL, "%s(): Argument #%d%s%s%s could not be passed by reference",
615
118
    ZSTR_VAL(func_name), arg_num, param_name ? " ($" : "", param_name ? param_name : "", param_name ? ")" : ""
616
118
  );
617
618
118
  zend_string_release(func_name);
619
118
}
620
621
21
static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_prop_error(const zend_property_info *prop) {
622
21
  zend_string *type_str = zend_type_to_string(prop->type);
623
21
  zend_type_error(
624
21
    "Cannot auto-initialize an array inside property %s::$%s of type %s",
625
21
    ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
626
21
    ZSTR_VAL(type_str)
627
21
  );
628
21
  zend_string_release(type_str);
629
21
}
630
631
10
static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_ref_error(const zend_property_info *prop) {
632
10
  zend_string *type_str = zend_type_to_string(prop->type);
633
10
  zend_type_error(
634
10
    "Cannot auto-initialize an array inside a reference held by property %s::$%s of type %s",
635
10
    ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
636
10
    ZSTR_VAL(type_str)
637
10
  );
638
10
  zend_string_release(type_str);
639
10
}
640
641
static zend_never_inline ZEND_COLD void zend_throw_access_uninit_prop_by_ref_error(
642
17
    const zend_property_info *prop) {
643
17
  zend_throw_error(NULL,
644
17
    "Cannot access uninitialized non-nullable property %s::$%s by reference",
645
17
    ZSTR_VAL(prop->ce->name),
646
17
    zend_get_unmangled_property_name(prop->name));
647
17
}
648
649
/* this should modify object only if it's empty */
650
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_throw_non_object_error(const zval *object, zval *property OPLINE_DC EXECUTE_DATA_DC)
651
554
{
652
554
  zend_string *tmp_property_name;
653
554
  zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
654
655
554
  if (opline->opcode == ZEND_PRE_INC_OBJ
656
554
   || opline->opcode == ZEND_PRE_DEC_OBJ
657
554
   || opline->opcode == ZEND_POST_INC_OBJ
658
554
   || opline->opcode == ZEND_POST_DEC_OBJ) {
659
85
    zend_throw_error(NULL,
660
85
      "Attempt to increment/decrement property \"%s\" on %s",
661
85
      ZSTR_VAL(property_name), zend_zval_value_name(object)
662
85
    );
663
469
  } else if (opline->opcode == ZEND_FETCH_OBJ_W
664
469
      || opline->opcode == ZEND_FETCH_OBJ_RW
665
469
      || opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG
666
469
      || opline->opcode == ZEND_ASSIGN_OBJ_REF) {
667
144
    zend_throw_error(NULL,
668
144
      "Attempt to modify property \"%s\" on %s",
669
144
      ZSTR_VAL(property_name), zend_zval_value_name(object)
670
144
    );
671
325
  } else {
672
325
    zend_throw_error(NULL,
673
325
      "Attempt to assign property \"%s\" on %s",
674
325
      ZSTR_VAL(property_name), zend_zval_value_name(object)
675
325
    );
676
325
  }
677
554
  zend_tmp_string_release(tmp_property_name);
678
679
554
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
680
255
    ZVAL_NULL(EX_VAR(opline->result.var));
681
255
  }
682
554
}
683
684
static ZEND_COLD void zend_verify_type_error_common(
685
    const zend_function *zf, const zend_arg_info *arg_info, const zval *value,
686
    const char **fname, const char **fsep, const char **fclass,
687
    zend_string **need_msg, const char **given_kind)
688
992
{
689
992
  *fname = ZSTR_VAL(zf->common.function_name);
690
992
  if (zf->common.scope) {
691
278
    *fsep =  "::";
692
278
    *fclass = ZSTR_VAL(zf->common.scope->name);
693
714
  } else {
694
714
    *fsep =  "";
695
714
    *fclass = "";
696
714
  }
697
698
992
  *need_msg = zend_type_to_string_resolved(arg_info->type, zf->common.scope);
699
700
992
  if (value) {
701
908
    *given_kind = zend_zval_value_name(value);
702
908
  } else {
703
84
    *given_kind = "none";
704
84
  }
705
992
}
706
707
ZEND_API ZEND_COLD void zend_verify_arg_error(
708
    const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, const zval *value)
709
661
{
710
661
  const zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
711
661
  const char *fname, *fsep, *fclass;
712
661
  zend_string *need_msg;
713
661
  const char *given_msg;
714
715
661
  zend_verify_type_error_common(
716
661
    zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
717
718
661
  ZEND_ASSERT(zf->common.type == ZEND_USER_FUNCTION
719
661
    && "Arginfo verification is not performed for internal functions");
720
661
  if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
721
637
    zend_argument_type_error(arg_num, "must be of type %s, %s given, called in %s on line %d",
722
637
      ZSTR_VAL(need_msg), given_msg,
723
637
      ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno
724
637
    );
725
637
  } else {
726
24
    zend_argument_type_error(arg_num,
727
24
      "must be of type %s, %s given", ZSTR_VAL(need_msg), given_msg);
728
24
  }
729
730
661
  zend_string_release(need_msg);
731
661
}
732
733
static bool zend_verify_weak_scalar_type_hint(uint32_t type_mask, zval *arg)
734
2.59k
{
735
2.59k
  zend_long lval;
736
2.59k
  double dval;
737
2.59k
  zend_string *str;
738
2.59k
  bool bval;
739
740
  /* Type preference order: int -> float -> string -> bool */
741
2.59k
  if (type_mask & MAY_BE_LONG) {
742
    /* For an int|float union type and string value,
743
     * determine chosen type by is_numeric_string() semantics. */
744
1.10k
    if ((type_mask & MAY_BE_DOUBLE) && Z_TYPE_P(arg) == IS_STRING) {
745
66
      uint8_t type = is_numeric_str_function(Z_STR_P(arg), &lval, &dval);
746
66
      if (type == IS_LONG) {
747
15
        zend_string_release(Z_STR_P(arg));
748
15
        ZVAL_LONG(arg, lval);
749
15
        return 1;
750
15
      }
751
51
      if (type == IS_DOUBLE) {
752
16
        zend_string_release(Z_STR_P(arg));
753
16
        ZVAL_DOUBLE(arg, dval);
754
16
        return 1;
755
16
      }
756
1.03k
    } else if (zend_parse_arg_long_weak(arg, &lval, 0)) {
757
590
      zval_ptr_dtor(arg);
758
590
      ZVAL_LONG(arg, lval);
759
590
      return 1;
760
590
    } else if (UNEXPECTED(EG(exception))) {
761
5
      return 0;
762
5
    }
763
1.10k
  }
764
1.96k
  if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval, 0)) {
765
177
    zval_ptr_dtor(arg);
766
177
    ZVAL_DOUBLE(arg, dval);
767
177
    return 1;
768
177
  }
769
1.78k
  if ((type_mask & MAY_BE_STRING) && zend_parse_arg_str_weak(arg, &str, 0)) {
770
    /* on success "arg" is converted to IS_STRING */
771
489
    return 1;
772
489
  }
773
1.29k
  if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval, 0)) {
774
33
    zval_ptr_dtor(arg);
775
33
    ZVAL_BOOL(arg, bval);
776
33
    return 1;
777
33
  }
778
1.26k
  return 0;
779
1.29k
}
780
781
#if ZEND_DEBUG
782
3.35k
static bool can_convert_to_string(const zval *zv) {
783
  /* We don't call cast_object here, because this check must be side-effect free. As this
784
   * is only used for a sanity check of arginfo/zpp consistency, it's okay if we accept
785
   * more than actually allowed here. */
786
3.35k
  if (Z_TYPE_P(zv) == IS_OBJECT) {
787
865
    return Z_OBJ_HT_P(zv)->cast_object != zend_std_cast_object_tostring
788
865
      || Z_OBJCE_P(zv)->__tostring;
789
865
  }
790
2.48k
  return Z_TYPE_P(zv) <= IS_STRING;
791
3.35k
}
792
793
/* Used to sanity-check internal arginfo types without performing any actual type conversions. */
794
static bool zend_verify_weak_scalar_type_hint_no_sideeffect(uint32_t type_mask, const zval *arg)
795
5.40k
{
796
5.40k
  zend_long lval;
797
5.40k
  double dval;
798
5.40k
  bool bval;
799
800
  /* Pass (uint32_t)-1 as arg_num to indicate to ZPP not to emit any deprecation notice,
801
   * this is needed because the version with side effects also uses 0 (e.g. for typed properties) */
802
5.40k
  if ((type_mask & MAY_BE_LONG) && zend_parse_arg_long_weak(arg, &lval, (uint32_t)-1)) {
803
337
    return 1;
804
337
  }
805
5.06k
  if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval, (uint32_t)-1)) {
806
300
    return 1;
807
300
  }
808
4.76k
  if ((type_mask & MAY_BE_STRING) && can_convert_to_string(arg)) {
809
3.28k
    return 1;
810
3.28k
  }
811
1.48k
  if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval, (uint32_t)-1)) {
812
1.16k
    return 1;
813
1.16k
  }
814
326
  return 0;
815
1.48k
}
816
#endif
817
818
ZEND_API bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, bool strict, bool is_internal_arg)
819
13.3k
{
820
13.3k
  if (UNEXPECTED(strict)) {
821
    /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
822
210
    if (!(type_mask & MAY_BE_DOUBLE) || Z_TYPE_P(arg) != IS_LONG) {
823
205
      return 0;
824
205
    }
825
13.1k
  } else if (UNEXPECTED(Z_TYPE_P(arg) == IS_NULL)) {
826
    /* NULL may be accepted only by nullable hints (this is already checked).
827
     * As an exception for internal functions, null is allowed for scalar types in weak mode. */
828
5.49k
    return is_internal_arg
829
5.49k
      && (type_mask & (MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING));
830
5.49k
  }
831
7.62k
#if ZEND_DEBUG
832
7.62k
  if (is_internal_arg) {
833
5.40k
    return zend_verify_weak_scalar_type_hint_no_sideeffect(type_mask, arg);
834
5.40k
  }
835
2.22k
#endif
836
2.22k
  return zend_verify_weak_scalar_type_hint(type_mask, arg);
837
7.62k
}
838
839
ZEND_COLD zend_never_inline void zend_verify_class_constant_type_error(const zend_class_constant *c, const zend_string *name, const zval *constant)
840
58
{
841
58
  zend_string *type_str = zend_type_to_string(c->type);
842
843
58
  zend_type_error("Cannot assign %s to class constant %s::%s of type %s",
844
58
    zend_zval_type_name(constant), ZSTR_VAL(c->ce->name), ZSTR_VAL(name), ZSTR_VAL(type_str));
845
846
58
  zend_string_release(type_str);
847
58
}
848
849
ZEND_COLD zend_never_inline void zend_verify_property_type_error(const zend_property_info *info, const zval *property)
850
605
{
851
605
  zend_string *type_str;
852
853
  /* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
854
605
  if (EG(exception)) {
855
16
    return;
856
16
  }
857
858
589
  type_str = zend_type_to_string(info->type);
859
589
  zend_type_error("Cannot assign %s to property %s::$%s of type %s",
860
589
    zend_zval_value_name(property),
861
589
    ZSTR_VAL(info->ce->name),
862
589
    zend_get_unmangled_property_name(info->name),
863
589
    ZSTR_VAL(type_str));
864
589
  zend_string_release(type_str);
865
589
}
866
867
ZEND_COLD zend_never_inline void zend_magic_get_property_type_inconsistency_error(const zend_property_info *info, const zval *property)
868
15
{
869
  /* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
870
15
  if (EG(exception)) {
871
2
    return;
872
2
  }
873
874
13
  zend_string *type_str = zend_type_to_string(info->type);
875
13
  zend_type_error("Value of type %s returned from %s::__get() must be compatible with unset property %s::$%s of type %s",
876
13
    zend_zval_type_name(property),
877
13
    ZSTR_VAL(info->ce->name),
878
13
    ZSTR_VAL(info->ce->name),
879
13
    zend_get_unmangled_property_name(info->name),
880
13
    ZSTR_VAL(type_str));
881
13
  zend_string_release(type_str);
882
13
}
883
884
ZEND_COLD void zend_match_unhandled_error(const zval *value)
885
163
{
886
163
  zend_long max_len = EG(exception_string_param_max_len);
887
163
  smart_str msg = {0};
888
163
  if (
889
163
    EG(exception_ignore_args)
890
163
    || (Z_TYPE_P(value) == IS_STRING && max_len == 0)
891
163
    || smart_str_append_zval(&msg, value, max_len) != SUCCESS
892
163
  ) {
893
13
    smart_str_appendl(&msg, "of type ", sizeof("of type ")-1);
894
13
    smart_str_appends(&msg, zend_zval_type_name(value));
895
13
  }
896
163
  smart_str_0(&msg);
897
898
163
  zend_throw_exception_ex(
899
163
    zend_ce_unhandled_match_error, 0, "Unhandled match case %s", ZSTR_VAL(msg.s));
900
901
163
  smart_str_free(&msg);
902
163
}
903
904
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_modification_error(
905
241
    const zend_property_info *info) {
906
241
  zend_readonly_property_modification_error_ex(
907
241
    ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
908
241
}
909
910
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_modification_error_ex(
911
241
    const char *class_name, const char *prop_name) {
912
241
  zend_throw_error(NULL, "Cannot modify readonly property %s::$%s", class_name, prop_name);
913
241
}
914
915
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_indirect_modification_error(const zend_property_info *info)
916
144
{
917
144
  zend_throw_error(NULL, "Cannot indirectly modify readonly property %s::$%s",
918
144
    ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
919
144
}
920
921
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_invalid_class_constant_type_error(const uint8_t type)
922
234
{
923
234
  zend_type_error("Cannot use value of type %s as class constant name", zend_get_type_by_const(type));
924
234
}
925
926
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_object_released_while_assigning_to_property_error(const zend_property_info *info)
927
14
{
928
14
  zend_throw_error(NULL, "Object was released while assigning to property %s::$%s",
929
14
    ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
930
14
}
931
932
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_asymmetric_visibility_property_modification_error(
933
  const zend_property_info *prop_info, const char *operation
934
339
) {
935
339
  zend_class_entry *scope;
936
339
  if (EG(fake_scope)) {
937
0
    scope = EG(fake_scope);
938
339
  } else {
939
339
    scope = zend_get_called_scope(EG(current_execute_data));
940
339
  }
941
942
339
  const char *visibility;
943
339
  if (prop_info->flags & ZEND_ACC_PRIVATE_SET) {
944
279
    visibility = "private(set)";
945
279
  } else {
946
60
    ZEND_ASSERT(prop_info->flags & ZEND_ACC_PROTECTED_SET);
947
60
    if (prop_info->flags & ZEND_ACC_READONLY) {
948
40
      visibility = "protected(set) readonly";
949
40
    } else {
950
20
      visibility = "protected(set)";
951
20
    }
952
60
  }
953
954
339
  zend_throw_error(NULL, "Cannot %s %s property %s::$%s from %s%s",
955
339
    operation,
956
339
    visibility,
957
339
    ZSTR_VAL(prop_info->ce->name),
958
339
    ZSTR_VAL(prop_info->name),
959
339
    scope ? "scope " : "global scope", scope ? ZSTR_VAL(scope->name) : "");
960
339
}
961
962
38
static const zend_class_entry *resolve_single_class_type(zend_string *name, const zend_class_entry *self_ce) {
963
38
  if (zend_string_equals_ci(name, ZSTR_KNOWN(ZEND_STR_SELF))) {
964
25
    return self_ce;
965
25
  } else if (zend_string_equals_ci(name, ZSTR_KNOWN(ZEND_STR_PARENT))) {
966
13
    return self_ce->parent;
967
13
  } else {
968
0
    return zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
969
0
  }
970
38
}
971
972
static zend_always_inline const zend_class_entry *zend_ce_from_type(
973
280k
    const zend_class_entry *scope, const zend_type *type) {
974
280k
  ZEND_ASSERT(ZEND_TYPE_HAS_NAME(*type));
975
280k
  zend_string *name = ZEND_TYPE_NAME(*type);
976
280k
  if (ZSTR_HAS_CE_CACHE(name)) {
977
280k
    zend_class_entry *ce = ZSTR_GET_CE_CACHE(name);
978
280k
    if (!ce) {
979
2.25k
      ce = zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
980
2.25k
    }
981
280k
    return ce;
982
280k
  }
983
38
  return resolve_single_class_type(name, scope);
984
280k
}
985
986
static bool zend_check_intersection_for_property_or_class_constant_class_type(
987
  const zend_class_entry *scope, const zend_type_list *intersection_type_list, const zend_class_entry *value_ce)
988
185
{
989
185
  const zend_type *list_type;
990
991
545
  ZEND_TYPE_LIST_FOREACH(intersection_type_list, list_type) {
992
545
    ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
993
360
    const zend_class_entry *ce = zend_ce_from_type(scope, list_type);
994
360
    if (!ce || !instanceof_function(value_ce, ce)) {
995
80
      return false;
996
80
    }
997
360
  } ZEND_TYPE_LIST_FOREACH_END();
998
105
  return true;
999
185
}
1000
1001
static bool zend_check_and_resolve_property_or_class_constant_class_type(
1002
280k
  const zend_class_entry *scope, const zend_type member_type, const zend_class_entry *value_ce) {
1003
280k
  if (ZEND_TYPE_HAS_LIST(member_type)) {
1004
261
    if (ZEND_TYPE_IS_INTERSECTION(member_type)) {
1005
100
      return zend_check_intersection_for_property_or_class_constant_class_type(
1006
100
        scope, ZEND_TYPE_LIST(member_type), value_ce);
1007
161
    } else {
1008
161
      const zend_type *list_type;
1009
401
      ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(member_type), list_type) {
1010
401
        if (ZEND_TYPE_IS_INTERSECTION(*list_type)) {
1011
85
          if (zend_check_intersection_for_property_or_class_constant_class_type(
1012
85
              scope, ZEND_TYPE_LIST(*list_type), value_ce)) {
1013
55
            return true;
1014
55
          }
1015
30
          continue;
1016
85
        }
1017
155
        ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
1018
155
        const zend_class_entry *ce = zend_ce_from_type(scope, list_type);
1019
155
        if (ce && instanceof_function(value_ce, ce)) {
1020
66
          return true;
1021
66
        }
1022
155
      } ZEND_TYPE_LIST_FOREACH_END();
1023
1024
40
      if ((ZEND_TYPE_PURE_MASK(member_type) & MAY_BE_STATIC)) {
1025
0
        return value_ce == scope;
1026
0
      }
1027
1028
40
      return false;
1029
40
    }
1030
279k
  } else if ((ZEND_TYPE_PURE_MASK(member_type) & MAY_BE_STATIC) && value_ce == scope) {
1031
10
    return true;
1032
279k
  } else if (ZEND_TYPE_HAS_NAME(member_type)) {
1033
279k
    const zend_class_entry *ce = zend_ce_from_type(scope, &member_type);
1034
279k
    return ce && instanceof_function(value_ce, ce);
1035
279k
  }
1036
1037
7
  return false;
1038
280k
}
1039
1040
static zend_always_inline bool i_zend_check_property_type(const zend_property_info *info, zval *property, bool strict)
1041
342k
{
1042
342k
  ZEND_ASSERT(!Z_ISREF_P(property));
1043
342k
  if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(info->type, Z_TYPE_P(property)))) {
1044
80.2k
    return 1;
1045
80.2k
  }
1046
1047
262k
  if (ZEND_TYPE_IS_COMPLEX(info->type) && Z_TYPE_P(property) == IS_OBJECT
1048
262k
      && zend_check_and_resolve_property_or_class_constant_class_type(info->ce, info->type, Z_OBJCE_P(property))) {
1049
261k
    return 1;
1050
261k
  }
1051
1052
1.15k
  uint32_t type_mask = ZEND_TYPE_FULL_MASK(info->type);
1053
1.15k
  ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC|MAY_BE_NEVER|MAY_BE_VOID)));
1054
1.15k
  return zend_verify_scalar_type_hint(type_mask, property, strict, 0);
1055
1.15k
}
1056
1057
static zend_always_inline bool i_zend_verify_property_type(const zend_property_info *info, zval *property, bool strict)
1058
160k
{
1059
160k
  if (i_zend_check_property_type(info, property, strict)) {
1060
160k
    return 1;
1061
160k
  }
1062
1063
489
  zend_verify_property_type_error(info, property);
1064
489
  return 0;
1065
160k
}
1066
1067
159k
ZEND_API bool zend_never_inline zend_verify_property_type(const zend_property_info *info, zval *property, bool strict) {
1068
159k
  return i_zend_verify_property_type(info, property, strict);
1069
159k
}
1070
1071
static zend_never_inline zval* zend_assign_to_typed_prop(const zend_property_info *info, zval *property_val, zval *value, zend_refcounted **garbage_ptr EXECUTE_DATA_DC)
1072
1.24k
{
1073
1.24k
  zval tmp;
1074
1075
1.24k
  if (UNEXPECTED(info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1076
115
    if ((info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(property_val) & IS_PROP_REINITABLE)) {
1077
32
      zend_readonly_property_modification_error(info);
1078
32
      return &EG(uninitialized_zval);
1079
32
    }
1080
83
    if (info->flags & ZEND_ACC_PPP_SET_MASK && !zend_asymmetric_property_has_set_access(info)) {
1081
12
      zend_asymmetric_visibility_property_modification_error(info, "modify");
1082
12
      return &EG(uninitialized_zval);
1083
12
    }
1084
83
  }
1085
1086
1.20k
  ZVAL_DEREF(value);
1087
1.20k
  ZVAL_COPY(&tmp, value);
1088
1089
1.20k
  if (UNEXPECTED(!i_zend_verify_property_type(info, &tmp, EX_USES_STRICT_TYPES()))) {
1090
73
    zval_ptr_dtor(&tmp);
1091
73
    return &EG(uninitialized_zval);
1092
73
  }
1093
1094
1.13k
  Z_PROP_FLAG_P(property_val) &= ~IS_PROP_REINITABLE;
1095
1096
1.13k
  return zend_assign_to_variable_ex(property_val, &tmp, IS_TMP_VAR, EX_USES_STRICT_TYPES(), garbage_ptr);
1097
1.20k
}
1098
1099
181
static zend_always_inline bool zend_value_instanceof_static(const zval *zv) {
1100
181
  if (Z_TYPE_P(zv) != IS_OBJECT) {
1101
0
    return 0;
1102
0
  }
1103
1104
181
  zend_class_entry *called_scope = zend_get_called_scope(EG(current_execute_data));
1105
181
  if (!called_scope) {
1106
5
    return 0;
1107
5
  }
1108
176
  return instanceof_function(Z_OBJCE_P(zv), called_scope);
1109
181
}
1110
1111
static zend_always_inline zend_class_entry *zend_fetch_ce_from_type(
1112
    const zend_type *type)
1113
48.2k
{
1114
48.2k
  zend_string *name = ZEND_TYPE_NAME(*type);
1115
48.2k
  zend_class_entry *ce;
1116
48.2k
  if (ZSTR_HAS_CE_CACHE(name)) {
1117
48.1k
    ce = ZSTR_GET_CE_CACHE(name);
1118
48.1k
    if (!ce) {
1119
3.42k
      ce = zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
1120
3.42k
      if (UNEXPECTED(!ce)) {
1121
        /* Cannot resolve */
1122
89
        return NULL;
1123
89
      }
1124
3.42k
    }
1125
48.1k
  } else {
1126
112
    ce = zend_fetch_class(name,
1127
112
      ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD | ZEND_FETCH_CLASS_SILENT);
1128
112
    if (UNEXPECTED(!ce)) {
1129
0
      return NULL;
1130
0
    }
1131
112
  }
1132
48.1k
  return ce;
1133
48.2k
}
1134
1135
static bool zend_check_intersection_type_from_list(
1136
  const zend_type_list *intersection_type_list,
1137
  zend_class_entry *arg_ce)
1138
522
{
1139
522
  zend_class_entry *ce;
1140
522
  const zend_type *list_type;
1141
1.40k
  ZEND_TYPE_LIST_FOREACH(intersection_type_list, list_type) {
1142
1.40k
    ce = zend_fetch_ce_from_type(list_type);
1143
    /* If type is not an instance of one of the types taking part in the
1144
     * intersection it cannot be a valid instance of the whole intersection type. */
1145
1.40k
    if (!ce || !instanceof_function(arg_ce, ce)) {
1146
233
      return false;
1147
233
    }
1148
1.40k
  } ZEND_TYPE_LIST_FOREACH_END();
1149
289
  return true;
1150
522
}
1151
1152
static zend_always_inline bool zend_check_type_slow(
1153
    const zend_type *type, zval *arg, const zend_reference *ref,
1154
    bool is_return_type, bool is_internal)
1155
68.0k
{
1156
68.0k
  if (ZEND_TYPE_IS_COMPLEX(*type) && EXPECTED(Z_TYPE_P(arg) == IS_OBJECT)) {
1157
47.6k
    zend_class_entry *ce;
1158
47.6k
    if (UNEXPECTED(ZEND_TYPE_HAS_LIST(*type))) {
1159
543
      if (ZEND_TYPE_IS_INTERSECTION(*type)) {
1160
69
        return zend_check_intersection_type_from_list(ZEND_TYPE_LIST(*type), Z_OBJCE_P(arg));
1161
474
      } else {
1162
474
        const zend_type *list_type;
1163
1.23k
        ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(*type), list_type) {
1164
1.23k
          if (ZEND_TYPE_IS_INTERSECTION(*list_type)) {
1165
453
            if (zend_check_intersection_type_from_list(ZEND_TYPE_LIST(*list_type), Z_OBJCE_P(arg))) {
1166
229
              return true;
1167
229
            }
1168
453
          } else {
1169
304
            ZEND_ASSERT(!ZEND_TYPE_HAS_LIST(*list_type));
1170
304
            ce = zend_fetch_ce_from_type(list_type);
1171
            /* Instance of a single type part of a union is sufficient to pass the type check */
1172
304
            if (ce && instanceof_function(Z_OBJCE_P(arg), ce)) {
1173
109
              return true;
1174
109
            }
1175
304
          }
1176
1.23k
        } ZEND_TYPE_LIST_FOREACH_END();
1177
474
      }
1178
47.0k
    } else {
1179
47.0k
      ce = zend_fetch_ce_from_type(type);
1180
      /* If we have a CE we check if it satisfies the type constraint,
1181
       * otherwise it will check if a standard type satisfies it. */
1182
47.0k
      if (ce && instanceof_function(Z_OBJCE_P(arg), ce)) {
1183
46.9k
        return true;
1184
46.9k
      }
1185
47.0k
    }
1186
47.6k
  }
1187
1188
20.7k
  const uint32_t type_mask = ZEND_TYPE_FULL_MASK(*type);
1189
20.7k
  if ((type_mask & MAY_BE_CALLABLE) &&
1190
20.7k
    zend_is_callable(arg, is_internal ? IS_CALLABLE_SUPPRESS_DEPRECATIONS : 0, NULL)) {
1191
8.43k
    return 1;
1192
8.43k
  }
1193
12.2k
  if ((type_mask & MAY_BE_STATIC) && zend_value_instanceof_static(arg)) {
1194
161
    return 1;
1195
161
  }
1196
12.1k
  if (ref && ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1197
    /* We cannot have conversions for typed refs. */
1198
0
    return 0;
1199
0
  }
1200
12.1k
  if (is_internal && is_return_type) {
1201
    /* For internal returns, the type has to match exactly, because we're not
1202
     * going to check it for non-debug builds, and there will be no chance to
1203
     * apply coercions. */
1204
0
    return 0;
1205
0
  }
1206
1207
12.1k
  return zend_verify_scalar_type_hint(type_mask, arg,
1208
12.1k
    is_return_type ? ZEND_RET_USES_STRICT_TYPES() : ZEND_ARG_USES_STRICT_TYPES(),
1209
12.1k
    is_internal);
1210
1211
  /* Special handling for IS_VOID is not necessary (for return types),
1212
   * because this case is already checked at compile-time. */
1213
12.1k
}
1214
1215
static zend_always_inline bool zend_check_type(
1216
    const zend_type *type, zval *arg, zend_class_entry *scope,
1217
    bool is_return_type, bool is_internal)
1218
2.96M
{
1219
2.96M
  const zend_reference *ref = NULL;
1220
2.96M
  ZEND_ASSERT(ZEND_TYPE_IS_SET(*type));
1221
1222
2.96M
  if (UNEXPECTED(Z_ISREF_P(arg))) {
1223
4.33k
    ref = Z_REF_P(arg);
1224
4.33k
    arg = Z_REFVAL_P(arg);
1225
4.33k
  }
1226
1227
2.96M
  if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(*type, Z_TYPE_P(arg)))) {
1228
2.89M
    return 1;
1229
2.89M
  }
1230
1231
67.3k
  return zend_check_type_slow(type, arg, ref, is_return_type, is_internal);
1232
2.96M
}
1233
1234
ZEND_API bool zend_check_user_type_slow(
1235
    const zend_type *type, zval *arg, const zend_reference *ref, bool is_return_type)
1236
0
{
1237
0
  return zend_check_type_slow(
1238
0
    type, arg, ref, is_return_type, /* is_internal */ false);
1239
0
}
1240
1241
static zend_always_inline bool zend_verify_recv_arg_type(const zend_function *zf, uint32_t arg_num, zval *arg)
1242
4.91k
{
1243
4.91k
  const zend_arg_info *cur_arg_info;
1244
1245
4.91k
  ZEND_ASSERT(arg_num <= zf->common.num_args);
1246
4.91k
  cur_arg_info = &zf->common.arg_info[arg_num-1];
1247
1248
4.91k
  if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1249
4.91k
      && UNEXPECTED(!zend_check_type(&cur_arg_info->type, arg, zf->common.scope, 0, 0))) {
1250
632
    zend_verify_arg_error(zf, cur_arg_info, arg_num, arg);
1251
632
    return 0;
1252
632
  }
1253
1254
4.28k
  return 1;
1255
4.91k
}
1256
1257
static zend_always_inline bool zend_verify_variadic_arg_type(
1258
    const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, zval *arg)
1259
189
{
1260
189
  ZEND_ASSERT(ZEND_TYPE_IS_SET(arg_info->type));
1261
189
  if (UNEXPECTED(!zend_check_type(&arg_info->type, arg, zf->common.scope, 0, 0))) {
1262
29
    zend_verify_arg_error(zf, arg_info, arg_num, arg);
1263
29
    return 0;
1264
29
  }
1265
1266
160
  return 1;
1267
189
}
1268
1269
static zend_never_inline ZEND_ATTRIBUTE_UNUSED bool zend_verify_internal_arg_types(const zend_function *fbc, zend_execute_data *call)
1270
1.81M
{
1271
1.81M
  uint32_t i;
1272
1.81M
  uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
1273
1.81M
  zval *arg = ZEND_CALL_ARG(call, 1);
1274
1275
4.36M
  for (i = 0; i < num_args; ++i) {
1276
2.54M
    zend_arg_info *cur_arg_info;
1277
2.54M
    if (EXPECTED(i < fbc->common.num_args)) {
1278
2.53M
      cur_arg_info = &fbc->common.arg_info[i];
1279
2.53M
    } else if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1280
11.7k
      cur_arg_info = &fbc->common.arg_info[fbc->common.num_args];
1281
11.7k
    } else {
1282
0
      break;
1283
0
    }
1284
1285
2.54M
    if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1286
2.54M
        && UNEXPECTED(!zend_check_type(&cur_arg_info->type, arg, fbc->common.scope, 0, /* is_internal */ 1))) {
1287
482
      return 0;
1288
482
    }
1289
2.54M
    arg++;
1290
2.54M
  }
1291
1.81M
  return 1;
1292
1.81M
}
1293
1294
#if ZEND_DEBUG
1295
/* Determine whether an internal call should throw, because the passed arguments violate
1296
 * an arginfo constraint. This is only checked in debug builds. In release builds, we
1297
 * trust that arginfo matches what is enforced by zend_parse_parameters. */
1298
ZEND_API bool zend_internal_call_should_throw(const zend_function *fbc, zend_execute_data *call)
1299
2.01M
{
1300
2.01M
  if (fbc->internal_function.handler == ZEND_FN(pass) || (fbc->internal_function.fn_flags & ZEND_ACC_FAKE_CLOSURE)) {
1301
    /* Be lenient about the special pass function and about fake closures. */
1302
480
    return 0;
1303
480
  }
1304
1305
2.01M
  if (fbc->common.required_num_args > ZEND_CALL_NUM_ARGS(call)) {
1306
    /* Required argument not passed. */
1307
386
    return 1;
1308
386
  }
1309
1310
2.01M
  if (fbc->common.num_args < ZEND_CALL_NUM_ARGS(call)
1311
2.01M
      && !(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1312
    /* Too many arguments passed. For internal functions (unlike userland functions),
1313
     * this should always throw. */
1314
517
    return 1;
1315
517
  }
1316
1317
2.01M
  if ((fbc->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) &&
1318
2.01M
      !zend_verify_internal_arg_types(fbc, call)) {
1319
482
    return 1;
1320
482
  }
1321
1322
2.01M
  return 0;
1323
2.01M
}
1324
1325
ZEND_API ZEND_COLD void zend_internal_call_arginfo_violation(const zend_function *fbc)
1326
0
{
1327
0
  zend_error_noreturn(E_ERROR, "Arginfo / zpp mismatch during call of %s%s%s()",
1328
0
    fbc->common.scope ? ZSTR_VAL(fbc->common.scope->name) : "",
1329
0
    fbc->common.scope ? "::" : "",
1330
0
    ZSTR_VAL(fbc->common.function_name));
1331
0
}
1332
1333
#ifndef ZEND_VERIFY_FUNC_INFO
1334
# define ZEND_VERIFY_FUNC_INFO 0
1335
#endif
1336
1337
622k
static void zend_verify_internal_func_info(const zend_function *fn, const zval *retval) {
1338
#if ZEND_VERIFY_FUNC_INFO
1339
  zend_string *name = fn->common.function_name;
1340
  const uint32_t type_mask = zend_get_internal_func_info(fn, NULL, NULL);
1341
  if (!type_mask) {
1342
    return;
1343
  }
1344
1345
  /* Always check refcount of arrays, as immutable arrays are RCN. */
1346
  if (Z_REFCOUNTED_P(retval) || Z_TYPE_P(retval) == IS_ARRAY) {
1347
    if (!(type_mask & MAY_BE_RC1)) {
1348
      zend_error_noreturn(E_CORE_ERROR, "%s() missing rc1", ZSTR_VAL(name));
1349
    }
1350
    if (Z_REFCOUNT_P(retval) > 1 && !(type_mask & MAY_BE_RCN)) {
1351
      zend_error_noreturn(E_CORE_ERROR, "%s() missing rcn", ZSTR_VAL(name));
1352
    }
1353
  }
1354
1355
  const uint32_t type = 1u << Z_TYPE_P(retval);
1356
  if (!(type_mask & type)) {
1357
    zend_error_noreturn(E_CORE_ERROR, "%s() missing type %s",
1358
      ZSTR_VAL(name), zend_get_type_by_const(Z_TYPE_P(retval)));
1359
  }
1360
1361
  if (Z_TYPE_P(retval) == IS_ARRAY) {
1362
    const HashTable *ht = Z_ARRVAL_P(retval);
1363
    uint32_t num_checked = 0;
1364
    zend_string *str;
1365
    zval *val;
1366
    ZEND_HASH_FOREACH_STR_KEY_VAL(ht, str, val) {
1367
      if (str) {
1368
        if (!(type_mask & MAY_BE_ARRAY_KEY_STRING)) {
1369
          zend_error_noreturn(E_CORE_ERROR,
1370
            "%s() missing array_key_string", ZSTR_VAL(name));
1371
        }
1372
      } else {
1373
        if (!(type_mask & MAY_BE_ARRAY_KEY_LONG)) {
1374
          zend_error_noreturn(E_CORE_ERROR,
1375
            "%s() missing array_key_long", ZSTR_VAL(name));
1376
        }
1377
      }
1378
1379
      const uint32_t array_type = 1u << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
1380
      if (!(type_mask & array_type)) {
1381
        zend_error_noreturn(E_CORE_ERROR,
1382
          "%s() missing array element type %s",
1383
          ZSTR_VAL(name), zend_get_type_by_const(Z_TYPE_P(retval)));
1384
      }
1385
1386
      /* Don't check all elements of large arrays. */
1387
      if (++num_checked > 16) {
1388
        break;
1389
      }
1390
    } ZEND_HASH_FOREACH_END();
1391
  }
1392
#endif
1393
622k
}
1394
#endif
1395
1396
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(const zend_execute_data *execute_data)
1397
330
{
1398
330
  const zend_execute_data *ptr = EX(prev_execute_data);
1399
1400
330
  if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
1401
330
    zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
1402
330
      EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1403
330
      EX(func)->common.scope ? "::" : "",
1404
330
      ZSTR_VAL(EX(func)->common.function_name),
1405
330
      EX_NUM_ARGS(),
1406
330
      ZSTR_VAL(ptr->func->op_array.filename),
1407
330
      ptr->opline->lineno,
1408
330
      EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1409
330
      EX(func)->common.required_num_args);
1410
330
  } else {
1411
0
    zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
1412
0
      EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1413
0
      EX(func)->common.scope ? "::" : "",
1414
0
      ZSTR_VAL(EX(func)->common.function_name),
1415
0
      EX_NUM_ARGS(),
1416
0
      EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1417
0
      EX(func)->common.required_num_args);
1418
0
  }
1419
330
}
1420
1421
ZEND_API ZEND_COLD void zend_verify_return_error(const zend_function *zf, const zval *value)
1422
331
{
1423
331
  const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1424
331
  const char *fname, *fsep, *fclass;
1425
331
  zend_string *need_msg;
1426
331
  const char *given_msg;
1427
1428
331
  zend_verify_type_error_common(
1429
331
    zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1430
1431
331
  zend_type_error("%s%s%s(): Return value must be of type %s, %s returned",
1432
331
    fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1433
1434
331
  zend_string_release(need_msg);
1435
331
}
1436
1437
ZEND_API ZEND_COLD void zend_verify_never_error(const zend_function *zf)
1438
19
{
1439
19
  zend_string *func_name = get_function_or_method_name(zf);
1440
1441
19
  zend_type_error("%s(): never-returning %s must not implicitly return",
1442
19
    ZSTR_VAL(func_name), zf->common.scope ? "method" : "function");
1443
1444
19
  zend_string_release(func_name);
1445
19
}
1446
1447
#if ZEND_DEBUG
1448
static ZEND_COLD void zend_verify_internal_return_error(const zend_function *zf, const zval *value)
1449
0
{
1450
0
  const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1451
0
  const char *fname, *fsep, *fclass;
1452
0
  zend_string *need_msg;
1453
0
  const char *given_msg;
1454
1455
0
  zend_verify_type_error_common(
1456
0
    zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1457
1458
0
  zend_error_noreturn(E_CORE_ERROR, "%s%s%s(): Return value must be of type %s, %s returned",
1459
0
    fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1460
0
}
1461
1462
static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, const char *returned_msg, const char *returned_kind)
1463
0
{
1464
0
  const char *fname = ZSTR_VAL(zf->common.function_name);
1465
0
  const char *fsep;
1466
0
  const char *fclass;
1467
1468
0
  if (zf->common.scope) {
1469
0
    fsep =  "::";
1470
0
    fclass = ZSTR_VAL(zf->common.scope->name);
1471
0
  } else {
1472
0
    fsep =  "";
1473
0
    fclass = "";
1474
0
  }
1475
1476
0
  zend_type_error("%s%s%s() must not return a value, %s%s returned",
1477
0
    fclass, fsep, fname, returned_msg, returned_kind);
1478
0
}
1479
1480
ZEND_API bool zend_verify_internal_return_type(const zend_function *zf, zval *ret)
1481
1.18M
{
1482
1.18M
  const zend_internal_arg_info *ret_info = zf->internal_function.arg_info - 1;
1483
1484
1.18M
  if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_VOID) {
1485
768k
    if (UNEXPECTED(Z_TYPE_P(ret) != IS_NULL)) {
1486
0
      zend_verify_void_return_error(zf, zend_zval_value_name(ret), "");
1487
0
      return 0;
1488
0
    }
1489
768k
    return 1;
1490
768k
  }
1491
1492
416k
  if (UNEXPECTED(!zend_check_type(&ret_info->type, ret, NULL, 1, /* is_internal */ 1))) {
1493
0
    zend_verify_internal_return_error(zf, ret);
1494
0
    return 0;
1495
0
  }
1496
1497
416k
  return 1;
1498
416k
}
1499
#endif
1500
1501
static ZEND_COLD void zend_verify_missing_return_type(const zend_function *zf)
1502
84
{
1503
  /* VERIFY_RETURN_TYPE is not emitted for "void" functions, so this is always an error. */
1504
84
  zend_verify_return_error(zf, NULL);
1505
84
}
1506
1507
static zend_always_inline bool zend_check_class_constant_type(const zend_class_constant *c, zval *constant)
1508
246
{
1509
246
  ZEND_ASSERT(!Z_ISREF_P(constant));
1510
246
  if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(c->type, Z_TYPE_P(constant)))) {
1511
14
    return 1;
1512
14
  }
1513
1514
232
  if (((ZEND_TYPE_PURE_MASK(c->type) & MAY_BE_STATIC) || ZEND_TYPE_IS_COMPLEX(c->type)) && Z_TYPE_P(constant) == IS_OBJECT
1515
232
    && zend_check_and_resolve_property_or_class_constant_class_type(c->ce, c->type, Z_OBJCE_P(constant))) {
1516
174
    return 1;
1517
174
  }
1518
1519
58
  uint32_t type_mask = ZEND_TYPE_FULL_MASK(c->type);
1520
58
  ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_NEVER|MAY_BE_VOID)));
1521
58
  return zend_verify_scalar_type_hint(type_mask, constant, true, false);
1522
58
}
1523
1524
ZEND_API bool zend_never_inline zend_verify_class_constant_type(const zend_class_constant *c, const zend_string *name, zval *constant)
1525
246
{
1526
246
  if (!zend_check_class_constant_type(c, constant)) {
1527
58
    zend_verify_class_constant_type_error(c, name, constant);
1528
58
    return 0;
1529
58
  }
1530
1531
188
  return 1;
1532
246
}
1533
1534
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_object_as_array(const zend_object *object)
1535
7
{
1536
7
  zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(object->ce->name));
1537
7
}
1538
1539
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_access(const zval *offset)
1540
133
{
1541
133
  zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_RW);
1542
133
}
1543
1544
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_isset(const zval *offset)
1545
42
{
1546
42
  zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_IS);
1547
42
}
1548
1549
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_array_offset_unset(const zval *offset)
1550
5
{
1551
5
  zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), offset, BP_VAR_UNSET);
1552
5
}
1553
1554
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_string_offset(const zval *offset, int type)
1555
253
{
1556
253
  zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_STRING), offset, type);
1557
253
}
1558
1559
static zend_never_inline void zend_assign_to_object_dim(zend_object *obj, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1560
1.63k
{
1561
1.63k
  obj->handlers->write_dimension(obj, dim, value);
1562
1563
1.63k
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1564
64
    ZVAL_COPY(EX_VAR(opline->result.var), value);
1565
64
  }
1566
1.63k
}
1567
1568
static void frameless_observed_call_copy(zend_execute_data *call, uint32_t arg, zval *zv)
1569
0
{
1570
0
  if (Z_ISUNDEF_P(zv)) {
1571
0
    ZVAL_NULL(ZEND_CALL_VAR_NUM(call, arg));
1572
0
  } else {
1573
0
    ZVAL_COPY_DEREF(ZEND_CALL_VAR_NUM(call, arg), zv);
1574
0
  }
1575
0
}
1576
1577
ZEND_API void zend_frameless_observed_call(zend_execute_data *execute_data)
1578
0
{
1579
0
  const zend_op *opline = EX(opline);
1580
0
  uint8_t num_args = ZEND_FLF_NUM_ARGS(opline->opcode);
1581
0
  zend_function *fbc = ZEND_FLF_FUNC(opline);
1582
0
  zval *result = EX_VAR(opline->result.var);
1583
1584
0
  zend_execute_data *call = zend_vm_stack_push_call_frame_ex(zend_vm_calc_used_stack(num_args, fbc), ZEND_CALL_NESTED_FUNCTION, fbc, num_args, NULL);
1585
0
  call->prev_execute_data = execute_data;
1586
1587
0
  switch (num_args) {
1588
0
    case 3: frameless_observed_call_copy(call, 2, zend_get_zval_ptr(opline+1, (opline+1)->op1_type, &(opline+1)->op1, execute_data)); ZEND_FALLTHROUGH;
1589
0
    case 2: frameless_observed_call_copy(call, 1, zend_get_zval_ptr(opline, opline->op2_type, &opline->op2, execute_data)); ZEND_FALLTHROUGH;
1590
0
    case 1: frameless_observed_call_copy(call, 0, zend_get_zval_ptr(opline, opline->op1_type, &opline->op1, execute_data));
1591
0
  }
1592
1593
0
  EG(current_execute_data) = call;
1594
1595
0
  zend_observer_fcall_begin_prechecked(call, ZEND_OBSERVER_DATA(fbc));
1596
0
  fbc->internal_function.handler(call, result);
1597
0
  zend_observer_fcall_end(call, result);
1598
1599
0
  EG(current_execute_data) = execute_data;
1600
1601
0
  if (UNEXPECTED(EG(exception) != NULL)) {
1602
0
    zend_rethrow_exception(execute_data);
1603
0
  }
1604
1605
0
  zend_vm_stack_free_args(call);
1606
1607
0
  uint32_t call_info = ZEND_CALL_INFO(call);
1608
0
  if (UNEXPECTED(call_info & ZEND_CALL_ALLOCATED)) {
1609
0
    zend_vm_stack_free_call_frame_ex(call_info, call);
1610
0
  } else {
1611
0
    EG(vm_stack_top) = (zval*)call;
1612
0
  }
1613
0
}
1614
1615
1616
static zend_always_inline int zend_binary_op(zval *ret, zval *op1, zval *op2 OPLINE_DC)
1617
2.27M
{
1618
2.27M
  static const binary_op_type zend_binary_ops[] = {
1619
2.27M
    add_function,
1620
2.27M
    sub_function,
1621
2.27M
    mul_function,
1622
2.27M
    div_function,
1623
2.27M
    mod_function,
1624
2.27M
    shift_left_function,
1625
2.27M
    shift_right_function,
1626
2.27M
    concat_function,
1627
2.27M
    bitwise_or_function,
1628
2.27M
    bitwise_and_function,
1629
2.27M
    bitwise_xor_function,
1630
2.27M
    pow_function
1631
2.27M
  };
1632
  /* size_t cast makes GCC to better optimize 64-bit PIC code */
1633
2.27M
  size_t opcode = (size_t)opline->extended_value;
1634
1635
2.27M
  return zend_binary_ops[opcode - ZEND_ADD](ret, op1, op2);
1636
2.27M
}
1637
1638
static zend_never_inline void zend_binary_assign_op_obj_dim(zend_object *obj, zval *property OPLINE_DC EXECUTE_DATA_DC)
1639
65
{
1640
65
  zval *value;
1641
65
  zval *z;
1642
65
  zval rv, res;
1643
1644
65
  GC_ADDREF(obj);
1645
65
  if (property && UNEXPECTED(Z_ISUNDEF_P(property))) {
1646
5
    property = ZVAL_UNDEFINED_OP2();
1647
5
  }
1648
65
  value = get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1);
1649
65
  if ((z = obj->handlers->read_dimension(obj, property, BP_VAR_R, &rv)) != NULL) {
1650
1651
58
    if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1652
53
      obj->handlers->write_dimension(obj, property, &res);
1653
53
    }
1654
58
    if (z == &rv) {
1655
45
      zval_ptr_dtor(&rv);
1656
45
    }
1657
58
    if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1658
5
      ZVAL_COPY(EX_VAR(opline->result.var), &res);
1659
5
    }
1660
58
    zval_ptr_dtor(&res);
1661
58
  } else {
1662
7
    zend_use_object_as_array(obj);
1663
7
    if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1664
2
      ZVAL_NULL(EX_VAR(opline->result.var));
1665
2
    }
1666
7
  }
1667
65
  FREE_OP((opline+1)->op1_type, (opline+1)->op1.var);
1668
65
  if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1669
5
    zend_objects_store_del(obj);
1670
5
  }
1671
65
}
1672
1673
static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *ref, zval *value OPLINE_DC EXECUTE_DATA_DC)
1674
213
{
1675
213
  zval z_copy;
1676
1677
  /* Make sure that in-place concatenation is used if the LHS is a string. */
1678
213
  if (opline->extended_value == ZEND_CONCAT && Z_TYPE(ref->val) == IS_STRING) {
1679
32
    concat_function(&ref->val, &ref->val, value);
1680
32
    ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
1681
32
    return;
1682
32
  }
1683
1684
181
  zend_binary_op(&z_copy, &ref->val, value OPLINE_CC);
1685
181
  if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, EX_USES_STRICT_TYPES()))) {
1686
140
    zval_ptr_dtor(&ref->val);
1687
140
    ZVAL_COPY_VALUE(&ref->val, &z_copy);
1688
140
  } else {
1689
41
    zval_ptr_dtor(&z_copy);
1690
41
  }
1691
181
}
1692
1693
static zend_never_inline void zend_binary_assign_op_typed_prop(const zend_property_info *prop_info, zval *zptr, zval *value OPLINE_DC EXECUTE_DATA_DC)
1694
224
{
1695
224
  zval z_copy;
1696
1697
  /* Make sure that in-place concatenation is used if the LHS is a string. */
1698
224
  if (opline->extended_value == ZEND_CONCAT && Z_TYPE_P(zptr) == IS_STRING) {
1699
100
    concat_function(zptr, zptr, value);
1700
100
    ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
1701
100
    return;
1702
100
  }
1703
1704
124
  zend_binary_op(&z_copy, zptr, value OPLINE_CC);
1705
124
  if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
1706
85
    zval_ptr_dtor(zptr);
1707
85
    ZVAL_COPY_VALUE(zptr, &z_copy);
1708
85
  } else {
1709
39
    zval_ptr_dtor(&z_copy);
1710
39
  }
1711
124
}
1712
1713
static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type EXECUTE_DATA_DC)
1714
369
{
1715
369
  zend_long offset;
1716
1717
369
try_again:
1718
369
  switch(Z_TYPE_P(dim)) {
1719
133
    case IS_LONG:
1720
133
      return Z_LVAL_P(dim);
1721
104
    case IS_STRING:
1722
104
    {
1723
104
      bool trailing_data = false;
1724
      /* For BC reasons we allow errors so that we can warn on leading numeric string */
1725
104
      if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset, NULL,
1726
104
          /* allow errors */ true, NULL, &trailing_data)) {
1727
26
        if (UNEXPECTED(trailing_data) && type != BP_VAR_UNSET) {
1728
26
          zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
1729
26
        }
1730
26
        return offset;
1731
26
      }
1732
78
      zend_illegal_string_offset(dim, type);
1733
78
      return 0;
1734
104
    }
1735
25
    case IS_UNDEF:
1736
25
      ZVAL_UNDEFINED_OP2();
1737
25
      ZEND_FALLTHROUGH;
1738
54
    case IS_DOUBLE:
1739
127
    case IS_NULL:
1740
127
    case IS_FALSE:
1741
127
    case IS_TRUE:
1742
127
      zend_error(E_WARNING, "String offset cast occurred");
1743
127
      break;
1744
0
    case IS_REFERENCE:
1745
0
      dim = Z_REFVAL_P(dim);
1746
0
      goto try_again;
1747
5
    default:
1748
5
      zend_illegal_string_offset(dim, type);
1749
5
      return 0;
1750
369
  }
1751
1752
127
  return zval_get_long_func(dim, /* is_strict */ false);
1753
369
}
1754
1755
ZEND_API ZEND_COLD void zend_wrong_string_offset_error(void)
1756
162
{
1757
162
  const char *msg = NULL;
1758
162
  const zend_execute_data *execute_data = EG(current_execute_data);
1759
162
  const zend_op *opline = execute_data->opline;
1760
1761
162
  if (UNEXPECTED(EG(exception) != NULL)) {
1762
16
    return;
1763
16
  }
1764
1765
146
  switch (opline->opcode) {
1766
15
    case ZEND_ASSIGN_DIM_OP:
1767
15
      msg = "Cannot use assign-op operators with string offsets";
1768
15
      break;
1769
5
    case ZEND_FETCH_LIST_W:
1770
5
      msg = "Cannot create references to/from string offsets";
1771
5
      break;
1772
71
    case ZEND_FETCH_DIM_W:
1773
106
    case ZEND_FETCH_DIM_RW:
1774
111
    case ZEND_FETCH_DIM_FUNC_ARG:
1775
126
    case ZEND_FETCH_DIM_UNSET:
1776
126
      switch (opline->extended_value) {
1777
46
        case ZEND_FETCH_DIM_REF:
1778
46
          msg = "Cannot create references to/from string offsets";
1779
46
          break;
1780
30
        case ZEND_FETCH_DIM_DIM:
1781
30
          msg = "Cannot use string offset as an array";
1782
30
          break;
1783
45
        case ZEND_FETCH_DIM_OBJ:
1784
45
          msg = "Cannot use string offset as an object";
1785
45
          break;
1786
5
        case ZEND_FETCH_DIM_INCDEC:
1787
5
          msg = "Cannot increment/decrement string offsets";
1788
5
          break;
1789
0
        EMPTY_SWITCH_DEFAULT_CASE();
1790
126
      }
1791
126
      break;
1792
126
    EMPTY_SWITCH_DEFAULT_CASE();
1793
146
  }
1794
146
  ZEND_ASSERT(msg != NULL);
1795
146
  zend_throw_error(NULL, "%s", msg);
1796
146
}
1797
1798
ZEND_COLD static zend_result ZEND_FASTCALL get_deprecation_suffix_from_attribute(HashTable *attributes, zend_class_entry* scope, zend_string **message_suffix)
1799
547
{
1800
547
  *message_suffix = ZSTR_EMPTY_ALLOC();
1801
1802
547
  if (!attributes) {
1803
45
    return SUCCESS;
1804
45
  }
1805
1806
502
  zend_attribute *deprecated = zend_get_attribute_str(attributes, "deprecated", sizeof("deprecated")-1);
1807
1808
502
  if (!deprecated) {
1809
0
    return SUCCESS;
1810
0
  }
1811
1812
502
  if (deprecated->argc == 0) {
1813
167
    return SUCCESS;
1814
167
  }
1815
1816
335
  zend_result result = FAILURE;
1817
1818
335
  zend_string *message = ZSTR_EMPTY_ALLOC();
1819
335
  zend_string *since = ZSTR_EMPTY_ALLOC();
1820
1821
335
  zval obj;
1822
335
  ZVAL_UNDEF(&obj);
1823
335
  zval *z;
1824
1825
  /* Construct the Deprecated object to correctly handle parameter processing. */
1826
335
  if (FAILURE == zend_get_attribute_object(&obj, zend_ce_deprecated, deprecated, scope, NULL)) {
1827
33
    goto out;
1828
33
  }
1829
1830
  /* Extract the $message property. */
1831
302
  z = zend_read_property_ex(zend_ce_deprecated, Z_OBJ_P(&obj), ZSTR_KNOWN(ZEND_STR_MESSAGE), false, NULL);
1832
302
  ZEND_ASSERT(z != &EG(uninitialized_zval));
1833
302
  if (Z_TYPE_P(z) == IS_STRING) {
1834
247
    message = Z_STR_P(z);
1835
247
  }
1836
1837
  /* Extract the $since property. */
1838
302
  z = zend_read_property_ex(zend_ce_deprecated, Z_OBJ_P(&obj), ZSTR_KNOWN(ZEND_STR_SINCE), false, NULL);
1839
302
  ZEND_ASSERT(z != &EG(uninitialized_zval));
1840
302
  if (Z_TYPE_P(z) == IS_STRING) {
1841
114
    since = Z_STR_P(z);
1842
114
  }
1843
1844
  /* Construct the suffix. */
1845
302
  *message_suffix = zend_strpprintf_unchecked(
1846
302
    0,
1847
302
    "%s%S%s%S",
1848
302
    ZSTR_LEN(since) > 0 ? " since " : "",
1849
302
    since,
1850
302
    ZSTR_LEN(message) > 0 ? ", " : "",
1851
302
    message
1852
302
  );
1853
1854
302
  result = SUCCESS;
1855
1856
335
 out:
1857
1858
335
  zval_ptr_dtor(&obj);
1859
1860
335
  return result;
1861
302
}
1862
1863
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_deprecated_function(const zend_function *fbc)
1864
331
{
1865
331
  zend_string *message_suffix = ZSTR_EMPTY_ALLOC();
1866
1867
331
  if (get_deprecation_suffix_from_attribute(fbc->common.attributes, fbc->common.scope, &message_suffix) == FAILURE) {
1868
23
    return;
1869
23
  }
1870
1871
308
  int code = fbc->type == ZEND_INTERNAL_FUNCTION ? E_DEPRECATED : E_USER_DEPRECATED;
1872
1873
308
  if (fbc->common.scope) {
1874
103
    zend_error_unchecked(code, "Method %s::%s() is deprecated%S",
1875
103
      ZSTR_VAL(fbc->common.scope->name),
1876
103
      ZSTR_VAL(fbc->common.function_name),
1877
103
      message_suffix
1878
103
    );
1879
205
  } else {
1880
205
    zend_error_unchecked(code, "Function %s() is deprecated%S",
1881
205
      ZSTR_VAL(fbc->common.function_name),
1882
205
      message_suffix
1883
205
    );
1884
205
  }
1885
1886
308
  zend_string_release(message_suffix);
1887
308
}
1888
1889
ZEND_COLD static zend_result ZEND_FASTCALL get_nodiscard_suffix_from_attribute(HashTable *attributes, zend_class_entry* scope, zend_string **message_suffix)
1890
158
{
1891
158
  *message_suffix = ZSTR_EMPTY_ALLOC();
1892
1893
158
  if (!attributes) {
1894
0
    return SUCCESS;
1895
0
  }
1896
1897
158
  zend_attribute *nodiscard = zend_get_attribute_str(attributes, "nodiscard", sizeof("nodiscard")-1);
1898
1899
158
  if (!nodiscard) {
1900
0
    return SUCCESS;
1901
0
  }
1902
1903
158
  if (nodiscard->argc == 0) {
1904
135
    return SUCCESS;
1905
135
  }
1906
1907
23
  zend_result result = FAILURE;
1908
1909
23
  zend_string *message = ZSTR_EMPTY_ALLOC();
1910
1911
23
  zval obj;
1912
23
  ZVAL_UNDEF(&obj);
1913
23
  zval *z;
1914
1915
  /* Construct the NoDiscard object to correctly handle parameter processing. */
1916
23
  if (FAILURE == zend_get_attribute_object(&obj, zend_ce_nodiscard, nodiscard, scope, NULL)) {
1917
5
    goto out;
1918
5
  }
1919
1920
  /* Extract the $message property. */
1921
18
  z = zend_read_property_ex(zend_ce_nodiscard, Z_OBJ_P(&obj), ZSTR_KNOWN(ZEND_STR_MESSAGE), false, NULL);
1922
18
  ZEND_ASSERT(z != &EG(uninitialized_zval));
1923
18
  if (Z_TYPE_P(z) == IS_STRING) {
1924
18
    message = Z_STR_P(z);
1925
18
  }
1926
1927
  /* Construct the suffix. */
1928
18
  *message_suffix = zend_strpprintf_unchecked(
1929
18
    0,
1930
18
    "%s%S",
1931
18
    ZSTR_LEN(message) > 0 ? ", " : "",
1932
18
    message
1933
18
  );
1934
1935
18
  result = SUCCESS;
1936
1937
23
 out:
1938
1939
23
  zval_ptr_dtor(&obj);
1940
1941
23
  return result;
1942
18
}
1943
1944
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_nodiscard_function(const zend_function *fbc)
1945
158
{
1946
158
  zend_string *message_suffix = ZSTR_EMPTY_ALLOC();
1947
1948
158
  if (get_nodiscard_suffix_from_attribute(fbc->common.attributes, fbc->common.scope, &message_suffix) == FAILURE) {
1949
5
    return;
1950
5
  }
1951
1952
153
  int code = fbc->type == ZEND_INTERNAL_FUNCTION ? E_WARNING : E_USER_WARNING;
1953
1954
153
  if (fbc->common.scope) {
1955
40
    zend_error_unchecked(code, "The return value of method %s::%s() should either be used or intentionally ignored by casting it as (void)%S",
1956
40
      ZSTR_VAL(fbc->common.scope->name),
1957
40
      ZSTR_VAL(fbc->common.function_name),
1958
40
      message_suffix
1959
40
    );
1960
113
  } else {
1961
113
    zend_error_unchecked(code, "The return value of function %s() should either be used or intentionally ignored by casting it as (void)%S",
1962
113
      ZSTR_VAL(fbc->common.function_name),
1963
113
      message_suffix
1964
113
    );
1965
113
  }
1966
1967
153
  zend_string_release(message_suffix);
1968
153
}
1969
1970
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_deprecated_class_constant(const zend_class_constant *c, const zend_string *constant_name)
1971
89
{
1972
89
  zend_string *message_suffix = ZSTR_EMPTY_ALLOC();
1973
1974
89
  if (get_deprecation_suffix_from_attribute(c->attributes, c->ce, &message_suffix) == FAILURE) {
1975
5
    return;
1976
5
  }
1977
1978
84
  int code = c->ce->type == ZEND_INTERNAL_CLASS ? E_DEPRECATED : E_USER_DEPRECATED;
1979
84
  char *type = (ZEND_CLASS_CONST_FLAGS(c) & ZEND_CLASS_CONST_IS_CASE) ? "Enum case" : "Constant";
1980
1981
84
  zend_error_unchecked(code, "%s %s::%s is deprecated%S",
1982
84
    type,
1983
84
    ZSTR_VAL(c->ce->name),
1984
84
    ZSTR_VAL(constant_name),
1985
84
    message_suffix
1986
84
  );
1987
1988
84
  zend_string_release(message_suffix);
1989
84
}
1990
1991
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_deprecated_constant(const zend_constant *c, const zend_string *constant_name)
1992
127
{
1993
127
  zend_string *message_suffix = ZSTR_EMPTY_ALLOC();
1994
1995
127
  if (get_deprecation_suffix_from_attribute(c->attributes, NULL, &message_suffix) == FAILURE) {
1996
5
    return;
1997
5
  }
1998
1999
122
  int code = ZEND_CONSTANT_MODULE_NUMBER(c) == PHP_USER_CONSTANT ? E_USER_DEPRECATED : E_DEPRECATED;
2000
2001
122
  zend_error_unchecked(code, "Constant %s is deprecated%S",
2002
122
    ZSTR_VAL(constant_name),
2003
122
    message_suffix
2004
122
  );
2005
2006
122
  zend_string_release(message_suffix);
2007
122
}
2008
2009
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_false_to_array_deprecated(void)
2010
516
{
2011
516
  zend_error(E_DEPRECATED, "Automatic conversion of false to array is deprecated");
2012
516
}
2013
2014
static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
2015
485
{
2016
485
  zend_uchar c;
2017
485
  size_t string_len;
2018
485
  zend_long offset;
2019
485
  zend_string *s;
2020
2021
  /* separate string */
2022
485
  if (Z_REFCOUNTED_P(str) && Z_REFCOUNT_P(str) == 1) {
2023
249
    s = Z_STR_P(str);
2024
249
  } else {
2025
236
    s = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
2026
236
    ZSTR_H(s) = ZSTR_H(Z_STR_P(str));
2027
236
    if (Z_REFCOUNTED_P(str)) {
2028
36
      GC_DELREF(Z_STR_P(str));
2029
36
    }
2030
236
    ZVAL_NEW_STR(str, s);
2031
236
  }
2032
2033
485
  if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
2034
278
    offset = Z_LVAL_P(dim);
2035
278
  } else {
2036
    /* The string may be destroyed while throwing the notice.
2037
     * Temporarily increase the refcount to detect this situation. */
2038
207
    GC_ADDREF(s);
2039
207
    offset = zend_check_string_offset(dim, BP_VAR_W EXECUTE_DATA_CC);
2040
207
    if (UNEXPECTED(GC_DELREF(s) == 0)) {
2041
10
      zend_string_efree(s);
2042
10
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2043
0
        ZVAL_NULL(EX_VAR(opline->result.var));
2044
0
      }
2045
10
      return;
2046
10
    }
2047
    /* Illegal offset assignment */
2048
197
    if (UNEXPECTED(EG(exception) != NULL)) {
2049
78
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2050
13
        ZVAL_UNDEF(EX_VAR(opline->result.var));
2051
13
      }
2052
78
      return;
2053
78
    }
2054
197
  }
2055
2056
397
  if (UNEXPECTED(offset < -(zend_long)ZSTR_LEN(s))) {
2057
    /* Error on negative offset */
2058
73
    zend_error(E_WARNING, "Illegal string offset " ZEND_LONG_FMT, offset);
2059
73
    if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2060
62
      ZVAL_NULL(EX_VAR(opline->result.var));
2061
62
    }
2062
73
    return;
2063
73
  }
2064
2065
324
  if (offset < 0) { /* Handle negative offset */
2066
71
    offset += (zend_long)ZSTR_LEN(s);
2067
71
  }
2068
2069
324
  if (UNEXPECTED(Z_TYPE_P(value) != IS_STRING)) {
2070
85
    zend_string *tmp;
2071
2072
    /* The string may be destroyed while throwing the notice.
2073
     * Temporarily increase the refcount to detect this situation. */
2074
85
    GC_ADDREF(s);
2075
85
    if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
2076
0
      zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC);
2077
0
    }
2078
    /* Convert to string, just the time to pick the 1st byte */
2079
85
    tmp = zval_try_get_string_func(value);
2080
85
    if (UNEXPECTED(GC_DELREF(s) == 0)) {
2081
0
      zend_string_efree(s);
2082
0
      if (tmp) {
2083
0
        zend_string_release_ex(tmp, 0);
2084
0
      }
2085
0
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2086
0
        ZVAL_NULL(EX_VAR(opline->result.var));
2087
0
      }
2088
0
      return;
2089
0
    }
2090
85
    if (UNEXPECTED(!tmp)) {
2091
8
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2092
0
        ZVAL_UNDEF(EX_VAR(opline->result.var));
2093
0
      }
2094
8
      return;
2095
8
    }
2096
2097
77
    string_len = ZSTR_LEN(tmp);
2098
77
    c = (zend_uchar)ZSTR_VAL(tmp)[0];
2099
77
    zend_string_release_ex(tmp, 0);
2100
239
  } else {
2101
239
    string_len = Z_STRLEN_P(value);
2102
239
    c = (zend_uchar)Z_STRVAL_P(value)[0];
2103
239
  }
2104
2105
316
  if (UNEXPECTED(string_len != 1)) {
2106
87
    if (string_len == 0) {
2107
      /* Error on empty input string */
2108
33
      zend_throw_error(NULL, "Cannot assign an empty string to a string offset");
2109
33
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2110
31
        ZVAL_NULL(EX_VAR(opline->result.var));
2111
31
      }
2112
33
      return;
2113
33
    }
2114
2115
    /* The string may be destroyed while throwing the notice.
2116
     * Temporarily increase the refcount to detect this situation. */
2117
54
    GC_ADDREF(s);
2118
54
    zend_error(E_WARNING, "Only the first byte will be assigned to the string offset");
2119
54
    if (UNEXPECTED(GC_DELREF(s) == 0)) {
2120
0
      zend_string_efree(s);
2121
0
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2122
0
        ZVAL_NULL(EX_VAR(opline->result.var));
2123
0
      }
2124
0
      return;
2125
0
    }
2126
    /* Illegal offset assignment */
2127
54
    if (UNEXPECTED(EG(exception) != NULL)) {
2128
0
      if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2129
0
        ZVAL_UNDEF(EX_VAR(opline->result.var));
2130
0
      }
2131
0
      return;
2132
0
    }
2133
54
  }
2134
2135
283
  if ((size_t)offset >= ZSTR_LEN(s)) {
2136
    /* Extend string if needed */
2137
38
    zend_long old_len = ZSTR_LEN(s);
2138
38
    ZVAL_NEW_STR(str, zend_string_extend(s, (size_t)offset + 1, 0));
2139
38
    memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
2140
38
    Z_STRVAL_P(str)[offset+1] = 0;
2141
245
  } else {
2142
245
    zend_string_forget_hash_val(Z_STR_P(str));
2143
245
  }
2144
2145
283
  Z_STRVAL_P(str)[offset] = c;
2146
2147
283
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2148
    /* Return the new character */
2149
86
    ZVAL_CHAR(EX_VAR(opline->result.var), c);
2150
86
  }
2151
283
}
2152
2153
static zend_property_info *zend_get_prop_not_accepting_double(zend_reference *ref)
2154
281
{
2155
281
  zend_property_info *prop;
2156
843
  ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
2157
843
    if (!(ZEND_TYPE_FULL_MASK(prop->type) & MAY_BE_DOUBLE)) {
2158
222
      return prop;
2159
222
    }
2160
843
  } ZEND_REF_FOREACH_TYPE_SOURCES_END();
2161
59
  return NULL;
2162
281
}
2163
2164
static ZEND_COLD zend_long zend_throw_incdec_ref_error(
2165
    zend_reference *ref, zend_property_info *error_prop OPLINE_DC)
2166
222
{
2167
222
  zend_string *type_str = zend_type_to_string(error_prop->type);
2168
222
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2169
100
    zend_type_error(
2170
100
      "Cannot increment a reference held by property %s::$%s of type %s past its maximal value",
2171
100
      ZSTR_VAL(error_prop->ce->name),
2172
100
      zend_get_unmangled_property_name(error_prop->name),
2173
100
      ZSTR_VAL(type_str));
2174
100
    zend_string_release(type_str);
2175
100
    return ZEND_LONG_MAX;
2176
122
  } else {
2177
122
    zend_type_error(
2178
122
      "Cannot decrement a reference held by property %s::$%s of type %s past its minimal value",
2179
122
      ZSTR_VAL(error_prop->ce->name),
2180
122
      zend_get_unmangled_property_name(error_prop->name),
2181
122
      ZSTR_VAL(type_str));
2182
122
    zend_string_release(type_str);
2183
122
    return ZEND_LONG_MIN;
2184
122
  }
2185
222
}
2186
2187
124
static ZEND_COLD zend_long zend_throw_incdec_prop_error(zend_property_info *prop OPLINE_DC) {
2188
124
  zend_string *type_str = zend_type_to_string(prop->type);
2189
124
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2190
72
    zend_type_error("Cannot increment property %s::$%s of type %s past its maximal value",
2191
72
      ZSTR_VAL(prop->ce->name),
2192
72
      zend_get_unmangled_property_name(prop->name),
2193
72
      ZSTR_VAL(type_str));
2194
72
    zend_string_release(type_str);
2195
72
    return ZEND_LONG_MAX;
2196
72
  } else {
2197
52
    zend_type_error("Cannot decrement property %s::$%s of type %s past its minimal value",
2198
52
      ZSTR_VAL(prop->ce->name),
2199
52
      zend_get_unmangled_property_name(prop->name),
2200
52
      ZSTR_VAL(type_str));
2201
52
    zend_string_release(type_str);
2202
52
    return ZEND_LONG_MIN;
2203
52
  }
2204
124
}
2205
2206
static void zend_incdec_typed_ref(zend_reference *ref, zval *copy OPLINE_DC EXECUTE_DATA_DC)
2207
459
{
2208
459
  zval tmp;
2209
459
  zval *var_ptr = &ref->val;
2210
2211
459
  if (!copy) {
2212
363
    copy = &tmp;
2213
363
  }
2214
2215
459
  ZVAL_COPY(copy, var_ptr);
2216
2217
459
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2218
182
    increment_function(var_ptr);
2219
277
  } else {
2220
277
    decrement_function(var_ptr);
2221
277
  }
2222
2223
459
  if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
2224
281
    zend_property_info *error_prop = zend_get_prop_not_accepting_double(ref);
2225
281
    if (UNEXPECTED(error_prop)) {
2226
222
      zend_long val = zend_throw_incdec_ref_error(ref, error_prop OPLINE_CC);
2227
222
      ZVAL_LONG(var_ptr, val);
2228
222
    }
2229
281
  } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, EX_USES_STRICT_TYPES()))) {
2230
5
    zval_ptr_dtor(var_ptr);
2231
5
    ZVAL_COPY_VALUE(var_ptr, copy);
2232
5
    ZVAL_UNDEF(copy);
2233
173
  } else if (copy == &tmp) {
2234
138
    zval_ptr_dtor(&tmp);
2235
138
  }
2236
459
}
2237
2238
static void zend_incdec_typed_prop(zend_property_info *prop_info, zval *var_ptr, zval *copy OPLINE_DC EXECUTE_DATA_DC)
2239
80
{
2240
80
  zval tmp;
2241
2242
80
  if (!copy) {
2243
65
    copy = &tmp;
2244
65
  }
2245
2246
80
  ZVAL_COPY(copy, var_ptr);
2247
2248
80
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2249
51
    increment_function(var_ptr);
2250
51
  } else {
2251
29
    decrement_function(var_ptr);
2252
29
  }
2253
2254
80
  if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
2255
0
    if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2256
0
      zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
2257
0
      ZVAL_LONG(var_ptr, val);
2258
0
    }
2259
80
  } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
2260
12
    zval_ptr_dtor(var_ptr);
2261
12
    ZVAL_COPY_VALUE(var_ptr, copy);
2262
12
    ZVAL_UNDEF(copy);
2263
68
  } else if (copy == &tmp) {
2264
58
    zval_ptr_dtor(&tmp);
2265
58
  }
2266
80
}
2267
2268
static void zend_pre_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
2269
1.57k
{
2270
1.57k
  if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
2271
730
    if (ZEND_IS_INCREMENT(opline->opcode)) {
2272
610
      fast_long_increment_function(prop);
2273
610
    } else {
2274
120
      fast_long_decrement_function(prop);
2275
120
    }
2276
730
    if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
2277
730
        && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2278
112
      zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
2279
112
      ZVAL_LONG(prop, val);
2280
112
    }
2281
840
  } else {
2282
840
    do {
2283
840
      if (Z_ISREF_P(prop)) {
2284
163
        zend_reference *ref = Z_REF_P(prop);
2285
163
        prop = Z_REFVAL_P(prop);
2286
163
        if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
2287
116
          zend_incdec_typed_ref(ref, NULL OPLINE_CC EXECUTE_DATA_CC);
2288
116
          break;
2289
116
        }
2290
163
      }
2291
2292
724
      if (prop_info) {
2293
65
        zend_incdec_typed_prop(prop_info, prop, NULL OPLINE_CC EXECUTE_DATA_CC);
2294
659
      } else if (ZEND_IS_INCREMENT(opline->opcode)) {
2295
516
        increment_function(prop);
2296
516
      } else {
2297
143
        decrement_function(prop);
2298
143
      }
2299
724
    } while (0);
2300
840
  }
2301
1.57k
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2302
1.05k
    ZVAL_COPY(EX_VAR(opline->result.var), prop);
2303
1.05k
  }
2304
1.57k
}
2305
2306
static void zend_post_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
2307
1.21k
{
2308
1.21k
  if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
2309
947
    ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(prop));
2310
947
    if (ZEND_IS_INCREMENT(opline->opcode)) {
2311
329
      fast_long_increment_function(prop);
2312
618
    } else {
2313
618
      fast_long_decrement_function(prop);
2314
618
    }
2315
947
    if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
2316
947
        && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2317
12
      zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
2318
12
      ZVAL_LONG(prop, val);
2319
12
    }
2320
947
  } else {
2321
265
    if (Z_ISREF_P(prop)) {
2322
73
      zend_reference *ref = Z_REF_P(prop);
2323
73
      prop = Z_REFVAL_P(prop);
2324
73
      if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2325
54
        zend_incdec_typed_ref(ref, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
2326
54
        return;
2327
54
      }
2328
73
    }
2329
2330
211
    if (prop_info) {
2331
15
      zend_incdec_typed_prop(prop_info, prop, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
2332
196
    } else {
2333
196
      ZVAL_COPY(EX_VAR(opline->result.var), prop);
2334
196
      if (ZEND_IS_INCREMENT(opline->opcode)) {
2335
112
        increment_function(prop);
2336
112
      } else {
2337
84
        decrement_function(prop);
2338
84
      }
2339
196
    }
2340
211
  }
2341
1.21k
}
2342
2343
static zend_never_inline void zend_post_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
2344
25
{
2345
25
  zval rv;
2346
25
  zval *z;
2347
25
  zval z_copy;
2348
2349
25
  GC_ADDREF(object);
2350
25
  z =object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2351
25
  if (UNEXPECTED(EG(exception))) {
2352
3
    OBJ_RELEASE(object);
2353
3
    ZVAL_UNDEF(EX_VAR(opline->result.var));
2354
3
    return;
2355
3
  }
2356
2357
22
  ZVAL_COPY_DEREF(&z_copy, z);
2358
22
  ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
2359
22
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2360
17
    increment_function(&z_copy);
2361
17
  } else {
2362
5
    decrement_function(&z_copy);
2363
5
  }
2364
22
  object->handlers->write_property(object, name, &z_copy, cache_slot);
2365
22
  OBJ_RELEASE(object);
2366
22
  zval_ptr_dtor(&z_copy);
2367
22
  if (z == &rv) {
2368
12
    zval_ptr_dtor(z);
2369
12
  }
2370
22
}
2371
2372
static zend_never_inline void zend_pre_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
2373
228
{
2374
228
  zval rv;
2375
228
  zval *z;
2376
228
  zval z_copy;
2377
2378
228
  GC_ADDREF(object);
2379
228
  z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2380
228
  if (UNEXPECTED(EG(exception))) {
2381
5
    OBJ_RELEASE(object);
2382
5
    if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2383
0
      ZVAL_NULL(EX_VAR(opline->result.var));
2384
0
    }
2385
5
    return;
2386
5
  }
2387
2388
223
  ZVAL_COPY_DEREF(&z_copy, z);
2389
223
  if (ZEND_IS_INCREMENT(opline->opcode)) {
2390
168
    increment_function(&z_copy);
2391
168
  } else {
2392
55
    decrement_function(&z_copy);
2393
55
  }
2394
223
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2395
12
    ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
2396
12
  }
2397
223
  object->handlers->write_property(object, name, &z_copy, cache_slot);
2398
223
  OBJ_RELEASE(object);
2399
223
  zval_ptr_dtor(&z_copy);
2400
223
  if (z == &rv) {
2401
104
    zval_ptr_dtor(z);
2402
104
  }
2403
223
}
2404
2405
static zend_never_inline void zend_assign_op_overloaded_property(zend_object *object, zend_string *name, void **cache_slot, zval *value OPLINE_DC EXECUTE_DATA_DC)
2406
233
{
2407
233
  zval *z;
2408
233
  zval rv, res;
2409
2410
233
  GC_ADDREF(object);
2411
233
  z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2412
233
  if (UNEXPECTED(EG(exception))) {
2413
8
    OBJ_RELEASE(object);
2414
8
    if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2415
0
      ZVAL_UNDEF(EX_VAR(opline->result.var));
2416
0
    }
2417
8
    return;
2418
8
  }
2419
225
  if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
2420
207
    object->handlers->write_property(object, name, &res, cache_slot);
2421
207
  }
2422
225
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2423
30
    ZVAL_COPY(EX_VAR(opline->result.var), &res);
2424
30
  }
2425
225
  if (z == &rv) {
2426
147
    zval_ptr_dtor(z);
2427
147
  }
2428
225
  zval_ptr_dtor(&res);
2429
225
  OBJ_RELEASE(object);
2430
225
}
2431
2432
/* Utility Functions for Extensions */
2433
static void zend_extension_statement_handler(const zend_extension *extension, zend_execute_data *frame)
2434
0
{
2435
0
  if (extension->statement_handler) {
2436
0
    extension->statement_handler(frame);
2437
0
  }
2438
0
}
2439
2440
2441
static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_execute_data *frame)
2442
0
{
2443
0
  if (extension->fcall_begin_handler) {
2444
0
    extension->fcall_begin_handler(frame);
2445
0
  }
2446
0
}
2447
2448
2449
static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_execute_data *frame)
2450
0
{
2451
0
  if (extension->fcall_end_handler) {
2452
0
    extension->fcall_end_handler(frame);
2453
0
  }
2454
0
}
2455
2456
2457
static zend_always_inline HashTable *zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)
2458
56.4k
{
2459
56.4k
  HashTable *ht;
2460
2461
56.4k
  if (EXPECTED(fetch_type & (ZEND_FETCH_GLOBAL_LOCK | ZEND_FETCH_GLOBAL))) {
2462
5.59k
    ht = &EG(symbol_table);
2463
50.8k
  } else {
2464
50.8k
    ZEND_ASSERT(fetch_type & ZEND_FETCH_LOCAL);
2465
50.8k
    if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
2466
7.46k
      zend_rebuild_symbol_table();
2467
7.46k
    }
2468
50.8k
    ht = EX(symbol_table);
2469
50.8k
  }
2470
56.4k
  return ht;
2471
56.4k
}
2472
2473
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_offset(zend_long lval)
2474
1.83k
{
2475
1.83k
  zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, lval);
2476
1.83k
}
2477
2478
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_index(const zend_string *offset)
2479
2.81k
{
2480
2.81k
  zend_error(E_WARNING, "Undefined array key \"%s\"", ZSTR_VAL(offset));
2481
2.81k
}
2482
2483
ZEND_API ZEND_COLD zval* ZEND_FASTCALL zend_undefined_offset_write(HashTable *ht, zend_long lval)
2484
370
{
2485
  /* The array may be destroyed while throwing the notice.
2486
   * Temporarily increase the refcount to detect this situation. */
2487
370
  if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2488
370
    GC_ADDREF(ht);
2489
370
  }
2490
370
  zend_undefined_offset(lval);
2491
370
  if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2492
41
    if (!GC_REFCOUNT(ht)) {
2493
38
      zend_array_destroy(ht);
2494
38
    }
2495
41
    return NULL;
2496
41
  }
2497
329
  if (EG(exception)) {
2498
9
    return NULL;
2499
9
  }
2500
320
  return zend_hash_index_add_new(ht, lval, &EG(uninitialized_zval));
2501
329
}
2502
2503
ZEND_API ZEND_COLD zval* ZEND_FASTCALL zend_undefined_index_write(HashTable *ht, zend_string *offset)
2504
1.86k
{
2505
1.86k
  zval *retval;
2506
2507
  /* The array may be destroyed while throwing the notice.
2508
   * Temporarily increase the refcount to detect this situation. */
2509
1.86k
  if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2510
1.86k
    GC_ADDREF(ht);
2511
1.86k
  }
2512
  /* Key may be released while throwing the undefined index warning. */
2513
1.86k
  zend_string_addref(offset);
2514
1.86k
  zend_undefined_index(offset);
2515
1.86k
  if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2516
30
    if (!GC_REFCOUNT(ht)) {
2517
30
      zend_array_destroy(ht);
2518
30
    }
2519
30
    retval = NULL;
2520
1.83k
  } else if (EG(exception)) {
2521
9
    retval = NULL;
2522
1.82k
  } else {
2523
1.82k
    retval = zend_hash_add_new(ht, offset, &EG(uninitialized_zval));
2524
1.82k
  }
2525
1.86k
  zend_string_release(offset);
2526
1.86k
  return retval;
2527
1.86k
}
2528
2529
ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
2530
458
{
2531
458
  zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
2532
458
}
2533
2534
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_invalid_method_call(zval *object, zval *function_name)
2535
657
{
2536
657
  zend_throw_error(NULL, "Call to a member function %s() on %s",
2537
657
    Z_STRVAL_P(function_name), zend_zval_value_name(object));
2538
657
}
2539
2540
ZEND_API void ZEND_FASTCALL zend_non_static_method_call(const zend_function *fbc)
2541
53
{
2542
53
  zend_throw_error(
2543
53
    zend_ce_error,
2544
53
    "Non-static method %s::%s() cannot be called statically",
2545
53
    ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2546
53
}
2547
2548
ZEND_COLD void ZEND_FASTCALL zend_param_must_be_ref(const zend_function *func, uint32_t arg_num)
2549
234
{
2550
234
  const char *arg_name = get_function_arg_name(func, arg_num);
2551
2552
234
  zend_error(E_WARNING, "%s%s%s(): Argument #%d%s%s%s must be passed by reference, value given",
2553
234
    func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
2554
234
    func->common.scope ? "::" : "",
2555
234
    ZSTR_VAL(func->common.function_name),
2556
234
    arg_num,
2557
234
    arg_name ? " ($" : "",
2558
234
    arg_name ? arg_name : "",
2559
234
    arg_name ? ")" : ""
2560
234
  );
2561
234
}
2562
2563
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(void)
2564
193
{
2565
193
  zend_throw_error(NULL, "Cannot use a scalar value as an array");
2566
193
}
2567
2568
ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
2569
142
{
2570
142
  zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
2571
142
}
2572
2573
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_use_resource_as_offset(const zval *dim)
2574
0
{
2575
0
  zend_error(E_WARNING,
2576
0
    "Resource ID#" ZEND_LONG_FMT " used as offset, casting to integer (" ZEND_LONG_FMT ")",
2577
0
    Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
2578
0
}
2579
2580
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_string(void)
2581
33
{
2582
33
  zend_throw_error(NULL, "[] operator not supported for strings");
2583
33
}
2584
2585
#ifdef ZEND_CHECK_STACK_LIMIT
2586
ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_call_stack_size_error(void)
2587
2
{
2588
2
  size_t max_stack_size = 0;
2589
2
  if ((uintptr_t) EG(stack_base) > (uintptr_t) EG(stack_limit)) {
2590
2
    max_stack_size = (size_t) ((uintptr_t) EG(stack_base) - (uintptr_t) EG(stack_limit));
2591
2
  }
2592
2593
2
  zend_throw_error(NULL, "Maximum call stack size of %zu bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?",
2594
2
    max_stack_size);
2595
2
}
2596
#endif /* ZEND_CHECK_STACK_LIMIT */
2597
2598
static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2599
30
{
2600
30
  if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2601
20
    if (opline->op2_type == IS_UNUSED) {
2602
5
      zend_use_new_element_for_string();
2603
15
    } else {
2604
15
      zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
2605
15
      zend_wrong_string_offset_error();
2606
15
    }
2607
20
  } else {
2608
10
    zend_use_scalar_as_array();
2609
10
  }
2610
30
}
2611
2612
static zend_never_inline uint8_t slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2613
741
{
2614
741
  switch (Z_TYPE_P(dim)) {
2615
371
    case IS_UNDEF: {
2616
      /* The array may be destroyed while throwing the notice.
2617
       * Temporarily increase the refcount to detect this situation. */
2618
371
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2619
114
        GC_ADDREF(ht);
2620
114
      }
2621
371
      ZVAL_UNDEFINED_OP2();
2622
371
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2623
5
        zend_array_destroy(ht);
2624
5
        return IS_NULL;
2625
5
      }
2626
366
      if (EG(exception)) {
2627
0
        return IS_NULL;
2628
0
      }
2629
366
      ZEND_FALLTHROUGH;
2630
366
    }
2631
490
    case IS_NULL:
2632
490
      value->str = ZSTR_EMPTY_ALLOC();
2633
490
      return IS_STRING;
2634
169
    case IS_DOUBLE:
2635
169
      value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2636
169
      if (!zend_is_long_compatible(Z_DVAL_P(dim), value->lval)) {
2637
        /* The array may be destroyed while throwing the notice.
2638
         * Temporarily increase the refcount to detect this situation. */
2639
146
        if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2640
103
          GC_ADDREF(ht);
2641
103
        }
2642
146
        zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
2643
146
        if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2644
7
          zend_array_destroy(ht);
2645
7
          return IS_NULL;
2646
7
        }
2647
139
        if (EG(exception)) {
2648
0
          return IS_NULL;
2649
0
        }
2650
139
      }
2651
162
      return IS_LONG;
2652
0
    case IS_RESOURCE:
2653
      /* The array may be destroyed while throwing the notice.
2654
       * Temporarily increase the refcount to detect this situation. */
2655
0
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2656
0
        GC_ADDREF(ht);
2657
0
      }
2658
0
      zend_use_resource_as_offset(dim);
2659
0
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2660
0
        zend_array_destroy(ht);
2661
0
        return IS_NULL;
2662
0
      }
2663
0
      if (EG(exception)) {
2664
0
        return IS_NULL;
2665
0
      }
2666
0
      value->lval = Z_RES_HANDLE_P(dim);
2667
0
      return IS_LONG;
2668
20
    case IS_FALSE:
2669
20
      value->lval = 0;
2670
20
      return IS_LONG;
2671
33
    case IS_TRUE:
2672
33
      value->lval = 1;
2673
33
      return IS_LONG;
2674
24
    default:
2675
24
      zend_illegal_array_offset_access(dim);
2676
24
      return IS_NULL;
2677
741
  }
2678
741
}
2679
2680
static zend_never_inline uint8_t slow_index_convert_w(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2681
8.76k
{
2682
8.76k
  switch (Z_TYPE_P(dim)) {
2683
7.31k
    case IS_UNDEF: {
2684
      /* The array may be destroyed while throwing the notice.
2685
       * Temporarily increase the refcount to detect this situation. */
2686
7.31k
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2687
7.31k
        GC_ADDREF(ht);
2688
7.31k
      }
2689
7.31k
      ZVAL_UNDEFINED_OP2();
2690
7.31k
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2691
134
        if (!GC_REFCOUNT(ht)) {
2692
134
          zend_array_destroy(ht);
2693
134
        }
2694
134
        return IS_NULL;
2695
134
      }
2696
7.17k
      if (EG(exception)) {
2697
46
        return IS_NULL;
2698
46
      }
2699
7.13k
      ZEND_FALLTHROUGH;
2700
7.13k
    }
2701
8.19k
    case IS_NULL:
2702
8.19k
      value->str = ZSTR_EMPTY_ALLOC();
2703
8.19k
      return IS_STRING;
2704
49
    case IS_DOUBLE:
2705
49
      value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2706
49
      if (!zend_is_long_compatible(Z_DVAL_P(dim), value->lval)) {
2707
        /* The array may be destroyed while throwing the notice.
2708
         * Temporarily increase the refcount to detect this situation. */
2709
36
        if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2710
36
          GC_ADDREF(ht);
2711
36
        }
2712
36
        zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
2713
36
        if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2714
22
          if (!GC_REFCOUNT(ht)) {
2715
12
            zend_array_destroy(ht);
2716
12
          }
2717
22
          return IS_NULL;
2718
22
        }
2719
14
        if (EG(exception)) {
2720
0
          return IS_NULL;
2721
0
        }
2722
14
      }
2723
27
      return IS_LONG;
2724
0
    case IS_RESOURCE:
2725
      /* The array may be destroyed while throwing the notice.
2726
       * Temporarily increase the refcount to detect this situation. */
2727
0
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2728
0
        GC_ADDREF(ht);
2729
0
      }
2730
0
      zend_use_resource_as_offset(dim);
2731
0
      if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
2732
0
        if (!GC_REFCOUNT(ht)) {
2733
0
          zend_array_destroy(ht);
2734
0
        }
2735
0
        return IS_NULL;
2736
0
      }
2737
0
      if (EG(exception)) {
2738
0
        return IS_NULL;
2739
0
      }
2740
0
      value->lval = Z_RES_HANDLE_P(dim);
2741
0
      return IS_LONG;
2742
0
    case IS_FALSE:
2743
0
      value->lval = 0;
2744
0
      return IS_LONG;
2745
244
    case IS_TRUE:
2746
244
      value->lval = 1;
2747
244
      return IS_LONG;
2748
95
    default:
2749
95
      zend_illegal_array_offset_access(dim);
2750
95
      return IS_NULL;
2751
8.76k
  }
2752
8.76k
}
2753
2754
static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2755
56.5k
{
2756
56.5k
  zval *retval = NULL;
2757
56.5k
  zend_string *offset_key;
2758
56.5k
  zend_ulong hval;
2759
2760
56.5k
try_again:
2761
56.5k
  if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
2762
33.2k
    hval = Z_LVAL_P(dim);
2763
33.8k
num_index:
2764
33.8k
    if (type != BP_VAR_W) {
2765
11.9k
      ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
2766
10.3k
      return retval;
2767
1.60k
num_undef:
2768
1.60k
      switch (type) {
2769
1.16k
        case BP_VAR_R:
2770
1.16k
          zend_undefined_offset(hval);
2771
1.16k
          ZEND_FALLTHROUGH;
2772
1.16k
        case BP_VAR_UNSET:
2773
1.23k
        case BP_VAR_IS:
2774
1.23k
          retval = &EG(uninitialized_zval);
2775
1.23k
          break;
2776
370
        case BP_VAR_RW:
2777
370
          retval = zend_undefined_offset_write(ht, hval);
2778
370
          break;
2779
1.60k
        }
2780
21.8k
    } else {
2781
21.8k
      ZEND_HASH_INDEX_LOOKUP(ht, hval, retval);
2782
21.8k
    }
2783
33.8k
  } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
2784
13.8k
    offset_key = Z_STR_P(dim);
2785
13.8k
    if (ZEND_CONST_COND(dim_type != IS_CONST, 1)) {
2786
13.8k
      if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
2787
81
        goto num_index;
2788
81
      }
2789
13.8k
    }
2790
22.4k
str_index:
2791
22.4k
    if (type != BP_VAR_W) {
2792
9.15k
      retval = zend_hash_find_ex(ht, offset_key, ZEND_CONST_COND(dim_type == IS_CONST, 0));
2793
9.15k
      if (!retval) {
2794
3.09k
        switch (type) {
2795
952
          case BP_VAR_R:
2796
952
            zend_undefined_index(offset_key);
2797
952
            ZEND_FALLTHROUGH;
2798
952
          case BP_VAR_UNSET:
2799
1.23k
          case BP_VAR_IS:
2800
1.23k
            retval = &EG(uninitialized_zval);
2801
1.23k
            break;
2802
1.86k
          case BP_VAR_RW:
2803
1.86k
            retval = zend_undefined_index_write(ht, offset_key);
2804
1.86k
            break;
2805
3.09k
        }
2806
3.09k
      }
2807
13.2k
    } else {
2808
13.2k
      retval = zend_hash_lookup(ht, offset_key);
2809
13.2k
    }
2810
22.4k
  } else if (EXPECTED(Z_TYPE_P(dim) == IS_REFERENCE)) {
2811
20
    dim = Z_REFVAL_P(dim);
2812
20
    goto try_again;
2813
9.50k
  } else {
2814
9.50k
    zend_value val;
2815
9.50k
    uint8_t t;
2816
2817
9.50k
    if (type != BP_VAR_W && type != BP_VAR_RW) {
2818
741
      t = slow_index_convert(ht, dim, &val EXECUTE_DATA_CC);
2819
8.76k
    } else {
2820
8.76k
      t = slow_index_convert_w(ht, dim, &val EXECUTE_DATA_CC);
2821
8.76k
    }
2822
9.50k
    if (t == IS_STRING) {
2823
8.68k
      offset_key = val.str;
2824
8.68k
      goto str_index;
2825
8.68k
    } else if (t == IS_LONG) {
2826
486
      hval = val.lval;
2827
486
      goto num_index;
2828
486
    } else {
2829
333
      retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
2830
297
          NULL : &EG(uninitialized_zval);
2831
333
    }
2832
9.50k
  }
2833
46.1k
  return retval;
2834
56.5k
}
2835
2836
static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2837
16.6k
{
2838
16.6k
  return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_W EXECUTE_DATA_CC);
2839
16.6k
}
2840
2841
static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2842
5.05k
{
2843
5.05k
  return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_W EXECUTE_DATA_CC);
2844
5.05k
}
2845
2846
static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2847
2.91k
{
2848
2.91k
  return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_RW EXECUTE_DATA_CC);
2849
2.91k
}
2850
2851
static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2852
1.31k
{
2853
1.31k
  return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_RW EXECUTE_DATA_CC);
2854
1.31k
}
2855
2856
static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container, zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2857
17.6k
{
2858
17.6k
  zval *retval;
2859
2860
17.6k
  if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2861
14.4k
try_array:
2862
14.4k
    SEPARATE_ARRAY(container);
2863
16.8k
fetch_from_array:
2864
16.8k
    if (dim == NULL) {
2865
1.95k
      retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
2866
1.95k
      if (UNEXPECTED(retval == NULL)) {
2867
40
        zend_cannot_add_element();
2868
40
        ZVAL_UNDEF(result);
2869
40
        return;
2870
40
      }
2871
14.8k
    } else {
2872
14.8k
      retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2873
14.8k
      if (UNEXPECTED(!retval)) {
2874
        /* This may fail without throwing if the array was modified while throwing an
2875
         * undefined index error. */
2876
74
        ZVAL_NULL(result);
2877
74
        return;
2878
74
      }
2879
14.8k
    }
2880
16.7k
    ZVAL_INDIRECT(result, retval);
2881
16.7k
    return;
2882
16.8k
  } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2883
4.19k
    zend_reference *ref = Z_REF_P(container);
2884
4.19k
    container = Z_REFVAL_P(container);
2885
4.19k
    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2886
3.97k
      goto try_array;
2887
3.97k
    } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2888
188
      if (type != BP_VAR_UNSET) {
2889
188
        if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2890
5
          if (UNEXPECTED(!zend_verify_ref_array_assignable(ref))) {
2891
5
            ZVAL_UNDEF(result);
2892
5
            return;
2893
5
          }
2894
5
        }
2895
183
        array_init(container);
2896
183
        goto fetch_from_array;
2897
188
      } else {
2898
0
        goto return_null;
2899
0
      }
2900
188
    }
2901
4.19k
  }
2902
2.98k
  if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2903
152
    if (dim == NULL) {
2904
5
      zend_use_new_element_for_string();
2905
147
    } else {
2906
147
      zend_check_string_offset(dim, type EXECUTE_DATA_CC);
2907
147
      zend_wrong_string_offset_error();
2908
147
    }
2909
152
    ZVAL_UNDEF(result);
2910
2.83k
  } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2911
510
    zend_object *obj = Z_OBJ_P(container);
2912
510
    GC_ADDREF(obj);
2913
510
    if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2914
7
      dim = ZVAL_UNDEFINED_OP2();
2915
503
    } else if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2916
0
      dim++;
2917
0
    }
2918
510
    retval = obj->handlers->read_dimension(obj, dim, type, result);
2919
2920
510
    if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
2921
0
      zend_class_entry *ce = obj->ce;
2922
2923
0
      ZVAL_NULL(result);
2924
0
      zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2925
510
    } else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
2926
491
      if (!Z_ISREF_P(retval)) {
2927
241
        if (result != retval) {
2928
198
          ZVAL_COPY(result, retval);
2929
198
          retval = result;
2930
198
        }
2931
241
        if (Z_TYPE_P(retval) != IS_OBJECT) {
2932
193
          zend_class_entry *ce = obj->ce;
2933
193
          zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2934
193
        }
2935
250
      } else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) {
2936
159
        ZVAL_UNREF(retval);
2937
159
      }
2938
491
      if (result != retval) {
2939
149
        ZVAL_INDIRECT(result, retval);
2940
149
      }
2941
491
    } else {
2942
19
      ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception");
2943
19
      ZVAL_UNDEF(result);
2944
19
    }
2945
510
    if (UNEXPECTED(GC_DELREF(obj) == 0)) {
2946
7
      zend_objects_store_del(obj);
2947
7
    }
2948
2.32k
  } else {
2949
2.32k
    if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2950
2.23k
      if (type != BP_VAR_W && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2951
227
        ZVAL_UNDEFINED_OP1();
2952
227
      }
2953
2.23k
      if (type != BP_VAR_UNSET) {
2954
2.19k
        HashTable *ht = zend_new_array(0);
2955
2.19k
        uint8_t old_type = Z_TYPE_P(container);
2956
2957
2.19k
        ZVAL_ARR(container, ht);
2958
2.19k
        if (UNEXPECTED(old_type == IS_FALSE)) {
2959
121
          GC_ADDREF(ht);
2960
121
          zend_false_to_array_deprecated();
2961
121
          if (UNEXPECTED(GC_DELREF(ht) == 0)) {
2962
0
            zend_array_destroy(ht);
2963
0
            goto return_null;
2964
0
          }
2965
121
        }
2966
2.19k
        goto fetch_from_array;
2967
2.19k
      } else {
2968
38
        if (UNEXPECTED(Z_TYPE_P(container) == IS_FALSE)) {
2969
12
          zend_false_to_array_deprecated();
2970
12
        }
2971
38
return_null:
2972
        /* for read-mode only */
2973
38
        if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2974
0
          ZVAL_UNDEFINED_OP2();
2975
0
        }
2976
38
        ZVAL_NULL(result);
2977
38
      }
2978
2.23k
    } else {
2979
93
      if (type == BP_VAR_UNSET) {
2980
17
        zend_throw_error(NULL, "Cannot unset offset in a non-array variable");
2981
17
        ZVAL_UNDEF(result);
2982
76
      } else {
2983
76
        zend_use_scalar_as_array();
2984
76
        ZVAL_UNDEF(result);
2985
76
      }
2986
93
    }
2987
2.32k
  }
2988
2.98k
}
2989
2990
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_W(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2991
16.1k
{
2992
16.1k
  zval *result = EX_VAR(opline->result.var);
2993
16.1k
  zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W EXECUTE_DATA_CC);
2994
16.1k
}
2995
2996
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_RW(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2997
1.37k
{
2998
1.37k
  zval *result = EX_VAR(opline->result.var);
2999
1.37k
  zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW EXECUTE_DATA_CC);
3000
1.37k
}
3001
3002
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_UNSET(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
3003
124
{
3004
124
  zval *result = EX_VAR(opline->result.var);
3005
124
  zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET EXECUTE_DATA_CC);
3006
124
}
3007
3008
static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, bool is_list, int slow EXECUTE_DATA_DC)
3009
17.9k
{
3010
17.9k
  zval *retval;
3011
3012
17.9k
  if (!slow) {
3013
7.21k
    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
3014
5.34k
try_array:
3015
5.34k
      retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
3016
5.34k
      ZVAL_COPY_DEREF(result, retval);
3017
5.34k
      return;
3018
5.32k
    } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
3019
68
      container = Z_REFVAL_P(container);
3020
68
      if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
3021
23
        goto try_array;
3022
23
      }
3023
68
    }
3024
7.21k
  }
3025
12.5k
  if (!is_list && EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
3026
2.94k
    zend_string *str = Z_STR_P(container);
3027
2.94k
    zend_long offset;
3028
3029
2.94k
try_string_offset:
3030
2.94k
    if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
3031
937
      switch (Z_TYPE_P(dim)) {
3032
458
        case IS_STRING:
3033
458
        {
3034
458
          bool trailing_data = false;
3035
          /* For BC reasons we allow errors so that we can warn on leading numeric string */
3036
458
          if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset,
3037
458
              NULL, /* allow errors */ true, NULL, &trailing_data)) {
3038
255
            if (UNEXPECTED(trailing_data)) {
3039
118
              zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
3040
118
            }
3041
255
            goto out;
3042
255
          }
3043
203
          if (type == BP_VAR_IS) {
3044
52
            ZVAL_NULL(result);
3045
52
            return;
3046
52
          }
3047
151
          zend_illegal_string_offset(dim, BP_VAR_R);
3048
151
          ZVAL_NULL(result);
3049
151
          return;
3050
203
        }
3051
59
        case IS_UNDEF:
3052
          /* The string may be destroyed while throwing the notice.
3053
           * Temporarily increase the refcount to detect this situation. */
3054
59
          if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
3055
9
            GC_ADDREF(str);
3056
9
          }
3057
59
          ZVAL_UNDEFINED_OP2();
3058
59
          if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
3059
0
            zend_string_efree(str);
3060
0
            ZVAL_NULL(result);
3061
0
            return;
3062
0
          }
3063
59
          ZEND_FALLTHROUGH;
3064
398
        case IS_DOUBLE:
3065
413
        case IS_NULL:
3066
443
        case IS_FALSE:
3067
460
        case IS_TRUE:
3068
460
          if (type != BP_VAR_IS) {
3069
            /* The string may be destroyed while throwing the notice.
3070
             * Temporarily increase the refcount to detect this situation. */
3071
445
            if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
3072
11
              GC_ADDREF(str);
3073
11
            }
3074
445
            zend_error(E_WARNING, "String offset cast occurred");
3075
445
            if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
3076
0
              zend_string_efree(str);
3077
0
              ZVAL_NULL(result);
3078
0
              return;
3079
0
            }
3080
445
          }
3081
460
          break;
3082
460
        case IS_REFERENCE:
3083
0
          dim = Z_REFVAL_P(dim);
3084
0
          goto try_string_offset;
3085
19
        default:
3086
19
          zend_illegal_string_offset(dim, BP_VAR_R);
3087
19
          ZVAL_NULL(result);
3088
19
          return;
3089
937
      }
3090
3091
460
      offset = zval_get_long_func(dim, /* is_strict */ false);
3092
2.00k
    } else {
3093
2.00k
      offset = Z_LVAL_P(dim);
3094
2.00k
    }
3095
2.71k
    out:
3096
3097
2.71k
    if (UNEXPECTED(ZSTR_LEN(str) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
3098
946
      if (type != BP_VAR_IS) {
3099
928
        zend_error(E_WARNING, "Uninitialized string offset " ZEND_LONG_FMT, offset);
3100
928
        ZVAL_EMPTY_STRING(result);
3101
928
      } else {
3102
18
        ZVAL_NULL(result);
3103
18
      }
3104
1.77k
    } else {
3105
1.77k
      zend_uchar c;
3106
1.77k
      zend_long real_offset;
3107
3108
1.77k
      real_offset = (UNEXPECTED(offset < 0)) /* Handle negative offset */
3109
1.77k
        ? (zend_long)ZSTR_LEN(str) + offset : offset;
3110
1.77k
      c = (zend_uchar)ZSTR_VAL(str)[real_offset];
3111
3112
1.77k
      ZVAL_CHAR(result, c);
3113
1.77k
    }
3114
9.65k
  } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
3115
2.92k
    zend_object *obj = Z_OBJ_P(container);
3116
3117
2.92k
    GC_ADDREF(obj);
3118
2.92k
    if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
3119
9
      dim = ZVAL_UNDEFINED_OP2();
3120
9
    }
3121
2.92k
    if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
3122
5
      dim++;
3123
5
    }
3124
2.92k
    retval = obj->handlers->read_dimension(obj, dim, type, result);
3125
3126
2.92k
    ZEND_ASSERT(result != NULL);
3127
1.92k
    if (retval) {
3128
1.84k
      if (result != retval) {
3129
1.43k
        ZVAL_COPY_DEREF(result, retval);
3130
1.43k
      } else if (UNEXPECTED(Z_ISREF_P(retval))) {
3131
86
        zend_unwrap_reference(result);
3132
86
      }
3133
1.84k
    } else {
3134
83
      ZVAL_NULL(result);
3135
83
    }
3136
1.92k
    if (UNEXPECTED(GC_DELREF(obj) == 0)) {
3137
14
      zend_objects_store_del(obj);
3138
14
    }
3139
6.73k
  } else {
3140
6.73k
    if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
3141
3.90k
      container = ZVAL_UNDEFINED_OP1();
3142
3.90k
    }
3143
6.73k
    if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
3144
524
      ZVAL_UNDEFINED_OP2();
3145
524
    }
3146
6.73k
    if (!is_list && type != BP_VAR_IS) {
3147
5.73k
      zend_error(E_WARNING, "Trying to access array offset on %s",
3148
5.73k
        zend_zval_value_name(container));
3149
5.73k
    }
3150
6.73k
    ZVAL_NULL(result);
3151
6.73k
  }
3152
12.5k
}
3153
3154
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_R(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
3155
1.02k
{
3156
1.02k
  zval *result = EX_VAR(opline->result.var);
3157
1.02k
  zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
3158
1.02k
}
3159
3160
static zend_never_inline void zend_fetch_dimension_address_read_R_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
3161
10.7k
{
3162
10.7k
  zval *result = EX_VAR(opline->result.var);
3163
10.7k
  zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 0, 1 EXECUTE_DATA_CC);
3164
10.7k
}
3165
3166
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_IS(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
3167
2.36k
{
3168
2.36k
  zval *result = EX_VAR(opline->result.var);
3169
2.36k
  zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 0, 0 EXECUTE_DATA_CC);
3170
2.36k
}
3171
3172
static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
3173
3.51k
{
3174
3.51k
  zval *result = EX_VAR(opline->result.var);
3175
3.51k
  zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0 EXECUTE_DATA_CC);
3176
3.51k
}
3177
3178
ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)
3179
312
{
3180
312
  zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 0, 0 NO_EXECUTE_DATA_CC);
3181
312
}
3182
3183
static zend_never_inline zval* ZEND_FASTCALL zend_find_array_dim_slow(HashTable *ht, zval *offset EXECUTE_DATA_DC)
3184
91
{
3185
91
  zend_ulong hval;
3186
3187
91
  if (Z_TYPE_P(offset) == IS_DOUBLE) {
3188
8
    hval = zend_dval_to_lval_safe(Z_DVAL_P(offset));
3189
18
num_idx:
3190
18
    return zend_hash_index_find(ht, hval);
3191
83
  } else if (Z_TYPE_P(offset) == IS_NULL) {
3192
31
str_idx:
3193
31
    return zend_hash_find_known_hash(ht, ZSTR_EMPTY_ALLOC());
3194
72
  } else if (Z_TYPE_P(offset) == IS_FALSE) {
3195
5
    hval = 0;
3196
5
    goto num_idx;
3197
67
  } else if (Z_TYPE_P(offset) == IS_TRUE) {
3198
5
    hval = 1;
3199
5
    goto num_idx;
3200
62
  } else if (Z_TYPE_P(offset) == IS_RESOURCE) {
3201
0
    zend_use_resource_as_offset(offset);
3202
0
    hval = Z_RES_HANDLE_P(offset);
3203
0
    goto num_idx;
3204
62
  } else if (/*OP2_TYPE == IS_CV &&*/ Z_TYPE_P(offset) == IS_UNDEF) {
3205
20
    ZVAL_UNDEFINED_OP2();
3206
20
    goto str_idx;
3207
42
  } else {
3208
42
    zend_illegal_array_offset_isset(offset);
3209
42
    return NULL;
3210
42
  }
3211
91
}
3212
3213
static zend_never_inline bool ZEND_FASTCALL zend_isset_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
3214
1.12k
{
3215
1.12k
  if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
3216
20
    offset = ZVAL_UNDEFINED_OP2();
3217
20
  }
3218
3219
1.12k
  if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
3220
365
    return Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 0);
3221
756
  } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
3222
543
    zend_long lval;
3223
3224
543
    if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
3225
176
      lval = Z_LVAL_P(offset);
3226
406
str_offset:
3227
406
      if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
3228
86
        lval += (zend_long)Z_STRLEN_P(container);
3229
86
      }
3230
406
      if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
3231
311
        return 1;
3232
311
      } else {
3233
95
        return 0;
3234
95
      }
3235
406
    } else {
3236
      /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
3237
367
        ZVAL_DEREF(offset);
3238
      /*}*/
3239
367
      if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
3240
367
          || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
3241
283
            && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
3242
230
        lval = zval_get_long_ex(offset, /* is_strict */ true);
3243
230
        goto str_offset;
3244
230
      }
3245
137
      return 0;
3246
367
    }
3247
543
  } else {
3248
213
    return 0;
3249
213
  }
3250
1.12k
}
3251
3252
static zend_never_inline bool ZEND_FASTCALL zend_isempty_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
3253
604
{
3254
604
  if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
3255
5
    offset = ZVAL_UNDEFINED_OP2();
3256
5
  }
3257
3258
604
  if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
3259
129
    return !Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 1);
3260
475
  } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
3261
440
    zend_long lval;
3262
3263
440
    if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
3264
164
      lval = Z_LVAL_P(offset);
3265
347
str_offset:
3266
347
      if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
3267
115
        lval += (zend_long)Z_STRLEN_P(container);
3268
115
      }
3269
347
      if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
3270
264
        return (Z_STRVAL_P(container)[lval] == '0');
3271
264
      } else {
3272
83
        return 1;
3273
83
      }
3274
347
    } else {
3275
      /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
3276
276
        ZVAL_DEREF(offset);
3277
      /*}*/
3278
276
      if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
3279
276
          || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
3280
199
            && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
3281
183
        lval = zval_get_long_ex(offset, /* is_strict */ true);
3282
183
        goto str_offset;
3283
183
      }
3284
93
      return 1;
3285
276
    }
3286
440
  } else {
3287
35
    return 1;
3288
35
  }
3289
604
}
3290
3291
static zend_never_inline bool ZEND_FASTCALL zend_array_key_exists_fast(HashTable *ht, zval *key OPLINE_DC EXECUTE_DATA_DC)
3292
358
{
3293
358
  zend_string *str;
3294
358
  zend_ulong hval;
3295
3296
358
try_again:
3297
358
  if (EXPECTED(Z_TYPE_P(key) == IS_STRING)) {
3298
261
    str = Z_STR_P(key);
3299
261
    if (ZEND_HANDLE_NUMERIC(str, hval)) {
3300
0
      goto num_key;
3301
0
    }
3302
270
str_key:
3303
270
    return zend_hash_exists(ht, str);
3304
261
  } else if (EXPECTED(Z_TYPE_P(key) == IS_LONG)) {
3305
88
    hval = Z_LVAL_P(key);
3306
88
num_key:
3307
88
    return zend_hash_index_exists(ht, hval);
3308
88
  } else if (EXPECTED(Z_ISREF_P(key))) {
3309
0
    key = Z_REFVAL_P(key);
3310
0
    goto try_again;
3311
9
  } else if (Z_TYPE_P(key) == IS_DOUBLE) {
3312
0
    hval = zend_dval_to_lval_safe(Z_DVAL_P(key));
3313
0
    goto num_key;
3314
9
  } else if (Z_TYPE_P(key) == IS_FALSE) {
3315
0
    hval = 0;
3316
0
    goto num_key;
3317
9
  } else if (Z_TYPE_P(key) == IS_TRUE) {
3318
0
    hval = 1;
3319
0
    goto num_key;
3320
9
  } else if (Z_TYPE_P(key) == IS_RESOURCE) {
3321
0
    zend_use_resource_as_offset(key);
3322
0
    hval = Z_RES_HANDLE_P(key);
3323
0
    goto num_key;
3324
9
  } else if (Z_TYPE_P(key) <= IS_NULL) {
3325
9
    if (UNEXPECTED(Z_TYPE_P(key) == IS_UNDEF)) {
3326
0
      ZVAL_UNDEFINED_OP1();
3327
0
    }
3328
9
    str = ZSTR_EMPTY_ALLOC();
3329
9
    goto str_key;
3330
9
  } else {
3331
0
    zend_illegal_array_offset_access(key);
3332
0
    return 0;
3333
0
  }
3334
358
}
3335
3336
static ZEND_COLD void ZEND_FASTCALL zend_array_key_exists_error(
3337
    zval *subject, zval *key OPLINE_DC EXECUTE_DATA_DC)
3338
16
{
3339
16
  if (Z_TYPE_P(key) == IS_UNDEF) {
3340
0
    ZVAL_UNDEFINED_OP1();
3341
0
  }
3342
16
  if (Z_TYPE_P(subject) == IS_UNDEF) {
3343
2
    ZVAL_UNDEFINED_OP2();
3344
2
  }
3345
16
  if (!EG(exception)) {
3346
16
    zend_type_error("array_key_exists(): Argument #2 ($array) must be of type array, %s given",
3347
16
      zend_zval_value_name(subject));
3348
16
  }
3349
16
}
3350
3351
110
static zend_always_inline bool promotes_to_array(zval *val) {
3352
110
  return Z_TYPE_P(val) <= IS_FALSE
3353
110
    || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE);
3354
110
}
3355
3356
68
static zend_always_inline bool check_type_array_assignable(zend_type type) {
3357
68
  if (!ZEND_TYPE_IS_SET(type)) {
3358
0
    return 1;
3359
0
  }
3360
68
  return (ZEND_TYPE_FULL_MASK(type) & MAY_BE_ARRAY) != 0;
3361
68
}
3362
3363
/* Checks whether an array can be assigned to the reference. Throws error if not assignable. */
3364
15
ZEND_API bool zend_verify_ref_array_assignable(zend_reference *ref) {
3365
15
  zend_property_info *prop;
3366
15
  ZEND_ASSERT(ZEND_REF_HAS_TYPE_SOURCES(ref));
3367
45
  ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3368
45
    if (!check_type_array_assignable(prop->type)) {
3369
10
      zend_throw_auto_init_in_ref_error(prop);
3370
10
      return 0;
3371
10
    }
3372
45
  } ZEND_REF_FOREACH_TYPE_SOURCES_END();
3373
5
  return 1;
3374
15
}
3375
3376
static zend_never_inline bool zend_handle_fetch_obj_flags(
3377
    zval *result, zval *ptr, zend_object *obj, zend_property_info *prop_info, uint32_t flags)
3378
1.52k
{
3379
1.52k
  switch (flags) {
3380
110
    case ZEND_FETCH_DIM_WRITE:
3381
110
      if (promotes_to_array(ptr)) {
3382
53
        if (!prop_info) {
3383
0
          break;
3384
0
        }
3385
53
        if (!check_type_array_assignable(prop_info->type)) {
3386
21
          zend_throw_auto_init_in_prop_error(prop_info);
3387
21
          if (result) ZVAL_ERROR(result);
3388
21
          return 0;
3389
21
        }
3390
53
      }
3391
89
      break;
3392
1.41k
    case ZEND_FETCH_REF:
3393
1.41k
      if (Z_TYPE_P(ptr) != IS_REFERENCE) {
3394
901
        if (!prop_info) {
3395
0
          break;
3396
0
        }
3397
901
        if (Z_TYPE_P(ptr) == IS_UNDEF) {
3398
64
          if (!ZEND_TYPE_ALLOW_NULL(prop_info->type)) {
3399
17
            zend_throw_access_uninit_prop_by_ref_error(prop_info);
3400
17
            if (result) ZVAL_ERROR(result);
3401
17
            return 0;
3402
17
          }
3403
47
          ZVAL_NULL(ptr);
3404
47
        }
3405
3406
884
        ZVAL_NEW_REF(ptr, ptr);
3407
884
        ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(ptr), prop_info);
3408
884
      }
3409
1.39k
      break;
3410
1.52k
    EMPTY_SWITCH_DEFAULT_CASE()
3411
1.52k
  }
3412
1.48k
  return 1;
3413
1.52k
}
3414
3415
static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type, uint32_t flags, zend_property_info **prop_info_p OPLINE_DC EXECUTE_DATA_DC)
3416
6.99k
{
3417
6.99k
  zval *ptr;
3418
6.99k
  zend_object *zobj;
3419
6.99k
  zend_string *name, *tmp_name;
3420
6.99k
  void *_cache_slot[3] = {0};
3421
6.99k
  if (prop_op_type != IS_CONST) {
3422
1.17k
    cache_slot = _cache_slot;
3423
5.82k
  } else {
3424
5.82k
    ZEND_ASSERT(cache_slot);
3425
5.82k
  }
3426
3427
6.99k
  if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
3428
255
    do {
3429
255
      if (Z_ISREF_P(container) && Z_TYPE_P(Z_REFVAL_P(container)) == IS_OBJECT) {
3430
85
        container = Z_REFVAL_P(container);
3431
85
        break;
3432
85
      }
3433
3434
170
      if (container_op_type == IS_CV
3435
170
       && type != BP_VAR_W
3436
170
       && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
3437
11
        ZVAL_UNDEFINED_OP1();
3438
11
      }
3439
3440
      /* this should modify object only if it's empty */
3441
170
      if (type == BP_VAR_UNSET) {
3442
26
        ZVAL_NULL(result);
3443
26
        return;
3444
26
      }
3445
3446
144
      zend_throw_non_object_error(container, prop_ptr OPLINE_CC EXECUTE_DATA_CC);
3447
144
      ZVAL_ERROR(result);
3448
144
      return;
3449
170
    } while (0);
3450
255
  }
3451
3452
6.82k
  zobj = Z_OBJ_P(container);
3453
6.82k
  if (prop_op_type == IS_CONST &&
3454
6.82k
      EXPECTED(zobj->ce == CACHED_PTR_EX(cache_slot))) {
3455
2.82k
    uintptr_t prop_offset = (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
3456
2.82k
    if (prop_info_p) {
3457
40
      *prop_info_p = CACHED_PTR_EX(cache_slot + 2);
3458
40
    }
3459
3460
2.82k
    if (EXPECTED(IS_VALID_PROPERTY_OFFSET(prop_offset))) {
3461
2.52k
      ptr = OBJ_PROP(zobj, prop_offset);
3462
2.52k
      if (EXPECTED(Z_TYPE_P(ptr) != IS_UNDEF)) {
3463
2.37k
        ZVAL_INDIRECT(result, ptr);
3464
2.37k
        zend_property_info *prop_info = CACHED_PTR_EX(cache_slot + 2);
3465
2.37k
        if (prop_info) {
3466
627
          if (UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))
3467
627
           && ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info))) {
3468
            /* For objects, W/RW/UNSET fetch modes might not actually modify object.
3469
             * Similar as with magic __get() allow them, but return the value as a copy
3470
             * to make sure no actual modification is possible. */
3471
63
            ZEND_ASSERT(type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET);
3472
63
            if (Z_TYPE_P(ptr) == IS_OBJECT) {
3473
29
              ZVAL_COPY(result, ptr);
3474
34
            } else {
3475
34
              if (prop_info->flags & ZEND_ACC_READONLY) {
3476
29
                zend_readonly_property_indirect_modification_error(prop_info);
3477
29
              } else {
3478
5
                zend_asymmetric_visibility_property_modification_error(prop_info, "indirectly modify");
3479
5
              }
3480
34
              ZVAL_ERROR(result);
3481
34
            }
3482
63
            return;
3483
63
          }
3484
564
          flags &= ZEND_FETCH_OBJ_FLAGS;
3485
564
          if (flags) {
3486
304
            zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags);
3487
304
          }
3488
564
        }
3489
2.30k
        return;
3490
2.37k
      }
3491
2.52k
    } else if (UNEXPECTED(IS_HOOKED_PROPERTY_OFFSET(prop_offset))) {
3492
      /* Fall through to read_property for hooks. */
3493
280
    } else if (EXPECTED(zobj->properties != NULL)) {
3494
156
      ZEND_ASSERT(IS_DYNAMIC_PROPERTY_OFFSET(prop_offset));
3495
156
      if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
3496
0
        if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
3497
0
          GC_DELREF(zobj->properties);
3498
0
        }
3499
0
        zobj->properties = zend_array_dup(zobj->properties);
3500
0
      }
3501
156
      ptr = zend_hash_find_known_hash(zobj->properties, Z_STR_P(prop_ptr));
3502
156
      if (EXPECTED(ptr)) {
3503
146
        ZVAL_INDIRECT(result, ptr);
3504
146
        return;
3505
146
      }
3506
156
    }
3507
3.99k
  } else if (prop_op_type == IS_CONST) {
3508
    /* CE mismatch, make cache slot consistent */
3509
2.84k
    cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
3510
2.84k
  }
3511
3512
  /* Pointer on property callback is required */
3513
4.30k
  ZEND_ASSERT(zobj->handlers->get_property_ptr_ptr != NULL);
3514
3515
4.30k
  if (prop_op_type == IS_CONST) {
3516
3.15k
    name = Z_STR_P(prop_ptr);
3517
3.15k
  } else {
3518
1.15k
    name = zval_get_tmp_string(prop_ptr, &tmp_name);
3519
1.15k
  }
3520
4.30k
  ptr = zobj->handlers->get_property_ptr_ptr(zobj, name, type, cache_slot);
3521
4.30k
  if (NULL == ptr) {
3522
716
    ptr = zobj->handlers->read_property(zobj, name, type, cache_slot, result);
3523
716
    if (ptr == result) {
3524
451
      if (UNEXPECTED(Z_ISREF_P(ptr) && Z_REFCOUNT_P(ptr) == 1)) {
3525
8
        ZVAL_UNREF(ptr);
3526
8
      }
3527
451
      goto end;
3528
451
    }
3529
265
    if (UNEXPECTED(EG(exception))) {
3530
190
      ZVAL_ERROR(result);
3531
190
      goto end;
3532
190
    }
3533
3.59k
  } else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
3534
38
    ZVAL_ERROR(result);
3535
38
    goto end;
3536
38
  }
3537
3538
3.62k
  ZVAL_INDIRECT(result, ptr);
3539
3.62k
  flags &= ZEND_FETCH_OBJ_FLAGS;
3540
3.62k
  if (flags) {
3541
2.50k
    zend_property_info *prop_info = CACHED_PTR_EX(cache_slot + 2);
3542
2.50k
    if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
3543
1.07k
      if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags))) {
3544
33
        goto end;
3545
33
      }
3546
1.07k
    }
3547
2.50k
  }
3548
3549
4.30k
end:
3550
4.30k
  if (prop_info_p) {
3551
894
    *prop_info_p = CACHED_PTR_EX(cache_slot + 2);
3552
894
  }
3553
4.30k
  if (prop_op_type != IS_CONST) {
3554
1.15k
    zend_tmp_string_release(tmp_name);
3555
1.15k
  }
3556
4.30k
}
3557
3558
static zend_always_inline void zend_assign_to_property_reference(zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3559
961
{
3560
961
  zval variable, *variable_ptr = &variable;
3561
961
  void **cache_addr = (prop_op_type == IS_CONST) ? CACHE_ADDR(opline->extended_value & ~ZEND_RETURNS_FUNCTION) : NULL;
3562
961
  zend_refcounted *garbage = NULL;
3563
961
  zend_property_info *prop_info = NULL;
3564
3565
961
  zend_fetch_property_address(variable_ptr, container, container_op_type, prop_ptr, prop_op_type,
3566
961
    cache_addr, BP_VAR_W, 0, &prop_info OPLINE_CC EXECUTE_DATA_CC);
3567
3568
961
  if (EXPECTED(Z_TYPE_P(variable_ptr) == IS_INDIRECT)) {
3569
882
    variable_ptr = Z_INDIRECT_P(variable_ptr);
3570
882
    if (/*OP_DATA_TYPE == IS_VAR &&*/
3571
882
           (opline->extended_value & ZEND_RETURNS_FUNCTION) &&
3572
882
           UNEXPECTED(!Z_ISREF_P(value_ptr))) {
3573
3574
5
      variable_ptr = zend_wrong_assign_to_variable_reference(
3575
5
        variable_ptr, value_ptr, &garbage OPLINE_CC EXECUTE_DATA_CC);
3576
877
    } else if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
3577
565
      variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr, &garbage EXECUTE_DATA_CC);
3578
565
    } else {
3579
312
      zend_assign_to_variable_reference(variable_ptr, value_ptr, &garbage);
3580
312
    }
3581
882
  } else if (Z_ISERROR_P(variable_ptr)) {
3582
46
    variable_ptr = &EG(uninitialized_zval);
3583
46
  } else {
3584
33
    zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
3585
33
    zval_ptr_dtor(&variable);
3586
33
    variable_ptr = &EG(uninitialized_zval);
3587
33
  }
3588
3589
961
  if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
3590
97
    ZVAL_COPY(EX_VAR(opline->result.var), variable_ptr);
3591
97
  }
3592
961
  if (garbage) {
3593
348
    GC_DTOR(garbage);
3594
348
  }
3595
961
}
3596
3597
static zend_never_inline void zend_assign_to_property_reference_this_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3598
81
{
3599
81
  zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_CONST, value_ptr
3600
81
    OPLINE_CC EXECUTE_DATA_CC);
3601
81
}
3602
3603
static zend_never_inline void zend_assign_to_property_reference_var_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3604
417
{
3605
417
  zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_CONST, value_ptr
3606
417
    OPLINE_CC EXECUTE_DATA_CC);
3607
417
}
3608
3609
static zend_never_inline void zend_assign_to_property_reference_this_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3610
2
{
3611
2
  zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_VAR, value_ptr
3612
2
    OPLINE_CC EXECUTE_DATA_CC);
3613
2
}
3614
3615
static zend_never_inline void zend_assign_to_property_reference_var_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3616
461
{
3617
461
  zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_VAR, value_ptr
3618
461
    OPLINE_CC EXECUTE_DATA_CC);
3619
461
}
3620
3621
3.39k
static zend_never_inline zval* zend_fetch_static_property_address_ex(zend_property_info **prop_info, uint32_t cache_slot, int fetch_type OPLINE_DC EXECUTE_DATA_DC) {
3622
3.39k
  zval *result;
3623
3.39k
  zend_string *name;
3624
3.39k
  zend_class_entry *ce;
3625
3.39k
  zend_property_info *property_info;
3626
3627
3.39k
  uint8_t op1_type = opline->op1_type, op2_type = opline->op2_type;
3628
3629
3.39k
  if (EXPECTED(op2_type == IS_CONST)) {
3630
2.15k
    zval *class_name = RT_CONSTANT(opline, opline->op2);
3631
3632
2.15k
    ZEND_ASSERT(op1_type != IS_CONST || CACHED_PTR(cache_slot) == NULL);
3633
3634
2.15k
    if (EXPECTED((ce = CACHED_PTR(cache_slot)) == NULL)) {
3635
2.08k
      ce = zend_fetch_class_by_name(Z_STR_P(class_name), Z_STR_P(class_name + 1), ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
3636
2.08k
      if (UNEXPECTED(ce == NULL)) {
3637
77
        FREE_OP(op1_type, opline->op1.var);
3638
77
        return NULL;
3639
77
      }
3640
2.00k
      if (UNEXPECTED(op1_type != IS_CONST)) {
3641
19
        CACHE_PTR(cache_slot, ce);
3642
19
      }
3643
2.00k
    }
3644
2.15k
  } else {
3645
1.24k
    if (EXPECTED(op2_type == IS_UNUSED)) {
3646
1.12k
      ce = zend_fetch_class(NULL, opline->op2.num);
3647
1.12k
      if (UNEXPECTED(ce == NULL)) {
3648
22
        FREE_OP(op1_type, opline->op1.var);
3649
22
        return NULL;
3650
22
      }
3651
1.12k
    } else {
3652
121
      ce = Z_CE_P(EX_VAR(opline->op2.var));
3653
121
    }
3654
1.22k
    if (EXPECTED(op1_type == IS_CONST) && EXPECTED(CACHED_PTR(cache_slot) == ce)) {
3655
45
      result = CACHED_PTR(cache_slot + sizeof(void *));
3656
45
      *prop_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3657
45
      return result;
3658
45
    }
3659
1.22k
  }
3660
3661
3.25k
  if (EXPECTED(op1_type == IS_CONST)) {
3662
3.15k
    name = Z_STR_P(RT_CONSTANT(opline, opline->op1));
3663
3.15k
    result = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3664
3.15k
  } else {
3665
95
    zend_string *tmp_name;
3666
95
    zval *varname = get_zval_ptr_undef(opline->op1_type, opline->op1, BP_VAR_R);
3667
95
    if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {
3668
75
      name = Z_STR_P(varname);
3669
75
      tmp_name = NULL;
3670
75
    } else {
3671
20
      if (op1_type == IS_CV && UNEXPECTED(Z_TYPE_P(varname) == IS_UNDEF)) {
3672
10
        zval_undefined_cv(opline->op1.var EXECUTE_DATA_CC);
3673
10
      }
3674
20
      name = zval_get_tmp_string(varname, &tmp_name);
3675
20
    }
3676
95
    result = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3677
3678
95
    zend_tmp_string_release(tmp_name);
3679
3680
95
    FREE_OP(op1_type, opline->op1.var);
3681
95
  }
3682
3683
3.25k
  if (UNEXPECTED(result == NULL)) {
3684
354
    return NULL;
3685
354
  }
3686
3687
2.89k
  *prop_info = property_info;
3688
3689
2.89k
  if (EXPECTED(op1_type == IS_CONST)
3690
2.89k
      && EXPECTED(!(property_info->ce->ce_flags & ZEND_ACC_TRAIT))) {
3691
2.75k
    CACHE_POLYMORPHIC_PTR(cache_slot, ce, result);
3692
2.75k
    CACHE_PTR(cache_slot + sizeof(void *) * 2, property_info);
3693
2.75k
  }
3694
3695
2.89k
  return result;
3696
3.25k
}
3697
3698
3699
7.09k
static zend_always_inline zval* zend_fetch_static_property_address(zend_property_info **prop_info, uint32_t cache_slot, int fetch_type, int flags OPLINE_DC EXECUTE_DATA_DC) {
3700
7.09k
  zval *result;
3701
7.09k
  zend_property_info *property_info;
3702
3703
7.09k
  if (opline->op1_type == IS_CONST
3704
7.09k
   && (opline->op2_type == IS_CONST
3705
6.97k
    || (opline->op2_type == IS_UNUSED
3706
3.41k
     && ((opline->op2.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_SELF
3707
3.28k
      || (opline->op2.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_PARENT)))
3708
7.09k
   && EXPECTED(CACHED_PTR(cache_slot + sizeof(void *)) != NULL)) {
3709
3.69k
    result = CACHED_PTR(cache_slot + sizeof(void *));
3710
3.69k
    property_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3711
3712
3.69k
    if ((fetch_type == BP_VAR_R || fetch_type == BP_VAR_RW)
3713
3.69k
        && UNEXPECTED(Z_TYPE_P(result) == IS_UNDEF)
3714
3.69k
        && ZEND_TYPE_IS_SET(property_info->type)) {
3715
10
      zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
3716
10
        ZSTR_VAL(property_info->ce->name),
3717
10
        zend_get_unmangled_property_name(property_info->name));
3718
10
      return NULL;
3719
10
    }
3720
3.69k
  } else {
3721
3.39k
    result = zend_fetch_static_property_address_ex(&property_info, cache_slot, fetch_type OPLINE_CC EXECUTE_DATA_CC);
3722
3.39k
    if (UNEXPECTED(!result)) {
3723
453
      return NULL;
3724
453
    }
3725
3.39k
  }
3726
3727
6.62k
  flags &= ZEND_FETCH_OBJ_FLAGS;
3728
6.62k
  if (flags && ZEND_TYPE_IS_SET(property_info->type)) {
3729
139
    zend_handle_fetch_obj_flags(NULL, result, NULL, property_info, flags);
3730
139
  }
3731
3732
6.62k
  if (prop_info) {
3733
6.47k
    *prop_info = property_info;
3734
6.47k
  }
3735
3736
6.62k
  return result;
3737
7.09k
}
3738
3739
0
ZEND_API zval* ZEND_FASTCALL zend_fetch_static_property(zend_execute_data *ex, int fetch_type) {
3740
0
  zval *result;
3741
0
  zend_property_info *property_info;
3742
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3743
  zend_execute_data *orig_execute_data = execute_data;
3744
#else
3745
0
  zend_execute_data *execute_data;
3746
0
#endif
3747
0
  execute_data = ex;
3748
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3749
  const zend_op *orig_opline = opline;
3750
#else
3751
0
  const zend_op *opline;
3752
0
#endif
3753
0
  opline = execute_data->opline;
3754
3755
0
  uint32_t cache_slot = opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS;
3756
0
  uint32_t flags = 0;
3757
3758
0
  if (fetch_type == BP_VAR_W) {
3759
0
    flags = opline->extended_value & ZEND_FETCH_OBJ_FLAGS;
3760
0
  }
3761
0
  result = zend_fetch_static_property_address_ex(&property_info, cache_slot, fetch_type OPLINE_CC EXECUTE_DATA_CC);
3762
0
  if (EXPECTED(result)) {
3763
0
    if (flags && ZEND_TYPE_IS_SET(property_info->type)) {
3764
0
      zend_handle_fetch_obj_flags(NULL, result, NULL, property_info, flags);
3765
0
    }
3766
0
  } else {
3767
0
    result = &EG(uninitialized_zval);
3768
0
  }
3769
3770
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3771
  EX(opline) = opline;
3772
  opline = orig_opline;
3773
#endif
3774
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3775
  execute_data = orig_execute_data;
3776
#endif
3777
3778
0
  return result;
3779
0
}
3780
3781
83
ZEND_API ZEND_COLD void zend_throw_ref_type_error_type(const zend_property_info *prop1, const zend_property_info *prop2, const zval *zv) {
3782
83
  zend_string *type1_str = zend_type_to_string(prop1->type);
3783
83
  zend_string *type2_str = zend_type_to_string(prop2->type);
3784
83
  zend_type_error("Reference with value of type %s held by property %s::$%s of type %s is not compatible with property %s::$%s of type %s",
3785
83
    zend_zval_type_name(zv),
3786
83
    ZSTR_VAL(prop1->ce->name),
3787
83
    zend_get_unmangled_property_name(prop1->name),
3788
83
    ZSTR_VAL(type1_str),
3789
83
    ZSTR_VAL(prop2->ce->name),
3790
83
    zend_get_unmangled_property_name(prop2->name),
3791
83
    ZSTR_VAL(type2_str)
3792
83
  );
3793
83
  zend_string_release(type1_str);
3794
83
  zend_string_release(type2_str);
3795
83
}
3796
3797
436
ZEND_API ZEND_COLD void zend_throw_ref_type_error_zval(const zend_property_info *prop, const zval *zv) {
3798
436
  zend_string *type_str = zend_type_to_string(prop->type);
3799
436
  zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s",
3800
436
    zend_zval_value_name(zv),
3801
436
    ZSTR_VAL(prop->ce->name),
3802
436
    zend_get_unmangled_property_name(prop->name),
3803
436
    ZSTR_VAL(type_str)
3804
436
  );
3805
436
  zend_string_release(type_str);
3806
436
}
3807
3808
52
ZEND_API ZEND_COLD void zend_throw_conflicting_coercion_error(const zend_property_info *prop1, const zend_property_info *prop2, const zval *zv) {
3809
52
  zend_string *type1_str = zend_type_to_string(prop1->type);
3810
52
  zend_string *type2_str = zend_type_to_string(prop2->type);
3811
52
  zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s and property %s::$%s of type %s, as this would result in an inconsistent type conversion",
3812
52
    zend_zval_value_name(zv),
3813
52
    ZSTR_VAL(prop1->ce->name),
3814
52
    zend_get_unmangled_property_name(prop1->name),
3815
52
    ZSTR_VAL(type1_str),
3816
52
    ZSTR_VAL(prop2->ce->name),
3817
52
    zend_get_unmangled_property_name(prop2->name),
3818
52
    ZSTR_VAL(type2_str)
3819
52
  );
3820
52
  zend_string_release(type1_str);
3821
52
  zend_string_release(type2_str);
3822
52
}
3823
3824
/* 1: valid, 0: invalid, -1: may be valid after type coercion */
3825
static zend_always_inline int i_zend_verify_type_assignable_zval(
3826
44.7k
    const zend_property_info *info, const zval *zv, bool strict) {
3827
44.7k
  zend_type type = info->type;
3828
44.7k
  uint32_t type_mask;
3829
44.7k
  uint8_t zv_type = Z_TYPE_P(zv);
3830
3831
44.7k
  if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(type, zv_type))) {
3832
25.6k
    return 1;
3833
25.6k
  }
3834
3835
19.0k
  if (ZEND_TYPE_IS_COMPLEX(type) && zv_type == IS_OBJECT
3836
19.0k
      && zend_check_and_resolve_property_or_class_constant_class_type(info->ce, info->type, Z_OBJCE_P(zv))) {
3837
18.2k
    return 1;
3838
18.2k
  }
3839
3840
755
  type_mask = ZEND_TYPE_FULL_MASK(type);
3841
755
  ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC)));
3842
3843
  /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
3844
755
  if (strict) {
3845
28
    if ((type_mask & MAY_BE_DOUBLE) && zv_type == IS_LONG) {
3846
0
      return -1;
3847
0
    }
3848
28
    return 0;
3849
28
  }
3850
3851
  /* NULL may be accepted only by nullable hints (this is already checked) */
3852
727
  if (zv_type == IS_NULL) {
3853
124
    return 0;
3854
124
  }
3855
3856
  /* Does not contain any type to which a coercion is possible */
3857
603
  if (!(type_mask & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING))
3858
603
      && (type_mask & MAY_BE_BOOL) != MAY_BE_BOOL) {
3859
209
    return 0;
3860
209
  }
3861
3862
  /* Coercion may be necessary, check separately */
3863
394
  return -1;
3864
603
}
3865
3866
ZEND_API bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference *ref, zval *zv, bool strict)
3867
1.70k
{
3868
1.70k
  const zend_property_info *prop;
3869
3870
  /* The value must satisfy each property type, and coerce to the same value for each property
3871
   * type. Remember the first coerced type and value we've seen for this purpose. */
3872
1.70k
  const zend_property_info *first_prop = NULL;
3873
1.70k
  zval coerced_value;
3874
1.70k
  ZVAL_UNDEF(&coerced_value);
3875
3876
1.70k
  ZEND_ASSERT(Z_TYPE_P(zv) != IS_REFERENCE);
3877
5.45k
  ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3878
5.45k
    int result = i_zend_verify_type_assignable_zval(prop, zv, strict);
3879
5.45k
    if (result == 0) {
3880
436
type_error:
3881
436
      zend_throw_ref_type_error_zval(prop, zv);
3882
436
      zval_ptr_dtor(&coerced_value);
3883
436
      return 0;
3884
305
    }
3885
3886
1.74k
    if (result < 0) {
3887
311
      if (!first_prop) {
3888
278
        first_prop = prop;
3889
278
        ZVAL_COPY(&coerced_value, zv);
3890
278
        if (!zend_verify_weak_scalar_type_hint(
3891
278
            ZEND_TYPE_FULL_MASK(prop->type), &coerced_value)) {
3892
131
          goto type_error;
3893
131
        }
3894
278
      } else if (Z_ISUNDEF(coerced_value)) {
3895
        /* A previous property did not require coercion, but this one does,
3896
         * so they are incompatible. */
3897
28
        goto conflicting_coercion_error;
3898
28
      } else {
3899
5
        zval tmp;
3900
5
        ZVAL_COPY(&tmp, zv);
3901
5
        if (!zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop->type), &tmp)) {
3902
0
          zval_ptr_dtor(&tmp);
3903
0
          goto type_error;
3904
0
        }
3905
5
        if (!zend_is_identical(&coerced_value, &tmp)) {
3906
0
          zval_ptr_dtor(&tmp);
3907
0
          goto conflicting_coercion_error;
3908
0
        }
3909
5
        zval_ptr_dtor(&tmp);
3910
5
      }
3911
1.43k
    } else {
3912
1.43k
      if (!first_prop) {
3913
1.20k
        first_prop = prop;
3914
1.20k
      } else if (!Z_ISUNDEF(coerced_value)) {
3915
        /* A previous property required coercion, but this one doesn't,
3916
         * so they are incompatible. */
3917
52
conflicting_coercion_error:
3918
52
        zend_throw_conflicting_coercion_error(first_prop, prop, zv);
3919
52
        zval_ptr_dtor(&coerced_value);
3920
52
        return 0;
3921
24
      }
3922
1.43k
    }
3923
1.74k
  } ZEND_REF_FOREACH_TYPE_SOURCES_END();
3924
3925
1.21k
  if (!Z_ISUNDEF(coerced_value)) {
3926
123
    zval_ptr_dtor(zv);
3927
123
    ZVAL_COPY_VALUE(zv, &coerced_value);
3928
123
  }
3929
3930
1.21k
  return 1;
3931
1.70k
}
3932
3933
861
static zend_always_inline void i_zval_ptr_dtor_noref(zval *zval_ptr) {
3934
861
  if (Z_REFCOUNTED_P(zval_ptr)) {
3935
321
    zend_refcounted *ref = Z_COUNTED_P(zval_ptr);
3936
321
    ZEND_ASSERT(Z_TYPE_P(zval_ptr) != IS_REFERENCE);
3937
321
    GC_DTOR_NO_REF(ref);
3938
321
  }
3939
861
}
3940
3941
ZEND_API zval* zend_assign_to_typed_ref_ex(zval *variable_ptr, zval *orig_value, uint8_t value_type, bool strict, zend_refcounted **garbage_ptr)
3942
1.32k
{
3943
1.32k
  bool ret;
3944
1.32k
  zval value;
3945
1.32k
  zend_refcounted *ref = NULL;
3946
3947
1.32k
  if (Z_ISREF_P(orig_value)) {
3948
0
    ref = Z_COUNTED_P(orig_value);
3949
0
    orig_value = Z_REFVAL_P(orig_value);
3950
0
  }
3951
3952
1.32k
  ZVAL_COPY(&value, orig_value);
3953
1.32k
  ret = zend_verify_ref_assignable_zval(Z_REF_P(variable_ptr), &value, strict);
3954
1.32k
  variable_ptr = Z_REFVAL_P(variable_ptr);
3955
1.32k
  if (EXPECTED(ret)) {
3956
889
    if (Z_REFCOUNTED_P(variable_ptr)) {
3957
252
      *garbage_ptr = Z_COUNTED_P(variable_ptr);
3958
252
    }
3959
889
    ZVAL_COPY_VALUE(variable_ptr, &value);
3960
889
  } else {
3961
440
    zval_ptr_dtor_nogc(&value);
3962
440
  }
3963
1.32k
  if (value_type & (IS_VAR|IS_TMP_VAR)) {
3964
861
    if (UNEXPECTED(ref)) {
3965
0
      if (UNEXPECTED(GC_DELREF(ref) == 0)) {
3966
0
        zval_ptr_dtor(orig_value);
3967
0
        efree_size(ref, sizeof(zend_reference));
3968
0
      }
3969
861
    } else {
3970
861
      i_zval_ptr_dtor_noref(orig_value);
3971
861
    }
3972
861
  }
3973
1.32k
  return variable_ptr;
3974
1.32k
}
3975
3976
ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, uint8_t value_type, bool strict)
3977
412
{
3978
412
  zend_refcounted *garbage = NULL;
3979
412
  zval *result = zend_assign_to_typed_ref_ex(variable_ptr, orig_value, value_type, strict, &garbage);
3980
412
  if (garbage) {
3981
9
    GC_DTOR_NO_REF(garbage);
3982
9
  }
3983
412
  return result;
3984
412
}
3985
3986
224k
ZEND_API bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref_ex(const zend_property_info *prop_info, zval *orig_val, bool strict, zend_verify_prop_assignable_by_ref_context context) {
3987
224k
  zval *val = orig_val;
3988
224k
  if (Z_ISREF_P(val) && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(val))) {
3989
42.6k
    int result;
3990
3991
42.6k
    val = Z_REFVAL_P(val);
3992
42.6k
    result = i_zend_verify_type_assignable_zval(prop_info, val, strict);
3993
42.6k
    if (result > 0) {
3994
42.5k
      return 1;
3995
42.5k
    }
3996
3997
139
    if (result < 0) {
3998
      /* This is definitely an error, but we still need to determined why: Either because
3999
       * the value is simply illegal for the type, or because or a conflicting coercion. */
4000
83
      zval tmp;
4001
83
      ZVAL_COPY(&tmp, val);
4002
83
      if (zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop_info->type), &tmp)) {
4003
83
        const zend_property_info *ref_prop = ZEND_REF_FIRST_SOURCE(Z_REF_P(orig_val));
4004
83
        zend_throw_ref_type_error_type(ref_prop, prop_info, val);
4005
83
        zval_ptr_dtor(&tmp);
4006
83
        return 0;
4007
83
      }
4008
0
      zval_ptr_dtor(&tmp);
4009
0
    }
4010
182k
  } else {
4011
182k
    ZVAL_DEREF(val);
4012
182k
    if (i_zend_check_property_type(prop_info, val, strict)) {
4013
182k
      return 1;
4014
182k
    }
4015
182k
  }
4016
4017
131
  if (EXPECTED(context == ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_ASSIGNMENT)) {
4018
116
    zend_verify_property_type_error(prop_info, val);
4019
116
  } else {
4020
15
    ZEND_ASSERT(context == ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_MAGIC_GET);
4021
15
    zend_magic_get_property_type_inconsistency_error(prop_info, val);
4022
15
  }
4023
4024
131
  return 0;
4025
131
}
4026
4027
224k
ZEND_API bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref(const zend_property_info *prop_info, zval *orig_val, bool strict) {
4028
224k
  return zend_verify_prop_assignable_by_ref_ex(prop_info, orig_val, strict, ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_ASSIGNMENT);
4029
224k
}
4030
4031
ZEND_API void ZEND_FASTCALL zend_ref_add_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
4032
45.3k
{
4033
45.3k
  zend_property_info_list *list;
4034
45.3k
  if (source_list->ptr == NULL) {
4035
2.74k
    source_list->ptr = prop;
4036
2.74k
    return;
4037
2.74k
  }
4038
4039
42.5k
  list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
4040
42.5k
  if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
4041
686
    list = emalloc(sizeof(zend_property_info_list) + (4 - 1) * sizeof(zend_property_info *));
4042
686
    list->ptr[0] = source_list->ptr;
4043
686
    list->num_allocated = 4;
4044
686
    list->num = 1;
4045
41.8k
  } else if (list->num_allocated == list->num) {
4046
1.00k
    list->num_allocated = list->num * 2;
4047
1.00k
    list = erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *));
4048
1.00k
  }
4049
4050
42.5k
  list->ptr[list->num++] = prop;
4051
42.5k
  source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(list);
4052
42.5k
}
4053
4054
ZEND_API void ZEND_FASTCALL zend_ref_del_type_source(zend_property_info_source_list *source_list, const zend_property_info *prop)
4055
45.3k
{
4056
45.3k
  zend_property_info_list *list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
4057
45.3k
  zend_property_info **ptr, **end;
4058
4059
45.3k
  ZEND_ASSERT(prop);
4060
45.3k
  if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
4061
2.05k
    ZEND_ASSERT(source_list->ptr == prop);
4062
2.05k
    source_list->ptr = NULL;
4063
2.05k
    return;
4064
2.05k
  }
4065
4066
43.2k
  if (list->num == 1) {
4067
686
    ZEND_ASSERT(*list->ptr == prop);
4068
686
    efree(list);
4069
686
    source_list->ptr = NULL;
4070
686
    return;
4071
686
  }
4072
4073
  /* Checking against end here to get a more graceful failure mode if we missed adding a type
4074
   * source at some point. */
4075
42.5k
  ptr = list->ptr;
4076
42.5k
  end = ptr + list->num;
4077
43.0k
  while (ptr < end && *ptr != prop) {
4078
476
    ptr++;
4079
476
  }
4080
42.5k
  ZEND_ASSERT(*ptr == prop);
4081
4082
  /* Copy the last list element into the deleted slot. */
4083
42.5k
  *ptr = list->ptr[--list->num];
4084
4085
42.5k
  if (list->num >= 4 && list->num * 4 == list->num_allocated) {
4086
727
    list->num_allocated = list->num * 2;
4087
727
    source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *)));
4088
727
  }
4089
42.5k
}
4090
4091
static zend_never_inline void zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)
4092
15
{
4093
15
  zval *result = EX_VAR(opline->result.var);
4094
4095
15
  switch (type) {
4096
10
    case BP_VAR_R:
4097
10
      if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
4098
10
        ZVAL_OBJ(result, Z_OBJ(EX(This)));
4099
10
        Z_ADDREF_P(result);
4100
10
      } else {
4101
0
        ZVAL_NULL(result);
4102
0
        zend_error_unchecked(E_WARNING, "Undefined variable $this");
4103
0
      }
4104
10
      break;
4105
0
    case BP_VAR_IS:
4106
0
      if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
4107
0
        ZVAL_OBJ(result, Z_OBJ(EX(This)));
4108
0
        Z_ADDREF_P(result);
4109
0
      } else {
4110
0
        ZVAL_NULL(result);
4111
0
      }
4112
0
      break;
4113
0
    case BP_VAR_RW:
4114
5
    case BP_VAR_W:
4115
5
      ZVAL_UNDEF(result);
4116
5
      zend_throw_error(NULL, "Cannot re-assign $this");
4117
5
      break;
4118
0
    case BP_VAR_UNSET:
4119
0
      ZVAL_UNDEF(result);
4120
0
      zend_throw_error(NULL, "Cannot unset $this");
4121
0
      break;
4122
15
    EMPTY_SWITCH_DEFAULT_CASE()
4123
15
  }
4124
15
}
4125
4126
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_clone_call(zend_function *clone, zend_class_entry *scope)
4127
0
{
4128
0
  zend_throw_error(NULL, "Call to %s %s::__clone() from %s%s",
4129
0
    zend_visibility_string(clone->common.fn_flags), ZSTR_VAL(clone->common.scope->name),
4130
0
    scope ? "scope " : "global scope",
4131
0
    scope ? ZSTR_VAL(scope->name) : ""
4132
0
  );
4133
0
}
4134
4135
#if ZEND_INTENSIVE_DEBUGGING
4136
4137
#define CHECK_SYMBOL_TABLES()                         \
4138
  zend_hash_apply(&EG(symbol_table), zend_check_symbol);      \
4139
  if (&EG(symbol_table)!=EX(symbol_table)) {              \
4140
    zend_hash_apply(EX(symbol_table), zend_check_symbol); \
4141
  }
4142
4143
static void zend_check_symbol(zval *pz)
4144
{
4145
  if (Z_TYPE_P(pz) == IS_INDIRECT) {
4146
    pz = Z_INDIRECT_P(pz);
4147
  }
4148
  if (Z_TYPE_P(pz) > 10) {
4149
    fprintf(stderr, "Warning!  %x has invalid type!\n", *pz);
4150
/* See http://support.microsoft.com/kb/190351 */
4151
#ifdef ZEND_WIN32
4152
    fflush(stderr);
4153
#endif
4154
  } else if (Z_TYPE_P(pz) == IS_ARRAY) {
4155
    zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol);
4156
  } else if (Z_TYPE_P(pz) == IS_OBJECT) {
4157
    /* OBJ-TBI - doesn't support new object model! */
4158
    zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol);
4159
  }
4160
}
4161
4162
4163
#else
4164
#define CHECK_SYMBOL_TABLES()
4165
#endif
4166
4167
ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value)
4168
1.32M
{
4169
1.32M
  execute_data->func->internal_function.handler(execute_data, return_value);
4170
1.32M
}
4171
4172
ZEND_API void zend_clean_and_cache_symbol_table(zend_array *symbol_table) /* {{{ */
4173
7.34k
{
4174
  /* Clean before putting into the cache, since clean could call dtors,
4175
   * which could use the cached hash. Also do this before the check for
4176
   * available cache slots, as those may be used by a dtor as well. */
4177
7.34k
  zend_symtable_clean(symbol_table);
4178
7.34k
  if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
4179
192
    zend_array_destroy(symbol_table);
4180
7.15k
  } else {
4181
7.15k
    *(EG(symtable_cache_ptr)++) = symbol_table;
4182
7.15k
  }
4183
7.34k
}
4184
/* }}} */
4185
4186
static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
4187
354k
{
4188
354k
  zval *cv = EX_VAR_NUM(0);
4189
354k
  int count = EX(func)->op_array.last_var;
4190
1.03M
  while (EXPECTED(count != 0)) {
4191
678k
    i_zval_ptr_dtor(cv);
4192
678k
    cv++;
4193
678k
    count--;
4194
678k
  }
4195
354k
}
4196
/* }}} */
4197
4198
ZEND_API void ZEND_FASTCALL zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
4199
4.94k
{
4200
4.94k
  i_free_compiled_variables(execute_data);
4201
4.94k
}
4202
/* }}} */
4203
4204
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_fcall_interrupt(zend_execute_data *call)
4205
0
{
4206
0
  zend_atomic_bool_store_ex(&EG(vm_interrupt), false);
4207
0
  if (zend_atomic_bool_load_ex(&EG(timed_out))) {
4208
0
    zend_timeout();
4209
0
  } else if (zend_interrupt_function) {
4210
0
    zend_interrupt_function(call);
4211
0
  }
4212
0
}
4213
4214
1.83M
#define ZEND_VM_INTERRUPT_CHECK() do { \
4215
1.83M
    if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
4216
0
      ZEND_VM_INTERRUPT(); \
4217
0
    } \
4218
1.83M
  } while (0)
4219
4220
141k
#define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \
4221
141k
    if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
4222
0
      ZEND_VM_LOOP_INTERRUPT(); \
4223
0
    } \
4224
141k
  } while (0)
4225
4226
1.24M
#define ZEND_VM_FCALL_INTERRUPT_CHECK(call) do { \
4227
1.24M
    if (UNEXPECTED(zend_atomic_bool_load_ex(&EG(vm_interrupt)))) { \
4228
0
      zend_fcall_interrupt(call); \
4229
0
    } \
4230
1.24M
  } while (0)
4231
4232
/*
4233
 * Stack Frame Layout (the whole stack frame is allocated at once)
4234
 * ==================
4235
 *
4236
 *                             +========================================+
4237
 * EG(current_execute_data) -> | zend_execute_data                      |
4238
 *                             +----------------------------------------+
4239
 *     EX_VAR_NUM(0) --------> | VAR[0] = ARG[1]                        |
4240
 *                             | ...                                    |
4241
 *                             | VAR[op_array->num_args-1] = ARG[N]     |
4242
 *                             | ...                                    |
4243
 *                             | VAR[op_array->last_var-1]              |
4244
 *                             | VAR[op_array->last_var] = TMP[0]       |
4245
 *                             | ...                                    |
4246
 *                             | VAR[op_array->last_var+op_array->T-1]  |
4247
 *                             | ARG[N+1] (extra_args)                  |
4248
 *                             | ...                                    |
4249
 *                             +----------------------------------------+
4250
 */
4251
4252
/* zend_copy_extra_args is used when the actually passed number of arguments
4253
 * (EX_NUM_ARGS) is greater than what the function defined (op_array->num_args).
4254
 *
4255
 * The extra arguments will be copied into the call frame after all the compiled variables.
4256
 *
4257
 * If there are extra arguments copied, a flag "ZEND_CALL_FREE_EXTRA_ARGS" will be set
4258
 * on the zend_execute_data, and when the executor leaves the function, the
4259
 * args will be freed in zend_leave_helper.
4260
 */
4261
static zend_never_inline void zend_copy_extra_args(EXECUTE_DATA_D)
4262
6.24k
{
4263
6.24k
  zend_op_array *op_array = &EX(func)->op_array;
4264
6.24k
  uint32_t first_extra_arg = op_array->num_args;
4265
6.24k
  uint32_t num_args = EX_NUM_ARGS();
4266
6.24k
  zval *src;
4267
6.24k
  size_t delta;
4268
6.24k
  uint32_t count;
4269
6.24k
  uint32_t type_flags = 0;
4270
4271
6.24k
  if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
4272
    /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
4273
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4274
    opline += first_extra_arg;
4275
#else
4276
6.10k
    EX(opline) += first_extra_arg;
4277
6.10k
#endif
4278
4279
6.10k
  }
4280
4281
  /* move extra args into separate array after all CV and TMP vars */
4282
6.24k
  src = EX_VAR_NUM(num_args - 1);
4283
6.24k
  delta = op_array->last_var + op_array->T - first_extra_arg;
4284
6.24k
  count = num_args - first_extra_arg;
4285
6.24k
  if (EXPECTED(delta != 0)) {
4286
3.97k
    delta *= sizeof(zval);
4287
261k
    do {
4288
261k
      type_flags |= Z_TYPE_INFO_P(src);
4289
261k
      ZVAL_COPY_VALUE((zval*)(((char*)src) + delta), src);
4290
261k
      ZVAL_UNDEF(src);
4291
261k
      src--;
4292
261k
    } while (--count);
4293
3.97k
    if (Z_TYPE_INFO_REFCOUNTED(type_flags)) {
4294
2.18k
      ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
4295
2.18k
    }
4296
3.97k
  } else {
4297
988k
    do {
4298
988k
      if (Z_REFCOUNTED_P(src)) {
4299
665
        ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
4300
665
        break;
4301
665
      }
4302
988k
      src--;
4303
988k
    } while (--count);
4304
2.26k
  }
4305
6.24k
}
4306
4307
static zend_always_inline void zend_init_cvs(uint32_t first, uint32_t last EXECUTE_DATA_DC)
4308
382k
{
4309
382k
  if (EXPECTED(first < last)) {
4310
307k
    uint32_t count = last - first;
4311
307k
    zval *var = EX_VAR_NUM(first);
4312
4313
2.48M
    do {
4314
2.48M
      ZVAL_UNDEF(var);
4315
2.48M
      var++;
4316
2.48M
    } while (--count);
4317
307k
  }
4318
382k
}
4319
4320
static zend_always_inline void i_init_func_execute_data(zend_op_array *op_array, zval *return_value, bool may_be_trampoline EXECUTE_DATA_DC) /* {{{ */
4321
382k
{
4322
382k
  uint32_t first_extra_arg, num_args;
4323
382k
  ZEND_ASSERT(EX(func) == (zend_function*)op_array);
4324
4325
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4326
  opline = op_array->opcodes;
4327
#else
4328
382k
  EX(opline) = op_array->opcodes;
4329
382k
#endif
4330
382k
  EX(call) = NULL;
4331
382k
  EX(return_value) = return_value;
4332
4333
  /* Handle arguments */
4334
382k
  first_extra_arg = op_array->num_args;
4335
382k
  num_args = EX_NUM_ARGS();
4336
382k
  if (UNEXPECTED(num_args > first_extra_arg)) {
4337
6.45k
    if (!may_be_trampoline || EXPECTED(!(op_array->fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE))) {
4338
6.24k
      zend_copy_extra_args(EXECUTE_DATA_C);
4339
6.24k
    }
4340
375k
  } else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
4341
    /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
4342
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4343
    opline += num_args;
4344
#else
4345
364k
    EX(opline) += num_args;
4346
364k
#endif
4347
364k
  }
4348
4349
  /* Initialize CV variables (skip arguments) */
4350
382k
  zend_init_cvs(num_args, op_array->last_var EXECUTE_DATA_CC);
4351
4352
382k
  EX(run_time_cache) = RUN_TIME_CACHE(op_array);
4353
4354
382k
  EG(current_execute_data) = execute_data;
4355
382k
}
4356
/* }}} */
4357
4358
static zend_always_inline void init_func_run_time_cache_i(zend_op_array *op_array) /* {{{ */
4359
32.3k
{
4360
32.3k
  void **run_time_cache;
4361
4362
32.3k
  ZEND_ASSERT(RUN_TIME_CACHE(op_array) == NULL);
4363
32.3k
  run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
4364
32.3k
  memset(run_time_cache, 0, op_array->cache_size);
4365
32.3k
  ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
4366
32.3k
}
4367
/* }}} */
4368
4369
static zend_never_inline void ZEND_FASTCALL init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
4370
31.7k
{
4371
31.7k
  init_func_run_time_cache_i(op_array);
4372
31.7k
}
4373
/* }}} */
4374
4375
ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function(zend_string *name) /* {{{ */
4376
98.0k
{
4377
98.0k
  zval *zv = zend_hash_find(EG(function_table), name);
4378
4379
98.0k
  if (EXPECTED(zv != NULL)) {
4380
94.3k
    zend_function *fbc = Z_FUNC_P(zv);
4381
4382
94.3k
    if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4383
535
      init_func_run_time_cache_i(&fbc->op_array);
4384
535
    }
4385
94.3k
    return fbc;
4386
94.3k
  }
4387
3.69k
  return NULL;
4388
98.0k
} /* }}} */
4389
4390
ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name, size_t len) /* {{{ */
4391
13
{
4392
13
  zval *zv = zend_hash_str_find(EG(function_table), name, len);
4393
4394
13
  if (EXPECTED(zv != NULL)) {
4395
10
    zend_function *fbc = Z_FUNC_P(zv);
4396
4397
10
    if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4398
0
      init_func_run_time_cache_i(&fbc->op_array);
4399
0
    }
4400
10
    return fbc;
4401
10
  }
4402
3
  return NULL;
4403
13
} /* }}} */
4404
4405
ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
4406
0
{
4407
0
  if (!RUN_TIME_CACHE(op_array)) {
4408
0
    init_func_run_time_cache_i(op_array);
4409
0
  }
4410
0
} /* }}} */
4411
4412
static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4413
171k
{
4414
171k
  ZEND_ASSERT(EX(func) == (zend_function*)op_array);
4415
4416
171k
  EX(opline) = op_array->opcodes;
4417
171k
  EX(call) = NULL;
4418
171k
  EX(return_value) = return_value;
4419
4420
171k
  if (op_array->last_var) {
4421
145k
    zend_attach_symbol_table(execute_data);
4422
145k
  }
4423
4424
171k
  if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
4425
170k
    void *ptr;
4426
4427
170k
    ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
4428
170k
    ptr = emalloc(op_array->cache_size);
4429
170k
    ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
4430
170k
    memset(ptr, 0, op_array->cache_size);
4431
170k
  }
4432
171k
  EX(run_time_cache) = RUN_TIME_CACHE(op_array);
4433
4434
171k
  EG(current_execute_data) = execute_data;
4435
171k
}
4436
/* }}} */
4437
4438
ZEND_API void zend_init_func_execute_data(zend_execute_data *ex, zend_op_array *op_array, zval *return_value) /* {{{ */
4439
312k
{
4440
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4441
  zend_execute_data *orig_execute_data = execute_data;
4442
#endif
4443
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4444
  const zend_op *orig_opline = opline;
4445
#endif
4446
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4447
  execute_data = ex;
4448
#else
4449
312k
  zend_execute_data *execute_data = ex;
4450
312k
#endif
4451
4452
312k
  EX(prev_execute_data) = EG(current_execute_data);
4453
312k
  if (!RUN_TIME_CACHE(op_array)) {
4454
7.85k
    init_func_run_time_cache(op_array);
4455
7.85k
  }
4456
312k
  i_init_func_execute_data(op_array, return_value, 1 EXECUTE_DATA_CC);
4457
4458
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4459
  EX(opline) = opline;
4460
  opline = orig_opline;
4461
#endif
4462
#if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4463
  execute_data = orig_execute_data;
4464
#endif
4465
312k
}
4466
/* }}} */
4467
4468
ZEND_API void zend_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4469
0
{
4470
0
  EX(prev_execute_data) = EG(current_execute_data);
4471
0
  i_init_code_execute_data(execute_data, op_array, return_value);
4472
0
}
4473
/* }}} */
4474
4475
ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
4476
0
{
4477
0
  if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
4478
0
    zend_init_code_execute_data(execute_data, op_array, return_value);
4479
0
  } else {
4480
0
    zend_init_func_execute_data(execute_data, op_array, return_value);
4481
0
  }
4482
0
}
4483
/* }}} */
4484
4485
zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
4486
57
{
4487
57
  zend_execute_data *new_call;
4488
57
  int used_stack = (EG(vm_stack_top) - (zval*)call) + additional_args;
4489
4490
  /* copy call frame into new stack segment */
4491
57
  new_call = zend_vm_stack_extend(used_stack * sizeof(zval));
4492
57
  *new_call = *call;
4493
57
  ZEND_ADD_CALL_FLAG(new_call, ZEND_CALL_ALLOCATED);
4494
4495
57
  if (passed_args) {
4496
7
    zval *src = ZEND_CALL_ARG(call, 1);
4497
7
    zval *dst = ZEND_CALL_ARG(new_call, 1);
4498
70.0k
    do {
4499
70.0k
      ZVAL_COPY_VALUE(dst, src);
4500
70.0k
      passed_args--;
4501
70.0k
      src++;
4502
70.0k
      dst++;
4503
70.0k
    } while (passed_args);
4504
7
  }
4505
4506
  /* delete old call_frame from previous stack segment */
4507
57
  EG(vm_stack)->prev->top = (zval*)call;
4508
4509
  /* delete previous stack segment if it became empty */
4510
57
  if (UNEXPECTED(EG(vm_stack)->prev->top == ZEND_VM_STACK_ELEMENTS(EG(vm_stack)->prev))) {
4511
0
    zend_vm_stack r = EG(vm_stack)->prev;
4512
4513
0
    EG(vm_stack)->prev = r->prev;
4514
0
    efree(r);
4515
0
  }
4516
4517
57
  return new_call;
4518
57
}
4519
/* }}} */
4520
4521
static zend_always_inline zend_generator *zend_get_running_generator(EXECUTE_DATA_D) /* {{{ */
4522
7.43k
{
4523
  /* The generator object is stored in EX(return_value) */
4524
7.43k
  zend_generator *generator = (zend_generator *) EX(return_value);
4525
  /* However control may currently be delegated to another generator.
4526
   * That's the one we're interested in. */
4527
7.43k
  return generator;
4528
7.43k
}
4529
/* }}} */
4530
4531
ZEND_API void zend_unfinished_calls_gc(zend_execute_data *execute_data, zend_execute_data *call, uint32_t op_num, zend_get_gc_buffer *buf) /* {{{ */
4532
325
{
4533
325
  zend_op *opline = EX(func)->op_array.opcodes + op_num;
4534
325
  int level;
4535
325
  int do_exit;
4536
325
  uint32_t num_args;
4537
4538
325
  if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
4539
325
    opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
4540
325
    opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
4541
325
    opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
4542
325
    opline->opcode == ZEND_INIT_USER_CALL ||
4543
325
    opline->opcode == ZEND_INIT_METHOD_CALL ||
4544
325
    opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
4545
325
    opline->opcode == ZEND_NEW)) {
4546
0
    ZEND_ASSERT(op_num);
4547
0
    opline--;
4548
0
  }
4549
4550
363
  do {
4551
    /* find the number of actually passed arguments */
4552
363
    level = 0;
4553
363
    do_exit = 0;
4554
363
    num_args = ZEND_CALL_NUM_ARGS(call);
4555
956
    do {
4556
956
      switch (opline->opcode) {
4557
85
        case ZEND_DO_FCALL:
4558
85
        case ZEND_DO_ICALL:
4559
139
        case ZEND_DO_UCALL:
4560
139
        case ZEND_DO_FCALL_BY_NAME:
4561
139
        case ZEND_CALLABLE_CONVERT:
4562
139
          level++;
4563
139
          break;
4564
246
        case ZEND_INIT_FCALL:
4565
246
        case ZEND_INIT_FCALL_BY_NAME:
4566
246
        case ZEND_INIT_NS_FCALL_BY_NAME:
4567
272
        case ZEND_INIT_DYNAMIC_CALL:
4568
272
        case ZEND_INIT_USER_CALL:
4569
308
        case ZEND_INIT_METHOD_CALL:
4570
318
        case ZEND_INIT_STATIC_METHOD_CALL:
4571
358
        case ZEND_NEW:
4572
358
          if (level == 0) {
4573
219
            num_args = 0;
4574
219
            do_exit = 1;
4575
219
          }
4576
358
          level--;
4577
358
          break;
4578
29
        case ZEND_SEND_VAL:
4579
39
        case ZEND_SEND_VAL_EX:
4580
69
        case ZEND_SEND_VAR:
4581
173
        case ZEND_SEND_VAR_EX:
4582
173
        case ZEND_SEND_FUNC_ARG:
4583
173
        case ZEND_SEND_REF:
4584
173
        case ZEND_SEND_VAR_NO_REF:
4585
173
        case ZEND_SEND_VAR_NO_REF_EX:
4586
173
        case ZEND_SEND_USER:
4587
173
          if (level == 0) {
4588
            /* For named args, the number of arguments is up to date. */
4589
144
            if (opline->op2_type != IS_CONST) {
4590
82
              num_args = opline->op2.num;
4591
82
            }
4592
144
            do_exit = 1;
4593
144
          }
4594
173
          break;
4595
0
        case ZEND_SEND_ARRAY:
4596
0
        case ZEND_SEND_UNPACK:
4597
0
        case ZEND_CHECK_UNDEF_ARGS:
4598
0
          if (level == 0) {
4599
0
            do_exit = 1;
4600
0
          }
4601
0
          break;
4602
956
      }
4603
956
      if (!do_exit) {
4604
593
        opline--;
4605
593
      }
4606
956
    } while (!do_exit);
4607
363
    if (call->prev_execute_data) {
4608
      /* skip current call region */
4609
38
      level = 0;
4610
38
      do_exit = 0;
4611
58
      do {
4612
58
        switch (opline->opcode) {
4613
0
          case ZEND_DO_FCALL:
4614
0
          case ZEND_DO_ICALL:
4615
0
          case ZEND_DO_UCALL:
4616
0
          case ZEND_DO_FCALL_BY_NAME:
4617
0
          case ZEND_CALLABLE_CONVERT:
4618
0
            level++;
4619
0
            break;
4620
32
          case ZEND_INIT_FCALL:
4621
32
          case ZEND_INIT_FCALL_BY_NAME:
4622
32
          case ZEND_INIT_NS_FCALL_BY_NAME:
4623
32
          case ZEND_INIT_DYNAMIC_CALL:
4624
32
          case ZEND_INIT_USER_CALL:
4625
38
          case ZEND_INIT_METHOD_CALL:
4626
38
          case ZEND_INIT_STATIC_METHOD_CALL:
4627
38
          case ZEND_NEW:
4628
38
            if (level == 0) {
4629
38
              do_exit = 1;
4630
38
            }
4631
38
            level--;
4632
38
            break;
4633
58
        }
4634
58
        opline--;
4635
58
      } while (!do_exit);
4636
38
    }
4637
4638
363
    if (EXPECTED(num_args > 0)) {
4639
82
      zval *p = ZEND_CALL_ARG(call, 1);
4640
82
      do {
4641
82
        zend_get_gc_buffer_add_zval(buf, p);
4642
82
        p++;
4643
82
      } while (--num_args);
4644
82
    }
4645
363
    if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
4646
62
      zend_get_gc_buffer_add_obj(buf, Z_OBJ(call->This));
4647
62
    }
4648
363
    if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4649
62
      zval *val;
4650
186
      ZEND_HASH_FOREACH_VAL(call->extra_named_params, val) {
4651
186
        zend_get_gc_buffer_add_zval(buf, val);
4652
186
      } ZEND_HASH_FOREACH_END();
4653
62
    }
4654
363
    if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
4655
26
      zend_get_gc_buffer_add_obj(buf, ZEND_CLOSURE_OBJECT(call->func));
4656
26
    }
4657
4658
363
    call = call->prev_execute_data;
4659
363
  } while (call);
4660
325
}
4661
/* }}} */
4662
4663
static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
4664
923k
{
4665
923k
  if (UNEXPECTED(EX(call))) {
4666
6.41k
    zend_execute_data *call = EX(call);
4667
6.41k
    zend_op *opline = EX(func)->op_array.opcodes + op_num;
4668
6.41k
    int level;
4669
6.41k
    int do_exit;
4670
4671
6.41k
    if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
4672
6.41k
      opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
4673
6.41k
      opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
4674
6.41k
      opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
4675
6.41k
      opline->opcode == ZEND_INIT_USER_CALL ||
4676
6.41k
      opline->opcode == ZEND_INIT_METHOD_CALL ||
4677
6.41k
      opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
4678
6.41k
      opline->opcode == ZEND_INIT_PARENT_PROPERTY_HOOK_CALL ||
4679
6.41k
      opline->opcode == ZEND_NEW)) {
4680
791
      ZEND_ASSERT(op_num);
4681
791
      opline--;
4682
791
    }
4683
4684
7.30k
    do {
4685
      /* If the exception was thrown during a function call there might be
4686
       * arguments pushed to the stack that have to be dtor'ed. */
4687
4688
      /* find the number of actually passed arguments */
4689
7.30k
      level = 0;
4690
7.30k
      do_exit = 0;
4691
20.9k
      do {
4692
20.9k
        switch (opline->opcode) {
4693
1.99k
          case ZEND_DO_FCALL:
4694
1.99k
          case ZEND_DO_ICALL:
4695
2.40k
          case ZEND_DO_UCALL:
4696
2.40k
          case ZEND_DO_FCALL_BY_NAME:
4697
2.41k
          case ZEND_CALLABLE_CONVERT:
4698
2.41k
            level++;
4699
2.41k
            break;
4700
6.85k
          case ZEND_INIT_FCALL:
4701
6.87k
          case ZEND_INIT_FCALL_BY_NAME:
4702
6.99k
          case ZEND_INIT_NS_FCALL_BY_NAME:
4703
7.35k
          case ZEND_INIT_DYNAMIC_CALL:
4704
7.36k
          case ZEND_INIT_USER_CALL:
4705
8.12k
          case ZEND_INIT_METHOD_CALL:
4706
8.29k
          case ZEND_INIT_STATIC_METHOD_CALL:
4707
8.30k
          case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL:
4708
8.64k
          case ZEND_NEW:
4709
8.64k
            if (level == 0) {
4710
6.22k
              ZEND_CALL_NUM_ARGS(call) = 0;
4711
6.22k
              do_exit = 1;
4712
6.22k
            }
4713
8.64k
            level--;
4714
8.64k
            break;
4715
1.11k
          case ZEND_SEND_VAL:
4716
1.57k
          case ZEND_SEND_VAL_EX:
4717
2.12k
          case ZEND_SEND_VAR:
4718
2.40k
          case ZEND_SEND_VAR_EX:
4719
2.41k
          case ZEND_SEND_FUNC_ARG:
4720
2.43k
          case ZEND_SEND_REF:
4721
2.43k
          case ZEND_SEND_VAR_NO_REF:
4722
2.49k
          case ZEND_SEND_VAR_NO_REF_EX:
4723
2.50k
          case ZEND_SEND_USER:
4724
2.50k
            if (level == 0) {
4725
              /* For named args, the number of arguments is up to date. */
4726
816
              if (opline->op2_type != IS_CONST) {
4727
686
                ZEND_CALL_NUM_ARGS(call) = opline->op2.num;
4728
686
              }
4729
816
              do_exit = 1;
4730
816
            }
4731
2.50k
            break;
4732
91
          case ZEND_SEND_ARRAY:
4733
221
          case ZEND_SEND_UNPACK:
4734
277
          case ZEND_CHECK_UNDEF_ARGS:
4735
277
            if (level == 0) {
4736
265
              do_exit = 1;
4737
265
            }
4738
277
            break;
4739
20.9k
        }
4740
20.9k
        if (!do_exit) {
4741
13.6k
          opline--;
4742
13.6k
        }
4743
20.9k
      } while (!do_exit);
4744
7.30k
      if (call->prev_execute_data) {
4745
        /* skip current call region */
4746
891
        level = 0;
4747
891
        do_exit = 0;
4748
1.71k
        do {
4749
1.71k
          switch (opline->opcode) {
4750
2
            case ZEND_DO_FCALL:
4751
2
            case ZEND_DO_ICALL:
4752
2
            case ZEND_DO_UCALL:
4753
2
            case ZEND_DO_FCALL_BY_NAME:
4754
2
            case ZEND_CALLABLE_CONVERT:
4755
2
              level++;
4756
2
              break;
4757
405
            case ZEND_INIT_FCALL:
4758
405
            case ZEND_INIT_FCALL_BY_NAME:
4759
415
            case ZEND_INIT_NS_FCALL_BY_NAME:
4760
420
            case ZEND_INIT_DYNAMIC_CALL:
4761
420
            case ZEND_INIT_USER_CALL:
4762
841
            case ZEND_INIT_METHOD_CALL:
4763
851
            case ZEND_INIT_STATIC_METHOD_CALL:
4764
854
            case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL:
4765
893
            case ZEND_NEW:
4766
893
              if (level == 0) {
4767
891
                do_exit = 1;
4768
891
              }
4769
893
              level--;
4770
893
              break;
4771
1.71k
          }
4772
1.71k
          opline--;
4773
1.71k
        } while (!do_exit);
4774
891
      }
4775
4776
7.30k
      zend_vm_stack_free_args(EX(call));
4777
4778
7.30k
      if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
4779
773
        OBJ_RELEASE(Z_OBJ(call->This));
4780
773
      }
4781
7.30k
      if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4782
26
        zend_free_extra_named_params(call->extra_named_params);
4783
26
      }
4784
7.30k
      if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
4785
50
        zend_object_release(ZEND_CLOSURE_OBJECT(call->func));
4786
7.25k
      } else if (call->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4787
38
        zend_string_release_ex(call->func->common.function_name, 0);
4788
38
        zend_free_trampoline(call->func);
4789
38
      }
4790
4791
7.30k
      EX(call) = call->prev_execute_data;
4792
7.30k
      zend_vm_stack_free_call_frame(call);
4793
7.30k
      call = EX(call);
4794
7.30k
    } while (call);
4795
6.41k
  }
4796
923k
}
4797
/* }}} */
4798
4799
static const zend_live_range *find_live_range(const zend_op_array *op_array, uint32_t op_num, uint32_t var_num) /* {{{ */
4800
32
{
4801
32
  int i;
4802
84
  for (i = 0; i < op_array->last_live_range; i++) {
4803
84
    const zend_live_range *range = &op_array->live_range[i];
4804
84
    if (op_num >= range->start && op_num < range->end
4805
84
        && var_num == (range->var & ~ZEND_LIVE_MASK)) {
4806
32
      return range;
4807
32
    }
4808
84
  }
4809
0
  return NULL;
4810
32
}
4811
/* }}} */
4812
4813
static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
4814
924k
{
4815
924k
  int i;
4816
4817
3.20M
  for (i = 0; i < EX(func)->op_array.last_live_range; i++) {
4818
2.88M
    const zend_live_range *range = &EX(func)->op_array.live_range[i];
4819
2.88M
    if (range->start > op_num) {
4820
      /* further blocks will not be relevant... */
4821
605k
      break;
4822
2.27M
    } else if (op_num < range->end) {
4823
881k
      if (!catch_op_num || catch_op_num >= range->end) {
4824
608k
        uint32_t kind = range->var & ZEND_LIVE_MASK;
4825
608k
        uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
4826
608k
        zval *var = EX_VAR(var_num);
4827
4828
608k
        if (kind == ZEND_LIVE_TMPVAR) {
4829
2.22k
          zval_ptr_dtor_nogc(var);
4830
606k
        } else if (kind == ZEND_LIVE_NEW) {
4831
603k
          zend_object *obj;
4832
603k
          ZEND_ASSERT(Z_TYPE_P(var) == IS_OBJECT);
4833
603k
          obj = Z_OBJ_P(var);
4834
603k
          zend_object_store_ctor_failed(obj);
4835
603k
          OBJ_RELEASE(obj);
4836
603k
        } else if (kind == ZEND_LIVE_LOOP) {
4837
883
          if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
4838
54
            zend_hash_iterator_del(Z_FE_ITER_P(var));
4839
54
          }
4840
883
          zval_ptr_dtor_nogc(var);
4841
1.92k
        } else if (kind == ZEND_LIVE_ROPE) {
4842
368
          zend_string **rope = (zend_string **)var;
4843
368
          zend_op *last = EX(func)->op_array.opcodes + op_num;
4844
479
          while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT)
4845
479
              || last->result.var != var_num) {
4846
111
            ZEND_ASSERT(last >= EX(func)->op_array.opcodes);
4847
111
            last--;
4848
111
          }
4849
368
          if (last->opcode == ZEND_ROPE_INIT) {
4850
34
            zend_string_release_ex(*rope, 0);
4851
334
          } else {
4852
334
            int j = last->extended_value;
4853
3.73k
            do {
4854
3.73k
              zend_string_release_ex(rope[j], 0);
4855
3.73k
            } while (j--);
4856
334
          }
4857
1.55k
        } else if (kind == ZEND_LIVE_SILENCE) {
4858
          /* restore previous error_reporting value */
4859
1.55k
          if (E_HAS_ONLY_FATAL_ERRORS(EG(error_reporting))
4860
1.55k
              && !E_HAS_ONLY_FATAL_ERRORS(Z_LVAL_P(var))) {
4861
33
            EG(error_reporting) = Z_LVAL_P(var);
4862
33
          }
4863
1.55k
        }
4864
608k
      }
4865
881k
    }
4866
2.88M
  }
4867
924k
}
4868
/* }}} */
4869
4870
1.23k
ZEND_API void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
4871
1.23k
  cleanup_unfinished_calls(execute_data, op_num);
4872
1.23k
  cleanup_live_vars(execute_data, op_num, catch_op_num);
4873
1.23k
}
4874
4875
ZEND_API ZEND_ATTRIBUTE_DEPRECATED HashTable *zend_unfinished_execution_gc(zend_execute_data *execute_data, zend_execute_data *call, zend_get_gc_buffer *gc_buffer)
4876
0
{
4877
0
  return zend_unfinished_execution_gc_ex(execute_data, call, gc_buffer, false);
4878
0
}
4879
4880
ZEND_API HashTable *zend_unfinished_execution_gc_ex(zend_execute_data *execute_data, zend_execute_data *call, zend_get_gc_buffer *gc_buffer, bool suspended_by_yield)
4881
5.84k
{
4882
5.84k
  if (!EX(func)) {
4883
123
    return NULL;
4884
123
  }
4885
4886
5.71k
  if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
4887
364
    zend_get_gc_buffer_add_obj(gc_buffer, Z_OBJ(execute_data->This));
4888
364
  }
4889
4890
5.71k
  if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
4891
1.19k
    zend_get_gc_buffer_add_obj(gc_buffer, ZEND_CLOSURE_OBJECT(EX(func)));
4892
1.19k
  }
4893
4894
5.71k
  if (!ZEND_USER_CODE(EX(func)->common.type)) {
4895
2.12k
    ZEND_ASSERT(!(EX_CALL_INFO() & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_HAS_EXTRA_NAMED_PARAMS)));
4896
2.12k
    return NULL;
4897
2.12k
  }
4898
4899
3.59k
  zend_op_array *op_array = &EX(func)->op_array;
4900
4901
3.59k
  if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
4902
3.31k
    uint32_t i, num_cvs = EX(func)->op_array.last_var;
4903
7.39k
    for (i = 0; i < num_cvs; i++) {
4904
4.08k
      zend_get_gc_buffer_add_zval(gc_buffer, EX_VAR_NUM(i));
4905
4.08k
    }
4906
3.31k
  }
4907
4908
3.59k
  if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
4909
56
    zval *zv = EX_VAR_NUM(op_array->last_var + op_array->T);
4910
56
    zval *end = zv + (EX_NUM_ARGS() - op_array->num_args);
4911
112
    while (zv != end) {
4912
56
      zend_get_gc_buffer_add_zval(gc_buffer, zv++);
4913
56
    }
4914
56
  }
4915
4916
3.59k
  if (EX_CALL_INFO() & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4917
0
    zval extra_named_params;
4918
0
    ZVAL_ARR(&extra_named_params, EX(extra_named_params));
4919
0
    zend_get_gc_buffer_add_zval(gc_buffer, &extra_named_params);
4920
0
  }
4921
4922
3.59k
  uint32_t op_num;
4923
3.59k
  if (UNEXPECTED(execute_data->opline->opcode == ZEND_HANDLE_EXCEPTION)) {
4924
10
    op_num = EG(opline_before_exception) - op_array->opcodes;
4925
3.58k
  } else {
4926
3.58k
    op_num = execute_data->opline - op_array->opcodes;
4927
3.58k
  }
4928
3.59k
  ZEND_ASSERT(op_num < op_array->last);
4929
4930
3.59k
  if (call) {
4931
325
    zend_unfinished_calls_gc(execute_data, call, op_num, gc_buffer);
4932
325
  }
4933
4934
3.59k
  if (execute_data->opline != op_array->opcodes) {
4935
3.47k
    uint32_t i;
4936
4.46k
    for (i = 0; i < op_array->last_live_range; i++) {
4937
1.11k
      const zend_live_range *range = &op_array->live_range[i];
4938
1.11k
      if (range->start > op_num) {
4939
117
        break;
4940
993
      } else if (op_num < range->end) {
4941
128
        uint32_t kind = range->var & ZEND_LIVE_MASK;
4942
128
        uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
4943
128
        zval *var = EX_VAR(var_num);
4944
128
        if (kind == ZEND_LIVE_TMPVAR || kind == ZEND_LIVE_LOOP) {
4945
98
          zend_get_gc_buffer_add_zval(gc_buffer, var);
4946
98
        }
4947
128
      }
4948
1.11k
    }
4949
3.47k
  }
4950
4951
3.59k
  if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
4952
282
    return execute_data->symbol_table;
4953
3.31k
  } else {
4954
3.31k
    return NULL;
4955
3.31k
  }
4956
3.59k
}
4957
4958
#if ZEND_VM_SPEC
4959
static void zend_swap_operands(zend_op *op) /* {{{ */
4960
10.0k
{
4961
10.0k
  znode_op     tmp;
4962
10.0k
  uint8_t   tmp_type;
4963
4964
10.0k
  tmp          = op->op1;
4965
10.0k
  tmp_type     = op->op1_type;
4966
10.0k
  op->op1      = op->op2;
4967
10.0k
  op->op1_type = op->op2_type;
4968
10.0k
  op->op2      = tmp;
4969
10.0k
  op->op2_type = tmp_type;
4970
4971
#ifdef ZEND_VERIFY_TYPE_INFERENCE
4972
  uint32_t tmp_info;
4973
  tmp_info = op->op1_use_type;
4974
  op->op1_use_type = op->op2_use_type;
4975
  op->op2_use_type = tmp_info;
4976
  tmp_info = op->op1_def_type;
4977
  op->op1_def_type = op->op2_def_type;
4978
  op->op2_def_type = tmp_info;
4979
#endif
4980
10.0k
}
4981
/* }}} */
4982
#endif
4983
4984
static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_string *function, uint32_t num_args) /* {{{ */
4985
1.33k
{
4986
1.33k
  zend_function *fbc;
4987
1.33k
  zval *func;
4988
1.33k
  zend_class_entry *called_scope;
4989
1.33k
  zend_string *lcname;
4990
1.33k
  const char *colon;
4991
4992
1.33k
  if ((colon = zend_memrchr(ZSTR_VAL(function), ':', ZSTR_LEN(function))) != NULL &&
4993
1.33k
    colon > ZSTR_VAL(function) &&
4994
1.33k
    *(colon-1) == ':'
4995
1.33k
  ) {
4996
130
    zend_string *mname;
4997
130
    size_t cname_length = colon - ZSTR_VAL(function) - 1;
4998
130
    size_t mname_length = ZSTR_LEN(function) - cname_length - (sizeof("::") - 1);
4999
5000
130
    lcname = zend_string_init(ZSTR_VAL(function), cname_length, 0);
5001
5002
130
    called_scope = zend_fetch_class_by_name(lcname, NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
5003
130
    if (UNEXPECTED(called_scope == NULL)) {
5004
35
      zend_string_release_ex(lcname, 0);
5005
35
      return NULL;
5006
35
    }
5007
5008
95
    mname = zend_string_init(ZSTR_VAL(function) + (cname_length + sizeof("::") - 1), mname_length, 0);
5009
5010
95
    if (called_scope->get_static_method) {
5011
0
      fbc = called_scope->get_static_method(called_scope, mname);
5012
95
    } else {
5013
95
      fbc = zend_std_get_static_method(called_scope, mname, NULL);
5014
95
    }
5015
95
    if (UNEXPECTED(fbc == NULL)) {
5016
7
      if (EXPECTED(!EG(exception))) {
5017
7
        zend_undefined_method(called_scope, mname);
5018
7
      }
5019
7
      zend_string_release_ex(lcname, 0);
5020
7
      zend_string_release_ex(mname, 0);
5021
7
      return NULL;
5022
7
    }
5023
5024
88
    zend_string_release_ex(lcname, 0);
5025
88
    zend_string_release_ex(mname, 0);
5026
5027
88
    if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
5028
14
      zend_non_static_method_call(fbc);
5029
14
      if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
5030
9
        zend_string_release_ex(fbc->common.function_name, 0);
5031
9
        zend_free_trampoline(fbc);
5032
9
      }
5033
14
      return NULL;
5034
14
    }
5035
74
    if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
5036
34
      init_func_run_time_cache(&fbc->op_array);
5037
34
    }
5038
1.20k
  } else {
5039
1.20k
    if (ZSTR_VAL(function)[0] == '\\') {
5040
5
      lcname = zend_string_alloc(ZSTR_LEN(function) - 1, 0);
5041
5
      zend_str_tolower_copy(ZSTR_VAL(lcname), ZSTR_VAL(function) + 1, ZSTR_LEN(function) - 1);
5042
1.20k
    } else {
5043
1.20k
      lcname = zend_string_tolower(function);
5044
1.20k
    }
5045
1.20k
    if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {
5046
107
      zend_throw_error(NULL, "Call to undefined function %s()", ZSTR_VAL(function));
5047
107
      zend_string_release_ex(lcname, 0);
5048
107
      return NULL;
5049
107
    }
5050
1.10k
    zend_string_release_ex(lcname, 0);
5051
5052
1.10k
    fbc = Z_FUNC_P(func);
5053
1.10k
    if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
5054
231
      init_func_run_time_cache(&fbc->op_array);
5055
231
    }
5056
1.10k
    called_scope = NULL;
5057
1.10k
  }
5058
5059
1.17k
  return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC,
5060
1.17k
    fbc, num_args, called_scope);
5061
1.33k
}
5062
/* }}} */
5063
5064
static zend_never_inline zend_execute_data *zend_init_dynamic_call_object(zend_object *function, uint32_t num_args) /* {{{ */
5065
5.38k
{
5066
5.38k
  zend_function *fbc;
5067
5.38k
  void *object_or_called_scope;
5068
5.38k
  zend_class_entry *called_scope;
5069
5.38k
  zend_object *object;
5070
5.38k
  uint32_t call_info;
5071
5072
5.38k
  if (EXPECTED(function->handlers->get_closure) &&
5073
5.38k
      EXPECTED(function->handlers->get_closure(function, &called_scope, &fbc, &object, 0) == SUCCESS)) {
5074
5075
5.37k
    object_or_called_scope = called_scope;
5076
5.37k
    if (EXPECTED(fbc->common.fn_flags & ZEND_ACC_CLOSURE)) {
5077
      /* Delay closure destruction until its invocation */
5078
5.20k
      GC_ADDREF(ZEND_CLOSURE_OBJECT(fbc));
5079
5.20k
      ZEND_ASSERT(ZEND_ACC_FAKE_CLOSURE == ZEND_CALL_FAKE_CLOSURE);
5080
5.20k
      call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC | ZEND_CALL_CLOSURE |
5081
5.20k
        (fbc->common.fn_flags & ZEND_ACC_FAKE_CLOSURE);
5082
5.20k
      if (object) {
5083
1.12k
        call_info |= ZEND_CALL_HAS_THIS;
5084
1.12k
        object_or_called_scope = object;
5085
1.12k
      }
5086
5.20k
    } else {
5087
168
      call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
5088
168
      if (object) {
5089
168
        call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
5090
168
        GC_ADDREF(object); /* For $this pointer */
5091
168
        object_or_called_scope = object;
5092
168
      }
5093
168
    }
5094
5.37k
  } else {
5095
13
    zend_throw_error(NULL, "Object of type %s is not callable", ZSTR_VAL(function->ce->name));
5096
13
    return NULL;
5097
13
  }
5098
5099
5.37k
  if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
5100
104
    init_func_run_time_cache(&fbc->op_array);
5101
104
  }
5102
5103
5.37k
  return zend_vm_stack_push_call_frame(call_info,
5104
5.37k
    fbc, num_args, object_or_called_scope);
5105
5.38k
}
5106
/* }}} */
5107
5108
static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_array *function, uint32_t num_args) /* {{{ */
5109
269
{
5110
269
  zend_function *fbc;
5111
269
  void *object_or_called_scope;
5112
269
  uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
5113
5114
269
  if (zend_hash_num_elements(function) == 2) {
5115
260
    zval *obj;
5116
260
    zval *method;
5117
260
    obj = zend_hash_index_find(function, 0);
5118
260
    method = zend_hash_index_find(function, 1);
5119
5120
260
    if (UNEXPECTED(!obj) || UNEXPECTED(!method)) {
5121
5
      zend_throw_error(NULL, "Array callback has to contain indices 0 and 1");
5122
5
      return NULL;
5123
5
    }
5124
5125
255
    ZVAL_DEREF(obj);
5126
255
    if (UNEXPECTED(Z_TYPE_P(obj) != IS_STRING) && UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
5127
7
      zend_throw_error(NULL, "First array member is not a valid class name or object");
5128
7
      return NULL;
5129
7
    }
5130
5131
248
    ZVAL_DEREF(method);
5132
248
    if (UNEXPECTED(Z_TYPE_P(method) != IS_STRING)) {
5133
0
      zend_throw_error(NULL, "Second array member is not a valid method");
5134
0
      return NULL;
5135
0
    }
5136
5137
248
    if (Z_TYPE_P(obj) == IS_STRING) {
5138
144
      zend_class_entry *called_scope = zend_fetch_class_by_name(Z_STR_P(obj), NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
5139
5140
144
      if (UNEXPECTED(called_scope == NULL)) {
5141
20
        return NULL;
5142
20
      }
5143
5144
124
      if (called_scope->get_static_method) {
5145
0
        fbc = called_scope->get_static_method(called_scope, Z_STR_P(method));
5146
124
      } else {
5147
124
        fbc = zend_std_get_static_method(called_scope, Z_STR_P(method), NULL);
5148
124
      }
5149
124
      if (UNEXPECTED(fbc == NULL)) {
5150
14
        if (EXPECTED(!EG(exception))) {
5151
14
          zend_undefined_method(called_scope, Z_STR_P(method));
5152
14
        }
5153
14
        return NULL;
5154
14
      }
5155
110
      if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
5156
14
        zend_non_static_method_call(fbc);
5157
14
        if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
5158
9
          zend_string_release_ex(fbc->common.function_name, 0);
5159
9
          zend_free_trampoline(fbc);
5160
9
        }
5161
14
        return NULL;
5162
14
      }
5163
96
      object_or_called_scope = called_scope;
5164
104
    } else {
5165
104
      zend_object *object = Z_OBJ_P(obj);
5166
5167
104
      fbc = Z_OBJ_HT_P(obj)->get_method(&object, Z_STR_P(method), NULL);
5168
104
      if (UNEXPECTED(fbc == NULL)) {
5169
8
        if (EXPECTED(!EG(exception))) {
5170
8
          zend_undefined_method(object->ce, Z_STR_P(method));
5171
8
        }
5172
8
        return NULL;
5173
8
      }
5174
5175
96
      if ((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
5176
28
        object_or_called_scope = object->ce;
5177
68
      } else {
5178
68
        call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
5179
68
        GC_ADDREF(object); /* For $this pointer */
5180
68
        object_or_called_scope = object;
5181
68
      }
5182
96
    }
5183
248
  } else {
5184
9
    zend_throw_error(NULL, "Array callback must have exactly two elements");
5185
9
    return NULL;
5186
9
  }
5187
5188
192
  if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
5189
62
    init_func_run_time_cache(&fbc->op_array);
5190
62
  }
5191
5192
192
  return zend_vm_stack_push_call_frame(call_info,
5193
192
    fbc, num_args, object_or_called_scope);
5194
269
}
5195
/* }}} */
5196
5197
121k
#define ZEND_FAKE_OP_ARRAY ((zend_op_array*)(intptr_t)-1)
5198
5199
static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval *inc_filename_zv, int type) /* {{{ */
5200
119k
{
5201
119k
  zend_op_array *new_op_array = NULL;
5202
119k
  zend_string *tmp_inc_filename;
5203
119k
  zend_string *inc_filename = zval_try_get_tmp_string(inc_filename_zv, &tmp_inc_filename);
5204
119k
  if (UNEXPECTED(!inc_filename)) {
5205
8
    return NULL;
5206
8
  }
5207
5208
119k
  switch (type) {
5209
14
    case ZEND_INCLUDE_ONCE:
5210
143
    case ZEND_REQUIRE_ONCE: {
5211
143
        zend_file_handle file_handle;
5212
143
        zend_string *resolved_path;
5213
5214
143
        resolved_path = zend_resolve_path(inc_filename);
5215
143
        if (EXPECTED(resolved_path)) {
5216
5
          if (zend_hash_exists(&EG(included_files), resolved_path)) {
5217
1
            new_op_array = ZEND_FAKE_OP_ARRAY;
5218
1
            zend_string_release_ex(resolved_path, 0);
5219
1
            break;
5220
1
          }
5221
138
        } else if (UNEXPECTED(EG(exception))) {
5222
19
          break;
5223
119
        } else if (UNEXPECTED(strlen(ZSTR_VAL(inc_filename)) != ZSTR_LEN(inc_filename))) {
5224
2
          zend_message_dispatcher(
5225
2
            (type == ZEND_INCLUDE_ONCE) ?
5226
2
              ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
5227
2
              ZSTR_VAL(inc_filename));
5228
2
          break;
5229
117
        } else {
5230
117
          resolved_path = zend_string_copy(inc_filename);
5231
117
        }
5232
5233
121
        zend_stream_init_filename_ex(&file_handle, resolved_path);
5234
121
        if (SUCCESS == zend_stream_open(&file_handle)) {
5235
5236
4
          if (!file_handle.opened_path) {
5237
0
            file_handle.opened_path = zend_string_copy(resolved_path);
5238
0
          }
5239
5240
4
          if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path)) {
5241
4
            new_op_array = zend_compile_file(&file_handle, (type==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE));
5242
4
          } else {
5243
0
            new_op_array = ZEND_FAKE_OP_ARRAY;
5244
0
          }
5245
117
        } else if (!EG(exception)) {
5246
112
          zend_message_dispatcher(
5247
112
            (type == ZEND_INCLUDE_ONCE) ?
5248
107
              ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
5249
112
              ZSTR_VAL(inc_filename));
5250
112
        }
5251
121
        zend_destroy_file_handle(&file_handle);
5252
121
        zend_string_release_ex(resolved_path, 0);
5253
121
      }
5254
0
      break;
5255
2.17k
    case ZEND_INCLUDE:
5256
115k
    case ZEND_REQUIRE:
5257
115k
      if (UNEXPECTED(strlen(ZSTR_VAL(inc_filename)) != ZSTR_LEN(inc_filename))) {
5258
255
        zend_message_dispatcher(
5259
255
          (type == ZEND_INCLUDE) ?
5260
248
            ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
5261
255
            ZSTR_VAL(inc_filename));
5262
255
        break;
5263
255
      }
5264
115k
      new_op_array = compile_filename(type, inc_filename);
5265
115k
      break;
5266
4.00k
    case ZEND_EVAL: {
5267
4.00k
        char *eval_desc = zend_make_compiled_string_description("eval()'d code");
5268
4.00k
        new_op_array = zend_compile_string(inc_filename, eval_desc, ZEND_COMPILE_POSITION_AFTER_OPEN_TAG);
5269
4.00k
        efree(eval_desc);
5270
4.00k
      }
5271
4.00k
      break;
5272
119k
    EMPTY_SWITCH_DEFAULT_CASE()
5273
119k
  }
5274
5275
119k
  zend_tmp_string_release(tmp_inc_filename);
5276
119k
  return new_op_array;
5277
119k
}
5278
/* }}} */
5279
5280
static zend_never_inline bool ZEND_FASTCALL zend_fe_reset_iterator(zval *array_ptr, int by_ref OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5281
1.58k
{
5282
1.58k
  zend_class_entry *ce = Z_OBJCE_P(array_ptr);
5283
1.58k
  zend_object_iterator *iter = ce->get_iterator(ce, array_ptr, by_ref);
5284
1.58k
  bool is_empty;
5285
5286
1.58k
  if (UNEXPECTED(!iter) || UNEXPECTED(EG(exception))) {
5287
27
    if (iter) {
5288
0
      OBJ_RELEASE(&iter->std);
5289
0
    }
5290
27
    if (!EG(exception)) {
5291
0
      zend_throw_exception_ex(NULL, 0, "Object of type %s did not create an Iterator", ZSTR_VAL(ce->name));
5292
0
    }
5293
27
    ZVAL_UNDEF(EX_VAR(opline->result.var));
5294
27
    return 1;
5295
27
  }
5296
5297
1.55k
  iter->index = 0;
5298
1.55k
  if (iter->funcs->rewind) {
5299
1.55k
    iter->funcs->rewind(iter);
5300
1.55k
    if (UNEXPECTED(EG(exception) != NULL)) {
5301
138
      OBJ_RELEASE(&iter->std);
5302
138
      ZVAL_UNDEF(EX_VAR(opline->result.var));
5303
138
      return 1;
5304
138
    }
5305
1.55k
  }
5306
5307
1.41k
  is_empty = iter->funcs->valid(iter) != SUCCESS;
5308
5309
1.41k
  if (UNEXPECTED(EG(exception) != NULL)) {
5310
81
    OBJ_RELEASE(&iter->std);
5311
81
    ZVAL_UNDEF(EX_VAR(opline->result.var));
5312
81
    return 1;
5313
81
  }
5314
1.33k
  iter->index = -1; /* will be set to 0 before using next handler */
5315
5316
1.33k
  ZVAL_OBJ(EX_VAR(opline->result.var), &iter->std);
5317
1.33k
  Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
5318
5319
1.33k
  return is_empty;
5320
1.41k
}
5321
/* }}} */
5322
5323
static zend_always_inline zend_result _zend_quick_get_constant(
5324
    const zval *key, uint32_t flags, bool check_defined_only OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5325
33.5k
{
5326
33.5k
  zval *zv;
5327
33.5k
  zend_constant *c = NULL;
5328
5329
  /* null/true/false are resolved during compilation, so don't check for them here. */
5330
33.5k
  zv = zend_hash_find_known_hash(EG(zend_constants), Z_STR_P(key));
5331
33.5k
  if (zv) {
5332
1.38k
    c = (zend_constant*)Z_PTR_P(zv);
5333
32.1k
  } else if (flags & IS_CONSTANT_UNQUALIFIED_IN_NAMESPACE) {
5334
178
    key++;
5335
178
    zv = zend_hash_find_known_hash(EG(zend_constants), Z_STR_P(key));
5336
178
    if (zv) {
5337
60
      c = (zend_constant*)Z_PTR_P(zv);
5338
60
    }
5339
178
  }
5340
5341
33.5k
  if (!c) {
5342
32.1k
    if (!check_defined_only) {
5343
32.0k
      zend_throw_error(NULL, "Undefined constant \"%s\"", Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
5344
32.0k
      ZVAL_UNDEF(EX_VAR(opline->result.var));
5345
32.0k
    }
5346
32.1k
    return FAILURE;
5347
32.1k
  }
5348
5349
1.44k
  if (!check_defined_only) {
5350
1.42k
    ZVAL_COPY_OR_DUP(EX_VAR(opline->result.var), &c->value);
5351
1.42k
    if (ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED) {
5352
107
      if (!CONST_IS_RECURSIVE(c)) {
5353
107
        CONST_PROTECT_RECURSION(c);
5354
107
        zend_deprecated_constant(c, c->name);
5355
107
        CONST_UNPROTECT_RECURSION(c);
5356
107
      }
5357
107
      return SUCCESS;
5358
107
    }
5359
1.42k
  }
5360
5361
1.33k
  CACHE_PTR(opline->extended_value, c);
5362
1.33k
  return SUCCESS;
5363
1.44k
}
5364
/* }}} */
5365
5366
static zend_never_inline void ZEND_FASTCALL zend_quick_get_constant(
5367
    const zval *key, uint32_t flags OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5368
33.4k
{
5369
33.4k
  _zend_quick_get_constant(key, flags, 0 OPLINE_CC EXECUTE_DATA_CC);
5370
33.4k
} /* }}} */
5371
5372
static zend_never_inline zend_result ZEND_FASTCALL zend_quick_check_constant(
5373
    const zval *key OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
5374
69
{
5375
69
  return _zend_quick_get_constant(key, 0, 1 OPLINE_CC EXECUTE_DATA_CC);
5376
69
} /* }}} */
5377
5378
static zend_always_inline uint32_t zend_get_arg_offset_by_name(
5379
5.28k
    zend_function *fbc, zend_string *arg_name, void **cache_slot) {
5380
5.28k
  if (EXPECTED(*cache_slot == fbc)) {
5381
17
    return *(uintptr_t *)(cache_slot + 1);
5382
17
  }
5383
5384
  // TODO: Use a hash table?
5385
5.26k
  uint32_t num_args = fbc->common.num_args;
5386
5.26k
  if (EXPECTED(fbc->type == ZEND_USER_FUNCTION)
5387
5.26k
      || EXPECTED(fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO)) {
5388
13.6k
    for (uint32_t i = 0; i < num_args; i++) {
5389
11.1k
      zend_arg_info *arg_info = &fbc->op_array.arg_info[i];
5390
11.1k
      if (zend_string_equals(arg_name, arg_info->name)) {
5391
2.17k
        *cache_slot = fbc;
5392
2.17k
        *(uintptr_t *)(cache_slot + 1) = i;
5393
2.17k
        return i;
5394
2.17k
      }
5395
11.1k
    }
5396
4.69k
  } else {
5397
578
    ZEND_ASSERT(num_args == 0 || fbc->internal_function.arg_info);
5398
1.18k
    for (uint32_t i = 0; i < num_args; i++) {
5399
923
      zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
5400
923
      size_t len = strlen(arg_info->name);
5401
923
      if (zend_string_equals_cstr(arg_name, arg_info->name, len)) {
5402
315
        *cache_slot = fbc;
5403
315
        *(uintptr_t *)(cache_slot + 1) = i;
5404
315
        return i;
5405
315
      }
5406
923
    }
5407
578
  }
5408
5409
2.78k
  if (fbc->common.fn_flags & ZEND_ACC_VARIADIC) {
5410
2.69k
    *cache_slot = fbc;
5411
2.69k
    *(uintptr_t *)(cache_slot + 1) = fbc->common.num_args;
5412
2.69k
    return fbc->common.num_args;
5413
2.69k
  }
5414
5415
89
  return (uint32_t) -1;
5416
2.78k
}
5417
5418
zval * ZEND_FASTCALL zend_handle_named_arg(
5419
    zend_execute_data **call_ptr, zend_string *arg_name,
5420
4.04k
    uint32_t *arg_num_ptr, void **cache_slot) {
5421
4.04k
  zend_execute_data *call = *call_ptr;
5422
4.04k
  zend_function *fbc = call->func;
5423
4.04k
  uint32_t arg_offset = zend_get_arg_offset_by_name(fbc, arg_name, cache_slot);
5424
4.04k
  if (UNEXPECTED(arg_offset == (uint32_t) -1)) {
5425
86
    zend_throw_error(NULL, "Unknown named parameter $%s", ZSTR_VAL(arg_name));
5426
86
    return NULL;
5427
86
  }
5428
5429
3.95k
  zval *arg;
5430
3.95k
  if (UNEXPECTED(arg_offset == fbc->common.num_args)) {
5431
    /* Unknown named parameter that will be collected into a variadic. */
5432
1.63k
    if (!(ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS)) {
5433
1.16k
      ZEND_ADD_CALL_FLAG(call, ZEND_CALL_HAS_EXTRA_NAMED_PARAMS);
5434
1.16k
      call->extra_named_params = zend_new_array(0);
5435
1.16k
    }
5436
5437
1.63k
    arg = zend_hash_add_empty_element(call->extra_named_params, arg_name);
5438
1.63k
    if (!arg) {
5439
0
      zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
5440
0
        ZSTR_VAL(arg_name));
5441
0
      return NULL;
5442
0
    }
5443
1.63k
    *arg_num_ptr = arg_offset + 1;
5444
1.63k
    return arg;
5445
1.63k
  }
5446
5447
2.32k
  uint32_t current_num_args = ZEND_CALL_NUM_ARGS(call);
5448
  // TODO: We may wish to optimize the arg_offset == current_num_args case,
5449
  // which is probably common (if the named parameters are in order of declaration).
5450
2.32k
  if (arg_offset >= current_num_args) {
5451
1.48k
    uint32_t new_num_args = arg_offset + 1;
5452
1.48k
    ZEND_CALL_NUM_ARGS(call) = new_num_args;
5453
5454
1.48k
    uint32_t num_extra_args = new_num_args - current_num_args;
5455
1.48k
    zend_vm_stack_extend_call_frame(call_ptr, current_num_args, num_extra_args);
5456
1.48k
    call = *call_ptr;
5457
5458
1.48k
    arg = ZEND_CALL_VAR_NUM(call, arg_offset);
5459
1.48k
    if (num_extra_args > 1) {
5460
917
      zval *zv = ZEND_CALL_VAR_NUM(call, current_num_args);
5461
3.34k
      do {
5462
3.34k
        ZVAL_UNDEF(zv);
5463
3.34k
        zv++;
5464
3.34k
      } while (zv != arg);
5465
917
      ZEND_ADD_CALL_FLAG(call, ZEND_CALL_MAY_HAVE_UNDEF);
5466
917
    }
5467
1.48k
  } else {
5468
845
    arg = ZEND_CALL_VAR_NUM(call, arg_offset);
5469
845
    if (UNEXPECTED(!Z_ISUNDEF_P(arg))) {
5470
71
      zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
5471
71
        ZSTR_VAL(arg_name));
5472
71
      return NULL;
5473
71
    }
5474
845
  }
5475
5476
2.25k
  *arg_num_ptr = arg_offset + 1;
5477
2.25k
  return arg;
5478
2.32k
}
5479
5480
88
static zend_execute_data *start_fake_frame(zend_execute_data *call, const zend_op *opline) {
5481
88
  zend_execute_data *old_prev_execute_data = call->prev_execute_data;
5482
88
  call->prev_execute_data = EG(current_execute_data);
5483
88
  call->opline = opline;
5484
88
  EG(current_execute_data) = call;
5485
88
  return old_prev_execute_data;
5486
88
}
5487
5488
88
static void end_fake_frame(zend_execute_data *call, zend_execute_data *old_prev_execute_data) {
5489
88
  zend_execute_data *prev_execute_data = call->prev_execute_data;
5490
88
  EG(current_execute_data) = prev_execute_data;
5491
88
  call->prev_execute_data = old_prev_execute_data;
5492
88
  if (UNEXPECTED(EG(exception)) && ZEND_USER_CODE(prev_execute_data->func->common.type)) {
5493
44
    zend_rethrow_exception(prev_execute_data);
5494
44
  }
5495
88
}
5496
5497
872
ZEND_API zend_result ZEND_FASTCALL zend_handle_undef_args(zend_execute_data *call) {
5498
872
  zend_function *fbc = call->func;
5499
872
  if (fbc->type == ZEND_USER_FUNCTION) {
5500
675
    zend_op_array *op_array = &fbc->op_array;
5501
675
    uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
5502
4.93k
    for (uint32_t i = 0; i < num_args; i++) {
5503
4.29k
      zval *arg = ZEND_CALL_VAR_NUM(call, i);
5504
4.29k
      if (!Z_ISUNDEF_P(arg)) {
5505
2.10k
        continue;
5506
2.10k
      }
5507
5508
2.18k
      zend_op *opline = &op_array->opcodes[i];
5509
2.18k
      if (EXPECTED(opline->opcode == ZEND_RECV_INIT)) {
5510
2.16k
        zval *default_value = RT_CONSTANT(opline, opline->op2);
5511
2.16k
        if (Z_OPT_TYPE_P(default_value) == IS_CONSTANT_AST) {
5512
19
          if (UNEXPECTED(!RUN_TIME_CACHE(op_array))) {
5513
5
            init_func_run_time_cache(op_array);
5514
5
          }
5515
5516
19
          void *run_time_cache = RUN_TIME_CACHE(op_array);
5517
19
          zval *cache_val =
5518
19
            (zval *) ((char *) run_time_cache + Z_CACHE_SLOT_P(default_value));
5519
5520
19
          if (Z_TYPE_P(cache_val) != IS_UNDEF) {
5521
            /* We keep in cache only not refcounted values */
5522
0
            ZVAL_COPY_VALUE(arg, cache_val);
5523
19
          } else {
5524
            /* Update constant inside a temporary zval, to make sure the CONSTANT_AST
5525
             * value is not accessible through back traces. */
5526
19
            zval tmp;
5527
19
            ZVAL_COPY(&tmp, default_value);
5528
19
            zend_execute_data *old = start_fake_frame(call, opline);
5529
19
            zend_result ret = zval_update_constant_ex(&tmp, fbc->op_array.scope);
5530
19
            end_fake_frame(call, old);
5531
19
            if (UNEXPECTED(ret == FAILURE)) {
5532
9
              zval_ptr_dtor_nogc(&tmp);
5533
9
              return FAILURE;
5534
9
            }
5535
10
            ZVAL_COPY_VALUE(arg, &tmp);
5536
10
            if (!Z_REFCOUNTED(tmp)) {
5537
10
              ZVAL_COPY_VALUE(cache_val, &tmp);
5538
10
            }
5539
10
          }
5540
2.14k
        } else {
5541
2.14k
          ZVAL_COPY(arg, default_value);
5542
2.14k
        }
5543
2.16k
      } else {
5544
24
        ZEND_ASSERT(opline->opcode == ZEND_RECV);
5545
24
        zend_execute_data *old = start_fake_frame(call, opline);
5546
24
        zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
5547
24
        end_fake_frame(call, old);
5548
24
        return FAILURE;
5549
24
      }
5550
2.18k
    }
5551
5552
642
    return SUCCESS;
5553
675
  } else {
5554
197
    if (fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO) {
5555
      /* Magic function, let it deal with it. */
5556
7
      return SUCCESS;
5557
7
    }
5558
5559
190
    uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
5560
637
    for (uint32_t i = 0; i < num_args; i++) {
5561
474
      zval *arg = ZEND_CALL_VAR_NUM(call, i);
5562
474
      if (!Z_ISUNDEF_P(arg)) {
5563
319
        continue;
5564
319
      }
5565
5566
155
      zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
5567
155
      if (i < fbc->common.required_num_args) {
5568
17
        zend_execute_data *old = start_fake_frame(call, NULL);
5569
17
        zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
5570
17
        end_fake_frame(call, old);
5571
17
        return FAILURE;
5572
17
      }
5573
5574
138
      zval default_value;
5575
138
      if (zend_get_default_from_internal_arg_info(&default_value, arg_info) == FAILURE) {
5576
10
        zend_execute_data *old = start_fake_frame(call, NULL);
5577
10
        zend_argument_error(zend_ce_argument_count_error, i + 1,
5578
10
          "must be passed explicitly, because the default value is not known");
5579
10
        end_fake_frame(call, old);
5580
10
        return FAILURE;
5581
10
      }
5582
5583
128
      if (Z_TYPE(default_value) == IS_CONSTANT_AST) {
5584
18
        zend_execute_data *old = start_fake_frame(call, NULL);
5585
18
        zend_result ret = zval_update_constant_ex(&default_value, fbc->common.scope);
5586
18
        end_fake_frame(call, old);
5587
18
        if (ret == FAILURE) {
5588
0
          return FAILURE;
5589
0
        }
5590
18
      }
5591
5592
128
      ZVAL_COPY_VALUE(arg, &default_value);
5593
128
      if (ZEND_ARG_SEND_MODE(arg_info) & ZEND_SEND_BY_REF) {
5594
0
        ZVAL_NEW_REF(arg, arg);
5595
0
      }
5596
128
    }
5597
190
  }
5598
5599
163
  return SUCCESS;
5600
872
}
5601
5602
ZEND_API void ZEND_FASTCALL zend_free_extra_named_params(zend_array *extra_named_params)
5603
443
{
5604
  /* Extra named params may be shared. */
5605
443
  zend_array_release(extra_named_params);
5606
443
}
5607
5608
#if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
5609
/* Special versions of functions that sets EX(opline) before calling zend_vm_stack_extend() */
5610
static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame_ex(uint32_t used_stack, uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
5611
{
5612
  zend_execute_data *call = (zend_execute_data*)EG(vm_stack_top);
5613
5614
  ZEND_ASSERT_VM_STACK_GLOBAL;
5615
5616
  if (UNEXPECTED(used_stack > (size_t)(((char*)EG(vm_stack_end)) - (char*)call))) {
5617
    EX(opline) = opline; /* this is the only difference */
5618
    call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
5619
    ZEND_ASSERT_VM_STACK_GLOBAL;
5620
    zend_vm_init_call_frame(call, call_info | ZEND_CALL_ALLOCATED, func, num_args, object_or_called_scope);
5621
    return call;
5622
  } else {
5623
    EG(vm_stack_top) = (zval*)((char*)call + used_stack);
5624
    zend_vm_init_call_frame(call, call_info, func, num_args, object_or_called_scope);
5625
    return call;
5626
  }
5627
} /* }}} */
5628
5629
static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame(uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
5630
{
5631
  uint32_t used_stack = zend_vm_calc_used_stack(num_args, func);
5632
5633
  return _zend_vm_stack_push_call_frame_ex(used_stack, call_info,
5634
    func, num_args, object_or_called_scope);
5635
} /* }}} */
5636
#else
5637
463k
# define _zend_vm_stack_push_call_frame_ex zend_vm_stack_push_call_frame_ex
5638
3.10k
# define _zend_vm_stack_push_call_frame    zend_vm_stack_push_call_frame
5639
#endif
5640
5641
#ifdef ZEND_VM_TRACE_HANDLERS
5642
# include "zend_vm_trace_handlers.h"
5643
#elif defined(ZEND_VM_TRACE_LINES)
5644
# include "zend_vm_trace_lines.h"
5645
#elif defined(ZEND_VM_TRACE_MAP)
5646
# include "zend_vm_trace_map.h"
5647
#elif defined(ZEND_VERIFY_TYPE_INFERENCE)
5648
# include "zend_verify_type_inference.h"
5649
#endif
5650
5651
#define ZEND_VM_NEXT_OPCODE_EX(check_exception, skip) \
5652
13.6M
  CHECK_SYMBOL_TABLES() \
5653
13.7M
  if (check_exception) { \
5654
8.64M
    OPLINE = EX(opline) + (skip); \
5655
8.64M
  } else { \
5656
5.10M
    ZEND_ASSERT(!EG(exception)); \
5657
5.10M
    OPLINE = opline + (skip); \
5658
5.00M
  } \
5659
13.6M
  ZEND_VM_CONTINUE()
5660
5661
#define ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION() \
5662
8.26M
  ZEND_VM_NEXT_OPCODE_EX(1, 1)
5663
5664
#define ZEND_VM_NEXT_OPCODE() \
5665
5.63M
  ZEND_VM_NEXT_OPCODE_EX(0, 1)
5666
5667
#define ZEND_VM_SET_NEXT_OPCODE(new_op) \
5668
356k
  CHECK_SYMBOL_TABLES() \
5669
356k
  OPLINE = new_op
5670
5671
#define ZEND_VM_SET_OPCODE_NO_INTERRUPT(new_op) \
5672
3.10M
  CHECK_SYMBOL_TABLES() \
5673
3.10M
  OPLINE = new_op
5674
5675
#define ZEND_VM_SET_OPCODE(new_op) \
5676
1.83M
  ZEND_VM_SET_OPCODE_NO_INTERRUPT(new_op); \
5677
1.83M
  ZEND_VM_INTERRUPT_CHECK()
5678
5679
#define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
5680
12.9k
  ZEND_VM_SET_OPCODE(ZEND_OFFSET_TO_OPLINE(opline, offset))
5681
5682
1.43M
#define ZEND_VM_JMP_EX(new_op, check_exception) do { \
5683
1.43M
    if (check_exception && UNEXPECTED(EG(exception))) { \
5684
2
      HANDLE_EXCEPTION(); \
5685
2
    } \
5686
1.43M
    ZEND_VM_SET_OPCODE(new_op); \
5687
1.43M
    ZEND_VM_CONTINUE(); \
5688
1.43M
  } while (0)
5689
5690
#define ZEND_VM_JMP(new_op) \
5691
66.3k
  ZEND_VM_JMP_EX(new_op, 1)
5692
5693
#define ZEND_VM_INC_OPCODE() \
5694
1.71k
  OPLINE++
5695
5696
5697
#define ZEND_VM_REPEATABLE_OPCODE \
5698
5.44k
  do {
5699
#define ZEND_VM_REPEAT_OPCODE(_opcode) \
5700
5.44k
  } while (UNEXPECTED((++opline)->opcode == _opcode)); \
5701
4.50k
  OPLINE = opline; \
5702
4.68k
  ZEND_VM_CONTINUE()
5703
353k
#define ZEND_VM_SMART_BRANCH(_result, _check) do { \
5704
353k
    if ((_check) && UNEXPECTED(EG(exception))) { \
5705
158
      OPLINE = EX(opline); \
5706
353k
    } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5707
248k
      if (_result) { \
5708
234k
        ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5709
234k
      } else { \
5710
13.2k
        ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5711
13.2k
      } \
5712
248k
    } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5713
26.4k
      if (!(_result)) { \
5714
4.24k
        ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5715
22.2k
      } else { \
5716
22.2k
        ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5717
22.2k
      } \
5718
79.1k
    } else { \
5719
79.1k
      ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
5720
79.1k
      ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5721
79.1k
    } \
5722
353k
    ZEND_VM_CONTINUE(); \
5723
353k
  } while (0)
5724
3.39k
#define ZEND_VM_SMART_BRANCH_JMPZ(_result, _check) do { \
5725
3.39k
    if ((_check) && UNEXPECTED(EG(exception))) { \
5726
0
      OPLINE = EX(opline); \
5727
3.39k
    } else if (_result) { \
5728
1.41k
      ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5729
1.97k
    } else { \
5730
1.97k
      ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5731
1.97k
    } \
5732
3.39k
    ZEND_VM_CONTINUE(); \
5733
3.39k
  } while (0)
5734
15.2k
#define ZEND_VM_SMART_BRANCH_JMPNZ(_result, _check) do { \
5735
15.2k
    if ((_check) && UNEXPECTED(EG(exception))) { \
5736
0
      OPLINE = EX(opline); \
5737
15.2k
    } else if (!(_result)) { \
5738
1.18k
      ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5739
14.0k
    } else { \
5740
14.0k
      ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5741
14.0k
    } \
5742
15.2k
    ZEND_VM_CONTINUE(); \
5743
15.2k
  } while (0)
5744
1.38k
#define ZEND_VM_SMART_BRANCH_NONE(_result, _check) do { \
5745
1.38k
    ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
5746
1.38k
    ZEND_VM_NEXT_OPCODE_EX(_check, 1); \
5747
1.38k
    ZEND_VM_CONTINUE(); \
5748
1.38k
  } while (0)
5749
107
#define ZEND_VM_SMART_BRANCH_TRUE() do { \
5750
107
    if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5751
0
      ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5752
107
    } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5753
90
      ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5754
90
    } else { \
5755
17
      ZVAL_TRUE(EX_VAR(opline->result.var)); \
5756
17
      ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5757
17
    } \
5758
107
    ZEND_VM_CONTINUE(); \
5759
107
  } while (0)
5760
27.4k
#define ZEND_VM_SMART_BRANCH_TRUE_JMPZ() do { \
5761
27.4k
    ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5762
27.4k
    ZEND_VM_CONTINUE(); \
5763
27.4k
  } while (0)
5764
334k
#define ZEND_VM_SMART_BRANCH_TRUE_JMPNZ() do { \
5765
334k
    ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5766
334k
    ZEND_VM_CONTINUE(); \
5767
334k
  } while (0)
5768
5.44k
#define ZEND_VM_SMART_BRANCH_TRUE_NONE() do { \
5769
5.44k
    ZVAL_TRUE(EX_VAR(opline->result.var)); \
5770
5.44k
    ZEND_VM_NEXT_OPCODE(); \
5771
5.44k
  } while (0)
5772
1.93k
#define ZEND_VM_SMART_BRANCH_FALSE() do { \
5773
1.93k
    if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
5774
314
      ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5775
1.62k
    } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
5776
807
      ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5777
816
    } else { \
5778
816
      ZVAL_FALSE(EX_VAR(opline->result.var)); \
5779
816
      ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
5780
816
    } \
5781
1.93k
    ZEND_VM_CONTINUE(); \
5782
1.93k
  } while (0)
5783
4.31k
#define ZEND_VM_SMART_BRANCH_FALSE_JMPZ() do { \
5784
4.31k
    ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5785
4.31k
    ZEND_VM_CONTINUE(); \
5786
4.31k
  } while (0)
5787
7.51k
#define ZEND_VM_SMART_BRANCH_FALSE_JMPNZ() do { \
5788
7.51k
    ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5789
7.51k
    ZEND_VM_CONTINUE(); \
5790
7.51k
  } while (0)
5791
8.04k
#define ZEND_VM_SMART_BRANCH_FALSE_NONE() do { \
5792
8.04k
    ZVAL_FALSE(EX_VAR(opline->result.var)); \
5793
8.04k
    ZEND_VM_NEXT_OPCODE(); \
5794
8.04k
  } while (0)
5795
5796
#ifdef __GNUC__
5797
# define ZEND_VM_GUARD(name) __asm__("#" #name)
5798
#else
5799
# define ZEND_VM_GUARD(name)
5800
#endif
5801
5802
2.12k
#define UNDEF_RESULT() do { \
5803
2.12k
    if (opline->result_type & (IS_VAR | IS_TMP_VAR)) { \
5804
1.23k
      ZVAL_UNDEF(EX_VAR(opline->result.var)); \
5805
1.23k
    } \
5806
2.12k
  } while (0)
5807
5808
/* This callback disables optimization of "vm_stack_data" variable in VM */
5809
ZEND_API void (ZEND_FASTCALL *zend_touch_vm_stack_data)(void *vm_stack_data) = NULL;
5810
5811
#include "zend_vm_execute.h"
5812
5813
ZEND_API zend_result zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
5814
0
{
5815
0
  if (opcode != ZEND_USER_OPCODE) {
5816
0
    if (handler == NULL) {
5817
      /* restore the original handler */
5818
0
      zend_user_opcodes[opcode] = opcode;
5819
0
    } else {
5820
0
      zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
5821
0
    }
5822
0
    zend_user_opcode_handlers[opcode] = handler;
5823
0
    return SUCCESS;
5824
0
  }
5825
0
  return FAILURE;
5826
0
}
5827
5828
ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
5829
4.09k
{
5830
4.09k
  return zend_user_opcode_handlers[opcode];
5831
4.09k
}
5832
5833
ZEND_API zval *zend_get_zval_ptr(const zend_op *opline, int op_type, const znode_op *node, const zend_execute_data *execute_data)
5834
0
{
5835
0
  zval *ret;
5836
5837
0
  switch (op_type) {
5838
0
    case IS_CONST:
5839
0
      ret = RT_CONSTANT(opline, *node);
5840
0
      break;
5841
0
    case IS_TMP_VAR:
5842
0
    case IS_VAR:
5843
0
    case IS_CV:
5844
0
      ret = EX_VAR(node->var);
5845
0
      break;
5846
0
    default:
5847
0
      ret = NULL;
5848
0
      break;
5849
0
  }
5850
0
  return ret;
5851
0
}