Coverage Report

Created: 2026-06-13 07:01

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/zend_closures.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright © Zend Technologies Ltd., a subsidiary company of          |
6
   |     Perforce Software, Inc., and Contributors.                       |
7
   +----------------------------------------------------------------------+
8
   | This source file is subject to the Modified BSD License that is      |
9
   | bundled with this package in the file LICENSE, and is available      |
10
   | through the World Wide Web at <https://www.php.net/license/>.        |
11
   |                                                                      |
12
   | SPDX-License-Identifier: BSD-3-Clause                                |
13
   +----------------------------------------------------------------------+
14
   | Authors: Christian Seiler <chris_se@gmx.net>                         |
15
   |          Dmitry Stogov <dmitry@php.net>                              |
16
   |          Marcus Boerger <helly@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend.h"
21
#include "zend_API.h"
22
#include "zend_closures.h"
23
#include "zend_exceptions.h"
24
#include "zend_interfaces.h"
25
#include "zend_objects.h"
26
#include "zend_objects_API.h"
27
#include "zend_globals.h"
28
#include "zend_closures_arginfo.h"
29
30
typedef struct _zend_closure {
31
  zend_object       std;
32
  zend_function     func;
33
  zval              this_ptr;
34
  zend_class_entry *called_scope;
35
  zif_handler       orig_internal_handler;
36
} zend_closure;
37
38
/* non-static since it needs to be referenced */
39
ZEND_API zend_class_entry *zend_ce_closure;
40
static zend_object_handlers closure_handlers;
41
42
static zend_result zend_closure_get_closure(zend_object *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zend_object **obj_ptr, bool check_only);
43
44
ZEND_METHOD(Closure, __invoke) /* {{{ */
45
217
{
46
217
  zend_function *func = EX(func);
47
217
  zval *args;
48
217
  uint32_t num_args;
49
217
  HashTable *named_args;
50
51
651
  ZEND_PARSE_PARAMETERS_START(0, -1)
52
651
    Z_PARAM_VARIADIC_WITH_NAMED(args, num_args, named_args)
53
651
  ZEND_PARSE_PARAMETERS_END();
54
55
217
  zend_fcall_info_cache fcc = {
56
217
    .closure = Z_OBJ_P(ZEND_THIS),
57
217
  };
58
217
  zend_closure_get_closure(Z_OBJ_P(ZEND_THIS), &fcc.calling_scope, &fcc.function_handler, &fcc.object, false);
59
217
  fcc.called_scope = fcc.calling_scope;
60
217
  zend_call_known_fcc(&fcc, return_value, num_args, args, named_args);
61
62
  /* destruct the function also, then - we have allocated it in get_method */
63
217
  zend_string_release_ex(func->internal_function.function_name, 0);
64
217
  efree(func);
65
66
  /* Set the func pointer to NULL. Prior to PHP 8.3, this was only done for debug builds,
67
   * because debug builds check certain properties after the call and needed to know this
68
   * had been freed.
69
   * However, extensions can proxy zend_execute_internal, and it's a bit surprising to have
70
   * an invalid func pointer sitting on there, so this was changed in PHP 8.3.
71
   */
72
217
  execute_data->func = NULL;
73
217
}
74
/* }}} */
75
76
static bool zend_valid_closure_binding(
77
    zend_closure *closure, zval *newthis, zend_class_entry *scope) /* {{{ */
78
1.65k
{
79
1.65k
  zend_function *func = &closure->func;
80
1.65k
  bool is_fake_closure = (func->common.fn_flags & ZEND_ACC_FAKE_CLOSURE) != 0;
81
1.65k
  if (newthis) {
82
1.39k
    if (func->common.fn_flags & ZEND_ACC_STATIC) {
83
35
      zend_error(E_WARNING, "Cannot bind an instance to a static closure, this will be an error in PHP 9");
84
35
      return false;
85
35
    }
86
87
1.36k
    if (is_fake_closure && func->common.scope &&
88
132
        !instanceof_function(Z_OBJCE_P(newthis), func->common.scope)) {
89
      /* Binding incompatible $this to an internal method is not supported. */
90
14
      zend_error(E_WARNING, "Cannot bind method %s::%s() to object of class %s, this will be an error in PHP 9",
91
14
          ZSTR_VAL(func->common.scope->name),
92
14
          ZSTR_VAL(func->common.function_name),
93
14
          ZSTR_VAL(Z_OBJCE_P(newthis)->name));
94
14
      return false;
95
14
    }
96
1.36k
  } else if (is_fake_closure && func->common.scope
97
6
      && !(func->common.fn_flags & ZEND_ACC_STATIC)) {
98
6
    zend_error(E_WARNING, "Cannot unbind $this of method, this will be an error in PHP 9");
99
6
    return false;
100
254
  } else if (!is_fake_closure && !Z_ISUNDEF(closure->this_ptr)
101
38
      && (func->common.fn_flags & ZEND_ACC_USES_THIS)) {
102
33
    zend_error(E_WARNING, "Cannot unbind $this of closure using $this, this will be an error in PHP 9");
103
33
    return false;
104
33
  }
105
106
1.56k
  if (scope && scope != func->common.scope && scope->type == ZEND_INTERNAL_CLASS) {
107
    /* rebinding to internal class is not allowed */
108
365
    zend_error(E_WARNING, "Cannot bind closure to scope of internal class %s, this will be an error in PHP 9",
109
365
        ZSTR_VAL(scope->name));
110
365
    return false;
111
365
  }
112
113
1.20k
  if (is_fake_closure && scope != func->common.scope) {
114
11
    if (func->common.scope == NULL) {
115
4
      zend_error(E_WARNING, "Cannot rebind scope of closure created from function, this will be an error in PHP 9");
116
7
    } else {
117
7
      zend_error(E_WARNING, "Cannot rebind scope of closure created from method, this will be an error in PHP 9");
118
7
    }
119
11
    return false;
120
11
  }
121
122
1.19k
  return true;
123
1.20k
}
124
/* }}} */
125
126
/* {{{ Call closure, binding to a given object with its class as the scope */
127
ZEND_METHOD(Closure, call)
128
1.05k
{
129
1.05k
  zval *newthis, closure_result;
130
1.05k
  zend_closure *closure;
131
1.05k
  zend_fcall_info fci;
132
1.05k
  zend_fcall_info_cache fci_cache;
133
1.05k
  zend_object *newobj;
134
1.05k
  zend_class_entry *newclass;
135
136
1.05k
  fci.param_count = 0;
137
1.05k
  fci.params = NULL;
138
139
3.16k
  ZEND_PARSE_PARAMETERS_START(1, -1)
140
4.21k
    Z_PARAM_OBJECT(newthis)
141
1.04k
    Z_PARAM_VARIADIC_WITH_NAMED(fci.params, fci.param_count, fci.named_params)
142
1.05k
  ZEND_PARSE_PARAMETERS_END();
143
144
1.04k
  closure = (zend_closure *) Z_OBJ_P(ZEND_THIS);
145
146
1.04k
  newobj = Z_OBJ_P(newthis);
147
1.04k
  newclass = newobj->ce;
148
149
1.04k
  if (!zend_valid_closure_binding(closure, newthis, newclass)) {
150
375
    return;
151
375
  }
152
153
674
  fci_cache.called_scope = newclass;
154
674
  fci_cache.object = fci.object = newobj;
155
156
674
  fci.size = sizeof(fci);
157
674
  fci.consumed_args = 0;
158
674
  ZVAL_OBJ(&fci.function_name, &closure->std);
159
674
  ZVAL_UNDEF(&closure_result);
160
674
  fci.retval = &closure_result;
161
162
674
  if (closure->func.common.fn_flags & ZEND_ACC_GENERATOR) {
163
6
    zval new_closure;
164
6
    zend_create_closure(&new_closure, &closure->func, newclass, closure->called_scope, newthis);
165
6
    closure = (zend_closure *) Z_OBJ(new_closure);
166
6
    fci_cache.function_handler = &closure->func;
167
168
6
    zend_call_function(&fci, &fci_cache);
169
170
    /* copied upon generator creation */
171
6
    GC_DELREF(&closure->std);
172
668
  } else {
173
668
    zend_closure *fake_closure;
174
668
    zend_function *my_function;
175
176
668
    fake_closure = emalloc(sizeof(zend_closure));
177
668
    memset(&fake_closure->std, 0, sizeof(fake_closure->std));
178
668
    fake_closure->std.gc.refcount = 1;
179
668
    fake_closure->std.gc.u.type_info = GC_NULL;
180
668
    ZVAL_UNDEF(&fake_closure->this_ptr);
181
668
    fake_closure->called_scope = NULL;
182
668
    my_function = &fake_closure->func;
183
668
    if (ZEND_USER_CODE(closure->func.type)) {
184
661
      memcpy(my_function, &closure->func, sizeof(zend_op_array));
185
661
    } else {
186
7
      memcpy(my_function, &closure->func, sizeof(zend_internal_function));
187
7
    }
188
    /* use scope of passed object */
189
668
    my_function->common.scope = newclass;
190
668
    if (closure->func.type == ZEND_INTERNAL_FUNCTION) {
191
7
      my_function->internal_function.handler = closure->orig_internal_handler;
192
7
    }
193
668
    fci_cache.function_handler = my_function;
194
195
    /* Runtime cache relies on bound scope to be immutable, hence we need a separate rt cache in case scope changed */
196
668
    if (ZEND_USER_CODE(my_function->type)
197
661
     && (closure->func.common.scope != newclass
198
661
      || (closure->func.common.fn_flags & ZEND_ACC_HEAP_RT_CACHE))) {
199
661
      void *ptr;
200
201
661
      my_function->op_array.fn_flags |= ZEND_ACC_HEAP_RT_CACHE;
202
661
      ptr = emalloc(my_function->op_array.cache_size);
203
661
      ZEND_MAP_PTR_INIT(my_function->op_array.run_time_cache, ptr);
204
661
      memset(ptr, 0, my_function->op_array.cache_size);
205
661
    }
206
207
668
    zend_call_function(&fci, &fci_cache);
208
209
668
    if (ZEND_USER_CODE(my_function->type)) {
210
661
      if (fci_cache.function_handler->common.fn_flags & ZEND_ACC_HEAP_RT_CACHE) {
211
661
        efree(ZEND_MAP_PTR(my_function->op_array.run_time_cache));
212
661
      }
213
661
    }
214
668
    efree_size(fake_closure, sizeof(zend_closure));
215
668
  }
216
217
674
  if (Z_TYPE(closure_result) != IS_UNDEF) {
218
670
    if (Z_ISREF(closure_result)) {
219
7
      zend_unwrap_reference(&closure_result);
220
7
    }
221
670
    ZVAL_COPY_VALUE(return_value, &closure_result);
222
670
  }
223
674
}
224
/* }}} */
225
226
static void do_closure_bind(zval *return_value, zval *zclosure, zval *newthis, zend_object *scope_obj, zend_string *scope_str)
227
612
{
228
612
  zend_class_entry *ce, *called_scope;
229
612
  zend_closure *closure = (zend_closure *) Z_OBJ_P(zclosure);
230
231
612
  if (scope_obj) {
232
28
    ce = scope_obj->ce;
233
584
  } else if (scope_str) {
234
515
    if (zend_string_equals(scope_str, ZSTR_KNOWN(ZEND_STR_STATIC))) {
235
264
      ce = closure->func.common.scope;
236
264
    } else if ((ce = zend_lookup_class(scope_str)) == NULL) {
237
5
      zend_error(E_WARNING, "Class \"%s\" not found", ZSTR_VAL(scope_str));
238
5
      RETURN_NULL();
239
5
    }
240
515
  } else {
241
69
    ce = NULL;
242
69
  }
243
244
607
  if (!zend_valid_closure_binding(closure, newthis, ce)) {
245
89
    return;
246
89
  }
247
248
518
  if (newthis) {
249
297
    called_scope = Z_OBJCE_P(newthis);
250
297
  } else {
251
221
    called_scope = ce;
252
221
  }
253
254
518
  zend_create_closure(return_value, &closure->func, ce, called_scope, newthis);
255
518
}
256
257
/* {{{ Create a closure from another one and bind to another object and scope */
258
ZEND_METHOD(Closure, bind)
259
93
{
260
93
  zval *zclosure, *newthis;
261
93
  zend_object *scope_obj = NULL;
262
93
  zend_string *scope_str = ZSTR_KNOWN(ZEND_STR_STATIC);
263
264
279
  ZEND_PARSE_PARAMETERS_START(2, 3)
265
372
    Z_PARAM_OBJECT_OF_CLASS(zclosure, zend_ce_closure)
266
465
    Z_PARAM_OBJECT_OR_NULL(newthis)
267
93
    Z_PARAM_OPTIONAL
268
450
    Z_PARAM_OBJ_OR_STR_OR_NULL(scope_obj, scope_str)
269
450
  ZEND_PARSE_PARAMETERS_END();
270
271
93
  do_closure_bind(return_value, zclosure, newthis, scope_obj, scope_str);
272
93
}
273
274
/* {{{ Create a closure from another one and bind to another object and scope */
275
ZEND_METHOD(Closure, bindTo)
276
525
{
277
525
  zval *newthis;
278
525
  zend_object *scope_obj = NULL;
279
525
  zend_string *scope_str = ZSTR_KNOWN(ZEND_STR_STATIC);
280
281
1.57k
  ZEND_PARSE_PARAMETERS_START(1, 2)
282
2.10k
    Z_PARAM_OBJECT_OR_NULL(newthis)
283
524
    Z_PARAM_OPTIONAL
284
1.91k
    Z_PARAM_OBJ_OR_STR_OR_NULL(scope_obj, scope_str)
285
1.91k
  ZEND_PARSE_PARAMETERS_END();
286
287
519
  do_closure_bind(return_value, ZEND_THIS, newthis, scope_obj, scope_str);
288
519
}
289
290
static void zend_copy_parameters_array(const uint32_t param_count, HashTable *argument_array) /* {{{ */
291
227
{
292
227
  zval *param_ptr = ZEND_CALL_ARG(EG(current_execute_data), 1);
293
294
227
  ZEND_ASSERT(param_count <= ZEND_CALL_NUM_ARGS(EG(current_execute_data)));
295
296
838
  for (uint32_t i = 0; i < param_count; i++) {
297
611
    Z_TRY_ADDREF_P(param_ptr);
298
611
    zend_hash_next_index_insert_new(argument_array, param_ptr);
299
611
    param_ptr++;
300
611
  }
301
227
}
302
303
364
static ZEND_NAMED_FUNCTION(zend_closure_call_magic) /* {{{ */ {
304
364
  zend_fcall_info fci;
305
364
  zend_fcall_info_cache fcc;
306
364
  zval params[2];
307
308
364
  memset(&fci, 0, sizeof(zend_fcall_info));
309
364
  memset(&fcc, 0, sizeof(zend_fcall_info_cache));
310
311
364
  fci.size = sizeof(zend_fcall_info);
312
364
  fci.retval = return_value;
313
314
364
  fcc.function_handler = (EX(func)->internal_function.fn_flags & ZEND_ACC_STATIC) ?
315
310
    EX(func)->internal_function.scope->__callstatic : EX(func)->internal_function.scope->__call;
316
364
  fci.named_params = NULL;
317
364
  fci.params = params;
318
364
  fci.param_count = 2;
319
364
  ZVAL_STR(&fci.params[0], EX(func)->common.function_name);
320
364
  if (EX_CALL_INFO() & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
321
20
    zend_string *name;
322
20
    zval *named_param_zval;
323
20
    array_init_size(&fci.params[1], ZEND_NUM_ARGS() + zend_hash_num_elements(EX(extra_named_params)));
324
    /* Avoid conversion from packed to mixed later. */
325
20
    zend_hash_real_init_mixed(Z_ARRVAL(fci.params[1]));
326
20
    zend_copy_parameters_array(ZEND_NUM_ARGS(), Z_ARRVAL(fci.params[1]));
327
120
    ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(EX(extra_named_params), name, named_param_zval) {
328
120
      Z_TRY_ADDREF_P(named_param_zval);
329
120
      zend_hash_add_new(Z_ARRVAL(fci.params[1]), name, named_param_zval);
330
120
    } ZEND_HASH_FOREACH_END();
331
344
  } else if (ZEND_NUM_ARGS()) {
332
207
    array_init_size(&fci.params[1], ZEND_NUM_ARGS());
333
207
    zend_copy_parameters_array(ZEND_NUM_ARGS(), Z_ARRVAL(fci.params[1]));
334
207
  } else {
335
137
    ZVAL_EMPTY_ARRAY(&fci.params[1]);
336
137
  }
337
338
364
  fcc.object = fci.object = Z_OBJ_P(ZEND_THIS);
339
364
  fcc.called_scope = zend_get_called_scope(EG(current_execute_data));
340
341
364
  zend_call_function(&fci, &fcc);
342
364
  zend_return_unwrap_ref(EG(current_execute_data), return_value);
343
364
  zval_ptr_dtor(&fci.params[1]);
344
364
}
345
/* }}} */
346
347
709
static zend_result zend_create_closure_from_callable(zval *return_value, zval *callable, char **error) /* {{{ */ {
348
709
  zend_fcall_info_cache fcc;
349
709
  zend_function *mptr;
350
709
  zval instance;
351
709
  zend_internal_function call;
352
353
709
  if (!zend_is_callable_ex(callable, NULL, 0, NULL, &fcc, error)) {
354
92
    return FAILURE;
355
92
  }
356
357
617
  mptr = fcc.function_handler;
358
617
  if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
359
    /* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
360
174
    if (fcc.object && fcc.object->ce == zend_ce_closure
361
54
        && zend_string_equals(mptr->common.function_name, ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE))) {
362
54
      RETVAL_OBJ_COPY(fcc.object);
363
54
      zend_free_trampoline(mptr);
364
54
      return SUCCESS;
365
54
    }
366
367
120
    if (!mptr->common.scope) {
368
0
      return FAILURE;
369
0
    }
370
120
    if (mptr->common.fn_flags & ZEND_ACC_STATIC) {
371
6
      if (!mptr->common.scope->__callstatic) {
372
0
        return FAILURE;
373
0
      }
374
114
    } else {
375
114
      if (!mptr->common.scope->__call) {
376
0
        return FAILURE;
377
0
      }
378
114
    }
379
380
120
    memset(&call, 0, sizeof(zend_internal_function));
381
120
    call.type = ZEND_INTERNAL_FUNCTION;
382
120
    call.fn_flags = mptr->common.fn_flags & (ZEND_ACC_STATIC | ZEND_ACC_DEPRECATED);
383
120
    call.handler = zend_closure_call_magic;
384
120
    call.function_name = mptr->common.function_name;
385
120
    call.scope = mptr->common.scope;
386
120
    call.doc_comment = NULL;
387
120
    call.attributes = mptr->common.attributes;
388
389
120
    zend_free_trampoline(mptr);
390
120
    mptr = (zend_function *) &call;
391
120
  }
392
393
563
  if (fcc.object) {
394
262
    ZVAL_OBJ(&instance, fcc.object);
395
262
    zend_create_fake_closure(return_value, mptr, mptr->common.scope, fcc.called_scope, &instance);
396
301
  } else {
397
301
    zend_create_fake_closure(return_value, mptr, mptr->common.scope, fcc.called_scope, NULL);
398
301
  }
399
400
563
  if (&mptr->internal_function == &call) {
401
120
    zend_string_release(mptr->common.function_name);
402
120
  }
403
404
563
  return SUCCESS;
405
617
}
406
/* }}} */
407
408
/* {{{ Create a closure from a callable using the current scope. */
409
ZEND_METHOD(Closure, fromCallable)
410
719
{
411
719
  zval *callable;
412
719
  char *error = NULL;
413
414
2.15k
  ZEND_PARSE_PARAMETERS_START(1, 1)
415
2.87k
    Z_PARAM_ZVAL(callable)
416
2.87k
  ZEND_PARSE_PARAMETERS_END();
417
418
719
  if (Z_TYPE_P(callable) == IS_OBJECT && instanceof_function(Z_OBJCE_P(callable), zend_ce_closure)) {
419
    /* It's already a closure */
420
10
    RETURN_COPY(callable);
421
10
  }
422
423
709
  if (zend_create_closure_from_callable(return_value, callable, &error) == FAILURE) {
424
92
    if (error) {
425
92
      zend_type_error("Failed to create closure from callable: %s", error);
426
92
      efree(error);
427
92
    } else {
428
0
      zend_type_error("Failed to create closure from callable");
429
0
    }
430
92
  }
431
709
}
432
/* }}} */
433
434
ZEND_METHOD(Closure, getCurrent)
435
122
{
436
122
  ZEND_PARSE_PARAMETERS_NONE();
437
438
122
  zend_execute_data *prev_ex = EX(prev_execute_data);
439
440
122
  if (!prev_ex
441
122
   || !prev_ex->func
442
122
   || (prev_ex->func->common.fn_flags & (ZEND_ACC_CLOSURE|ZEND_ACC_FAKE_CLOSURE)) != ZEND_ACC_CLOSURE) {
443
10
      zend_throw_error(NULL, "Current function is not a closure");
444
10
      RETURN_THROWS();
445
10
  }
446
447
112
  zend_object *obj = ZEND_CLOSURE_OBJECT(prev_ex->func);
448
112
  RETURN_OBJ_COPY(obj);
449
112
}
450
451
static ZEND_COLD zend_function *zend_closure_get_constructor(zend_object *object) /* {{{ */
452
9
{
453
9
  zend_throw_error(NULL, "Instantiation of class Closure is not allowed");
454
9
  return NULL;
455
9
}
456
/* }}} */
457
458
/* int return due to Object Handler API */
459
static int zend_closure_compare(zval *o1, zval *o2) /* {{{ */
460
200
{
461
200
  ZEND_COMPARE_OBJECTS_FALLBACK(o1, o2);
462
463
193
  zend_closure *lhs = (zend_closure*) Z_OBJ_P(o1);
464
193
  zend_closure *rhs = (zend_closure*) Z_OBJ_P(o2);
465
466
193
  if (!((lhs->func.common.fn_flags & ZEND_ACC_FAKE_CLOSURE) && (rhs->func.common.fn_flags & ZEND_ACC_FAKE_CLOSURE))) {
467
4
    return ZEND_UNCOMPARABLE;
468
4
  }
469
470
189
  if (Z_TYPE(lhs->this_ptr) != Z_TYPE(rhs->this_ptr)) {
471
0
    return ZEND_UNCOMPARABLE;
472
0
  }
473
474
189
  if (Z_TYPE(lhs->this_ptr) == IS_OBJECT && Z_OBJ(lhs->this_ptr) != Z_OBJ(rhs->this_ptr)) {
475
42
    return ZEND_UNCOMPARABLE;
476
42
  }
477
478
147
  if (lhs->called_scope != rhs->called_scope) {
479
13
    return ZEND_UNCOMPARABLE;
480
13
  }
481
482
134
  if (lhs->func.type != rhs->func.type) {
483
0
    return ZEND_UNCOMPARABLE;
484
0
  }
485
486
134
  if (lhs->func.common.scope != rhs->func.common.scope) {
487
0
    return ZEND_UNCOMPARABLE;
488
0
  }
489
490
134
  if (!zend_string_equals(lhs->func.common.function_name, rhs->func.common.function_name)) {
491
60
    return ZEND_UNCOMPARABLE;
492
60
  }
493
494
74
  return 0;
495
134
}
496
/* }}} */
497
498
ZEND_API zend_function *zend_get_closure_invoke_method(zend_object *object) /* {{{ */
499
454
{
500
454
  zend_closure *closure = (zend_closure *)object;
501
454
  zend_function *invoke = (zend_function*)emalloc(sizeof(zend_function));
502
454
  const uint32_t keep_flags =
503
454
    ZEND_ACC_RETURN_REFERENCE | ZEND_ACC_VARIADIC | ZEND_ACC_HAS_RETURN_TYPE | ZEND_ACC_DEPRECATED;
504
505
454
  invoke->common = closure->func.common;
506
  /* We return ZEND_INTERNAL_FUNCTION, but arg_info representation is the
507
   * same as for ZEND_USER_FUNCTION (uses zend_string* instead of char*).
508
   * This is not a problem, because ZEND_ACC_HAS_TYPE_HINTS is never set,
509
   * and we won't check arguments on internal function. We also set
510
   * ZEND_ACC_USER_ARG_INFO flag to prevent invalid usage by Reflection */
511
454
  invoke->type = ZEND_INTERNAL_FUNCTION;
512
454
  invoke->internal_function.fn_flags =
513
454
    ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | ZEND_ACC_NEVER_CACHE | (closure->func.common.fn_flags & keep_flags);
514
454
  if (closure->func.type != ZEND_INTERNAL_FUNCTION || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO)) {
515
341
    invoke->internal_function.fn_flags |=
516
341
      ZEND_ACC_USER_ARG_INFO;
517
341
  }
518
454
  invoke->internal_function.handler = ZEND_MN(Closure___invoke);
519
454
  invoke->internal_function.doc_comment = NULL;
520
454
  invoke->internal_function.module = 0;
521
454
  invoke->internal_function.scope = zend_ce_closure;
522
454
  invoke->internal_function.function_name = ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE);
523
454
  return invoke;
524
454
}
525
/* }}} */
526
527
ZEND_API const zend_function *zend_get_closure_method_def(zend_object *obj) /* {{{ */
528
554
{
529
554
  zend_closure *closure = (zend_closure *) obj;
530
554
  return &closure->func;
531
554
}
532
/* }}} */
533
534
ZEND_API zval* zend_get_closure_this_ptr(zval *obj) /* {{{ */
535
10
{
536
10
  zend_closure *closure = (zend_closure *)Z_OBJ_P(obj);
537
10
  return &closure->this_ptr;
538
10
}
539
/* }}} */
540
541
static zend_function *zend_closure_get_method(zend_object **object, zend_string *method, const zval *key) /* {{{ */
542
1.72k
{
543
1.72k
  if (zend_string_equals_literal_ci(method, ZEND_INVOKE_FUNC_NAME)) {
544
418
    return zend_get_closure_invoke_method(*object);
545
418
  }
546
547
1.30k
  return zend_std_get_method(object, method, key);
548
1.72k
}
549
/* }}} */
550
551
static void zend_closure_free_storage(zend_object *object) /* {{{ */
552
13.7k
{
553
13.7k
  zend_closure *closure = (zend_closure *)object;
554
555
13.7k
  zend_object_std_dtor(&closure->std);
556
557
13.7k
  if (closure->func.type == ZEND_USER_FUNCTION) {
558
    /* We don't own the static variables of fake closures. */
559
13.0k
    if (!(closure->func.op_array.fn_flags & ZEND_ACC_FAKE_CLOSURE)) {
560
12.3k
      zend_destroy_static_vars(&closure->func.op_array);
561
12.3k
    }
562
13.0k
    destroy_op_array(&closure->func.op_array);
563
13.0k
  } else if (closure->func.type == ZEND_INTERNAL_FUNCTION) {
564
721
    zend_string_release(closure->func.common.function_name);
565
721
  }
566
567
13.7k
  if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
568
2.92k
    zval_ptr_dtor(&closure->this_ptr);
569
2.92k
  }
570
13.7k
}
571
/* }}} */
572
573
static zend_object *zend_closure_new(zend_class_entry *class_type) /* {{{ */
574
13.7k
{
575
13.7k
  zend_closure *closure;
576
577
13.7k
  closure = emalloc(sizeof(zend_closure));
578
13.7k
  memset(closure, 0, sizeof(zend_closure));
579
580
13.7k
  zend_object_std_init(&closure->std, class_type);
581
582
13.7k
  return (zend_object*)closure;
583
13.7k
}
584
/* }}} */
585
586
static zend_object *zend_closure_clone(zend_object *zobject) /* {{{ */
587
14
{
588
14
  zend_closure *closure = (zend_closure *)zobject;
589
14
  zval result;
590
591
14
  zend_create_closure(&result, &closure->func,
592
14
    closure->func.common.scope, closure->called_scope, &closure->this_ptr);
593
14
  return Z_OBJ(result);
594
14
}
595
/* }}} */
596
597
static zend_result zend_closure_get_closure(zend_object *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zend_object **obj_ptr, bool check_only) /* {{{ */
598
17.1k
{
599
17.1k
  zend_closure *closure = (zend_closure*)obj;
600
601
17.1k
  *fptr_ptr = &closure->func;
602
17.1k
  *ce_ptr = closure->called_scope;
603
604
17.1k
  if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
605
1.90k
    *obj_ptr = Z_OBJ(closure->this_ptr);
606
15.2k
  } else {
607
15.2k
    *obj_ptr = NULL;
608
15.2k
  }
609
610
17.1k
  return SUCCESS;
611
17.1k
}
612
/* }}} */
613
614
/* *is_temp is int due to Object Handler API */
615
static HashTable *zend_closure_get_debug_info(zend_object *object, int *is_temp) /* {{{ */
616
1.07k
{
617
1.07k
  zend_closure *closure = (zend_closure *)object;
618
1.07k
  zval val;
619
1.07k
  struct _zend_arg_info *arg_info = closure->func.common.arg_info;
620
1.07k
  HashTable *debug_info;
621
622
1.07k
  *is_temp = 1;
623
624
1.07k
  debug_info = zend_new_array(8);
625
626
1.07k
  if (closure->func.op_array.fn_flags & ZEND_ACC_FAKE_CLOSURE) {
627
185
    if (closure->func.common.scope) {
628
54
      zend_string *class_name = closure->func.common.scope->name;
629
54
      zend_string *func_name = closure->func.common.function_name;
630
54
      zend_string *combined = zend_string_concat3(
631
54
        ZSTR_VAL(class_name), ZSTR_LEN(class_name),
632
54
        "::", strlen("::"),
633
54
        ZSTR_VAL(func_name), ZSTR_LEN(func_name)
634
54
      );
635
54
      ZVAL_STR(&val, combined);
636
131
    } else {
637
131
      ZVAL_STR_COPY(&val, closure->func.common.function_name);
638
131
    }
639
185
    zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_FUNCTION), &val);
640
888
  } else {
641
888
    ZVAL_STR_COPY(&val, closure->func.common.function_name);
642
888
    zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_NAME), &val);
643
644
888
    ZVAL_STR_COPY(&val, closure->func.op_array.filename);
645
888
    zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_FILE), &val);
646
647
888
    ZVAL_LONG(&val, closure->func.op_array.line_start);
648
888
    zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_LINE), &val);
649
888
  }
650
651
1.07k
  if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
652
139
    zval *var;
653
139
    zend_string *key;
654
139
    HashTable *static_variables = ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr);
655
656
139
    array_init(&val);
657
658
595
    ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(static_variables, key, var) {
659
595
      zval copy;
660
661
595
      if (Z_ISREF_P(var) && Z_REFCOUNT_P(var) == 1) {
662
38
        var = Z_REFVAL_P(var);
663
38
      }
664
595
      ZVAL_COPY(&copy, var);
665
666
595
      zend_hash_add_new(Z_ARRVAL(val), key, &copy);
667
595
    } ZEND_HASH_FOREACH_END();
668
669
139
    if (zend_hash_num_elements(Z_ARRVAL(val))) {
670
126
      zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
671
126
    } else {
672
13
      zval_ptr_dtor(&val);
673
13
    }
674
139
  }
675
676
1.07k
  if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
677
619
    Z_ADDREF(closure->this_ptr);
678
619
    zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_THIS), &closure->this_ptr);
679
619
  }
680
681
1.07k
  if (arg_info &&
682
178
    (closure->func.common.num_args ||
683
171
     (closure->func.common.fn_flags & ZEND_ACC_VARIADIC))) {
684
171
    uint32_t i, num_args, required = closure->func.common.required_num_args;
685
686
171
    array_init(&val);
687
688
171
    num_args = closure->func.common.num_args;
689
171
    if (closure->func.common.fn_flags & ZEND_ACC_VARIADIC) {
690
18
      num_args++;
691
18
    }
692
361
    for (i = 0; i < num_args; i++) {
693
190
      zend_string *name;
694
190
      zval info;
695
190
      ZEND_ASSERT(arg_info->name && "Argument should have name");
696
190
      name = zend_strpprintf(0, "%s$%s",
697
190
          ZEND_ARG_SEND_MODE(arg_info) ? "&" : "",
698
190
          ZSTR_VAL(arg_info->name));
699
190
      ZVAL_NEW_STR(&info, zend_strpprintf(0, "%s", i >= required ? "<optional>" : "<required>"));
700
190
      zend_hash_update(Z_ARRVAL(val), name, &info);
701
190
      zend_string_release_ex(name, 0);
702
190
      arg_info++;
703
190
    }
704
171
    zend_hash_str_update(debug_info, "parameter", sizeof("parameter")-1, &val);
705
171
  }
706
707
1.07k
  return debug_info;
708
1.07k
}
709
/* }}} */
710
711
static HashTable *zend_closure_get_gc(zend_object *obj, zval **table, int *n) /* {{{ */
712
13.6k
{
713
13.6k
  zend_closure *closure = (zend_closure *)obj;
714
715
13.6k
  *table = Z_TYPE(closure->this_ptr) != IS_NULL ? &closure->this_ptr : NULL;
716
13.6k
  *n = Z_TYPE(closure->this_ptr) != IS_NULL ? 1 : 0;
717
  /* Fake closures don't own the static variables they reference. */
718
13.6k
  return (closure->func.type == ZEND_USER_FUNCTION
719
13.3k
      && !(closure->func.op_array.fn_flags & ZEND_ACC_FAKE_CLOSURE)) ?
720
13.6k
    ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr) : NULL;
721
13.6k
}
722
/* }}} */
723
724
/* {{{ Private constructor preventing instantiation */
725
ZEND_COLD ZEND_METHOD(Closure, __construct)
726
1
{
727
1
  zend_throw_error(NULL, "Instantiation of class Closure is not allowed");
728
1
}
729
/* }}} */
730
731
void zend_register_closure_ce(void) /* {{{ */
732
16
{
733
16
  zend_ce_closure = register_class_Closure();
734
16
  zend_ce_closure->create_object = zend_closure_new;
735
16
  zend_ce_closure->default_object_handlers = &closure_handlers;
736
737
16
  memcpy(&closure_handlers, &std_object_handlers, sizeof(zend_object_handlers));
738
16
  closure_handlers.free_obj = zend_closure_free_storage;
739
16
  closure_handlers.get_constructor = zend_closure_get_constructor;
740
16
  closure_handlers.get_method = zend_closure_get_method;
741
16
  closure_handlers.compare = zend_closure_compare;
742
16
  closure_handlers.clone_obj = zend_closure_clone;
743
16
  closure_handlers.get_debug_info = zend_closure_get_debug_info;
744
16
  closure_handlers.get_closure = zend_closure_get_closure;
745
16
  closure_handlers.get_gc = zend_closure_get_gc;
746
16
}
747
/* }}} */
748
749
static ZEND_NAMED_FUNCTION(zend_closure_internal_handler) /* {{{ */
750
523
{
751
523
  zend_closure *closure = (zend_closure*)ZEND_CLOSURE_OBJECT(EX(func));
752
523
  closure->orig_internal_handler(INTERNAL_FUNCTION_PARAM_PASSTHRU);
753
523
  ZEND_ASSERT(!(closure->func.common.fn_flags2 & ZEND_ACC2_FORBID_DYN_CALLS) || EG(exception));
754
  // Assign to EX(this) so that it is released after observer checks etc.
755
523
  ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_RELEASE_THIS);
756
523
  Z_OBJ(EX(This)) = &closure->std;
757
523
}
758
/* }}} */
759
760
static void zend_create_closure_ex(zval *res, zend_function *func, zend_class_entry *scope, zend_class_entry *called_scope, zval *this_ptr, bool is_fake) /* {{{ */
761
13.7k
{
762
13.7k
  zend_closure *closure;
763
13.7k
  void *ptr;
764
765
13.7k
  object_init_ex(res, zend_ce_closure);
766
767
13.7k
  closure = (zend_closure *)Z_OBJ_P(res);
768
769
13.7k
  if ((scope == NULL) && this_ptr && (Z_TYPE_P(this_ptr) != IS_UNDEF)) {
770
    /* use dummy scope if we're binding an object without specifying a scope */
771
    /* maybe it would be better to create one for this purpose */
772
68
    scope = zend_ce_closure;
773
68
  }
774
775
13.7k
  if (func->type == ZEND_USER_FUNCTION) {
776
13.0k
    memcpy(&closure->func, func, sizeof(zend_op_array));
777
13.0k
    closure->func.common.fn_flags |= ZEND_ACC_CLOSURE;
778
13.0k
    closure->func.common.fn_flags &= ~ZEND_ACC_IMMUTABLE;
779
780
13.0k
    zend_string_addref(closure->func.op_array.function_name);
781
13.0k
    if (closure->func.op_array.refcount) {
782
1.20k
      (*closure->func.op_array.refcount)++;
783
1.20k
    }
784
785
    /* For fake closures, we want to reuse the static variables of the original function. */
786
13.0k
    HashTable *ht = ZEND_MAP_PTR_GET(func->op_array.static_variables_ptr);
787
13.0k
    if (!is_fake) {
788
12.3k
      if (!ht) {
789
12.3k
        ht = closure->func.op_array.static_variables;
790
12.3k
      }
791
12.3k
      ZEND_MAP_PTR_INIT(closure->func.op_array.static_variables_ptr,
792
12.3k
        ht ? zend_array_dup(ht) : NULL);
793
12.3k
    } else if (func->op_array.static_variables) {
794
129
      if (!ht) {
795
57
        ht = zend_array_dup(func->op_array.static_variables);
796
57
        ZEND_MAP_PTR_SET(func->op_array.static_variables_ptr, ht);
797
57
      }
798
129
      ZEND_MAP_PTR_INIT(closure->func.op_array.static_variables_ptr, ht);
799
129
    }
800
801
    /* Runtime cache is scope-dependent, so we cannot reuse it if the scope changed */
802
13.0k
    ptr = ZEND_MAP_PTR_GET(func->op_array.run_time_cache);
803
13.0k
    if (!ptr
804
2.80k
      || func->common.scope != scope
805
2.50k
      || (func->common.fn_flags & ZEND_ACC_HEAP_RT_CACHE)
806
13.0k
    ) {
807
10.6k
      if (!ptr
808
10.2k
       && (func->common.fn_flags & ZEND_ACC_CLOSURE)
809
9.97k
       && (func->common.scope == scope ||
810
7.68k
           !(func->common.fn_flags & ZEND_ACC_IMMUTABLE))) {
811
        /* If a real closure is used for the first time, we create a shared runtime cache
812
         * and remember which scope it is for. */
813
7.68k
        if (func->common.scope != scope) {
814
33
          func->common.scope = scope;
815
33
        }
816
7.68k
        ptr = zend_arena_alloc(&CG(arena), func->op_array.cache_size);
817
7.68k
        ZEND_MAP_PTR_SET(func->op_array.run_time_cache, ptr);
818
7.68k
        closure->func.op_array.fn_flags &= ~ZEND_ACC_HEAP_RT_CACHE;
819
7.68k
      } else {
820
        /* Otherwise, we use a non-shared runtime cache */
821
2.95k
        ptr = emalloc(func->op_array.cache_size);
822
2.95k
        closure->func.op_array.fn_flags |= ZEND_ACC_HEAP_RT_CACHE;
823
2.95k
      }
824
10.6k
      memset(ptr, 0, func->op_array.cache_size);
825
10.6k
    }
826
13.0k
    ZEND_MAP_PTR_INIT(closure->func.op_array.run_time_cache, ptr);
827
13.0k
  } else {
828
721
    memcpy(&closure->func, func, sizeof(zend_internal_function));
829
721
    closure->func.common.fn_flags |= ZEND_ACC_CLOSURE;
830
    /* wrap internal function handler to avoid memory leak */
831
721
    if (UNEXPECTED(closure->func.internal_function.handler == zend_closure_internal_handler)) {
832
      /* avoid infinity recursion, by taking handler from nested closure */
833
94
      zend_closure *nested = ZEND_CONTAINER_OF(func, zend_closure, func);
834
94
      ZEND_ASSERT(nested->std.ce == zend_ce_closure);
835
94
      closure->orig_internal_handler = nested->orig_internal_handler;
836
627
    } else {
837
627
      closure->orig_internal_handler = closure->func.internal_function.handler;
838
627
    }
839
721
    closure->func.internal_function.handler = zend_closure_internal_handler;
840
721
    zend_string_addref(closure->func.op_array.function_name);
841
721
    if (!func->common.scope) {
842
      /* if it's a free function, we won't set scope & this since they're meaningless */
843
331
      this_ptr = NULL;
844
331
      scope = NULL;
845
331
    }
846
721
  }
847
848
13.7k
  ZVAL_UNDEF(&closure->this_ptr);
849
  /* Invariant:
850
   * If the closure is unscoped or static, it has no bound object. */
851
13.7k
  closure->func.common.scope = scope;
852
13.7k
  closure->called_scope = called_scope;
853
13.7k
  if (scope) {
854
3.79k
    closure->func.common.fn_flags |= ZEND_ACC_PUBLIC;
855
3.79k
    if (this_ptr && Z_TYPE_P(this_ptr) == IS_OBJECT && (closure->func.common.fn_flags & ZEND_ACC_STATIC) == 0) {
856
2.92k
      ZVAL_OBJ_COPY(&closure->this_ptr, Z_OBJ_P(this_ptr));
857
2.92k
    }
858
3.79k
  }
859
13.7k
}
860
/* }}} */
861
862
ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_entry *scope, zend_class_entry *called_scope, zval *this_ptr)
863
12.4k
{
864
12.4k
  zend_create_closure_ex(res, func, scope, called_scope, this_ptr,
865
12.4k
    /* is_fake */ (func->common.fn_flags & ZEND_ACC_FAKE_CLOSURE) != 0);
866
12.4k
}
867
868
ZEND_API void zend_create_fake_closure(zval *res, zend_function *func, zend_class_entry *scope, zend_class_entry *called_scope, zval *this_ptr) /* {{{ */
869
1.31k
{
870
1.31k
  zend_closure *closure;
871
872
1.31k
  zend_create_closure_ex(res, func, scope, called_scope, this_ptr, /* is_fake */ true);
873
874
1.31k
  closure = (zend_closure *)Z_OBJ_P(res);
875
1.31k
  closure->func.common.fn_flags |= ZEND_ACC_FAKE_CLOSURE;
876
1.31k
  if (Z_TYPE(closure->this_ptr) != IS_OBJECT) {
877
867
    GC_ADD_FLAGS(&closure->std, GC_NOT_COLLECTABLE);
878
867
  }
879
1.31k
}
880
/* }}} */
881
882
554
void zend_closure_from_frame(zval *return_value, const zend_execute_data *call) { /* {{{ */
883
554
  zval instance;
884
554
  zend_internal_function trampoline;
885
554
  zend_function *mptr = call->func;
886
887
554
  if (ZEND_CALL_INFO(call) & ZEND_CALL_CLOSURE) {
888
8
    RETURN_OBJ(ZEND_CLOSURE_OBJECT(mptr));
889
8
  }
890
891
546
  if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
892
156
    if ((ZEND_CALL_INFO(call) & ZEND_CALL_HAS_THIS) &&
893
100
      (Z_OBJCE(call->This) == zend_ce_closure)
894
13
      && zend_string_equals(mptr->common.function_name, ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE))) {
895
13
          zend_free_trampoline(mptr);
896
13
          RETURN_OBJ_COPY(Z_OBJ(call->This));
897
13
      }
898
899
143
    memset(&trampoline, 0, sizeof(zend_internal_function));
900
143
    trampoline.type = ZEND_INTERNAL_FUNCTION;
901
143
    trampoline.fn_flags = mptr->common.fn_flags & (ZEND_ACC_STATIC | ZEND_ACC_VARIADIC | ZEND_ACC_RETURN_REFERENCE | ZEND_ACC_DEPRECATED);
902
143
    trampoline.handler = zend_closure_call_magic;
903
143
    trampoline.function_name = mptr->common.function_name;
904
143
    trampoline.scope = mptr->common.scope;
905
143
    trampoline.doc_comment = NULL;
906
143
    trampoline.arg_info = mptr->common.arg_info;
907
143
    trampoline.attributes = mptr->common.attributes;
908
909
143
    zend_free_trampoline(mptr);
910
143
    mptr = (zend_function *) &trampoline;
911
143
  }
912
913
533
  if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_THIS) {
914
158
    ZVAL_OBJ(&instance, Z_OBJ(call->This));
915
916
158
    zend_create_fake_closure(return_value, mptr, mptr->common.scope, Z_OBJCE(instance), &instance);
917
375
  } else {
918
375
    zend_create_fake_closure(return_value, mptr, mptr->common.scope, Z_CE(call->This), NULL);
919
375
  }
920
921
533
  if (&mptr->internal_function == &trampoline) {
922
143
    zend_string_release(mptr->common.function_name);
923
143
  }
924
533
} /* }}} */
925
926
void zend_closure_bind_var(zval *closure_zv, zend_string *var_name, zval *var) /* {{{ */
927
0
{
928
0
  zend_closure *closure = (zend_closure *) Z_OBJ_P(closure_zv);
929
0
  HashTable *static_variables = ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr);
930
0
  zend_hash_update(static_variables, var_name, var);
931
0
}
932
/* }}} */
933
934
void zend_closure_bind_var_ex(zval *closure_zv, uint32_t offset, zval *val) /* {{{ */
935
5.51k
{
936
5.51k
  zend_closure *closure = (zend_closure *) Z_OBJ_P(closure_zv);
937
5.51k
  HashTable *static_variables = ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr);
938
5.51k
  zval *var = (zval*)((char*)static_variables->arData + offset);
939
5.51k
  zval_ptr_dtor(var);
940
5.51k
  ZVAL_COPY_VALUE(var, val);
941
5.51k
}
942
/* }}} */