Coverage Report

Created: 2026-09-14 06:25

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/zend_object_handlers.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright © Zend Technologies Ltd., a subsidiary company of          |
6
   |     Perforce Software, Inc., and Contributors.                       |
7
   +----------------------------------------------------------------------+
8
   | This source file is subject to the Modified BSD License that is      |
9
   | bundled with this package in the file LICENSE, and is available      |
10
   | through the World Wide Web at <https://www.php.net/license/>.        |
11
   |                                                                      |
12
   | SPDX-License-Identifier: BSD-3-Clause                                |
13
   +----------------------------------------------------------------------+
14
   | Authors: Andi Gutmans <andi@php.net>                                 |
15
   |          Zeev Suraski <zeev@php.net>                                 |
16
   |          Dmitry Stogov <dmitry@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend.h"
21
#include "zend_globals.h"
22
#include "zend_lazy_objects.h"
23
#include "zend_variables.h"
24
#include "zend_API.h"
25
#include "zend_objects.h"
26
#include "zend_objects_API.h"
27
#include "zend_object_handlers.h"
28
#include "zend_interfaces.h"
29
#include "zend_exceptions.h"
30
#include "zend_closures.h"
31
#include "zend_compile.h"
32
#include "zend_hash.h"
33
#include "zend_property_hooks.h"
34
#include "zend_observer.h"
35
36
#define DEBUG_OBJECT_HANDLERS 0
37
38
742
#define ZEND_WRONG_PROPERTY_OFFSET   0
39
4.63k
#define ZEND_HOOKED_PROPERTY_OFFSET 1
40
41
/* guard flags */
42
23.5k
#define IN_GET    ZEND_GUARD_PROPERTY_GET
43
44.9k
#define IN_SET    ZEND_GUARD_PROPERTY_SET
44
1.00k
#define IN_UNSET  ZEND_GUARD_PROPERTY_UNSET
45
4.71k
#define IN_ISSET  ZEND_GUARD_PROPERTY_ISSET
46
#define IN_HOOK   ZEND_GUARD_PROPERTY_HOOK
47
48
static zend_arg_info zend_call_trampoline_arginfo[1] = {{0}};
49
static zend_arg_info zend_property_hook_arginfo[1] = {{0}};
50
51
static zend_always_inline bool zend_objects_check_stack_limit(void)
52
876
{
53
876
#ifdef ZEND_CHECK_STACK_LIMIT
54
876
  return zend_call_stack_overflowed(EG(stack_limit));
55
#else
56
  return false;
57
#endif
58
876
}
59
60
/*
61
  __X accessors explanation:
62
63
  if we have __get and property that is not part of the properties array is
64
  requested, we call __get handler. If it fails, we return uninitialized.
65
66
  if we have __set and property that is not part of the properties array is
67
  set, we call __set handler. If it fails, we do not change the array.
68
69
  for both handlers above, when we are inside __get/__set, no further calls for
70
  __get/__set for this property of this object will be made, to prevent endless
71
  recursion and enable accessors to change properties array.
72
73
  if we have __call and method which is not part of the class function table is
74
  called, we cal __call handler.
75
*/
76
77
ZEND_API HashTable *rebuild_object_properties_internal(zend_object *zobj) /* {{{ */
78
619k
{
79
619k
  if (!zobj->properties) {
80
618k
    zend_property_info *prop_info;
81
618k
    zend_class_entry *ce = zobj->ce;
82
618k
    int i;
83
84
618k
    zobj->properties = zend_new_array(ce->default_properties_count);
85
618k
    if (ce->default_properties_count) {
86
159k
      zend_hash_real_init_mixed(zobj->properties);
87
1.20M
      for (i = 0; i < ce->default_properties_count; i++) {
88
1.04M
        prop_info = ce->properties_info_table[i];
89
90
1.04M
        if (!prop_info) {
91
203
          continue;
92
203
        }
93
94
1.04M
        if (UNEXPECTED(Z_TYPE_P(OBJ_PROP(zobj, prop_info->offset)) == IS_UNDEF)) {
95
3.09k
          HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
96
3.09k
        }
97
98
1.04M
        _zend_hash_append_ind(zobj->properties, prop_info->name,
99
1.04M
          OBJ_PROP(zobj, prop_info->offset));
100
1.04M
      }
101
159k
    }
102
618k
  }
103
104
619k
  return zobj->properties;
105
619k
}
106
/* }}} */
107
108
/* Implements the fast path for array cast */
109
ZEND_API HashTable *zend_std_build_object_properties_array(zend_object *zobj) /* {{{ */
110
157
{
111
157
  const zend_class_entry *ce = zobj->ce;
112
157
  HashTable *ht;
113
157
  zval* prop;
114
157
  int i;
115
116
157
  ZEND_ASSERT(!(zend_object_is_lazy_proxy(zobj) && zend_lazy_object_initialized(zobj)));
117
157
  ZEND_ASSERT(!zobj->properties);
118
157
  ht = zend_new_array(ce->default_properties_count);
119
157
  if (ce->default_properties_count) {
120
95
    zend_hash_real_init_mixed(ht);
121
226
    for (i = 0; i < ce->default_properties_count; i++) {
122
131
      const zend_property_info *prop_info = ce->properties_info_table[i];
123
124
131
      if (!prop_info) {
125
0
        continue;
126
0
      }
127
128
131
      prop = OBJ_PROP(zobj, prop_info->offset);
129
131
      if (UNEXPECTED(Z_TYPE_P(prop) == IS_UNDEF)) {
130
47
        continue;
131
47
      }
132
133
84
      if (Z_ISREF_P(prop) && Z_REFCOUNT_P(prop) == 1) {
134
11
        prop = Z_REFVAL_P(prop);
135
11
      }
136
137
84
      Z_TRY_ADDREF_P(prop);
138
84
      _zend_hash_append(ht, prop_info->name, prop);
139
84
    }
140
95
  }
141
157
  return ht;
142
157
}
143
/* }}} */
144
145
ZEND_API HashTable *zend_std_get_properties(zend_object *zobj) /* {{{ */
146
1.34M
{
147
1.34M
  return zend_std_get_properties_ex(zobj);
148
1.34M
}
149
/* }}} */
150
151
/* Fetch properties HashTable without triggering lazy initialization */
152
ZEND_API HashTable *zend_get_properties_no_lazy_init(zend_object *zobj)
153
1.04k
{
154
1.04k
  if (zobj->handlers->get_properties == zend_std_get_properties) {
155
1.04k
    if (UNEXPECTED(zend_object_is_lazy_proxy(zobj)
156
1.04k
        && zend_lazy_object_initialized(zobj))) {
157
28
      zend_object *instance = zend_lazy_object_get_instance(zobj);
158
28
      return zend_get_properties_no_lazy_init(instance);
159
28
    }
160
161
1.01k
    if (!zobj->properties) {
162
670
      rebuild_object_properties_internal(zobj);
163
670
    }
164
1.01k
    return zobj->properties;
165
1.04k
  }
166
167
0
  ZEND_ASSERT(!zend_object_is_lazy(zobj));
168
169
0
  return zobj->handlers->get_properties(zobj);
170
0
}
171
172
ZEND_API HashTable *zend_std_get_gc(zend_object *zobj, zval **table, int *n) /* {{{ */
173
481k
{
174
481k
  if (zobj->handlers->get_properties != zend_std_get_properties) {
175
0
    *table = NULL;
176
0
    *n = 0;
177
0
    return zobj->handlers->get_properties(zobj);
178
481k
  } else {
179
481k
    if (UNEXPECTED(zend_object_is_lazy(zobj))) {
180
2.44k
      return zend_lazy_object_get_gc(zobj, table, n);
181
479k
    } else if (zobj->properties) {
182
415k
      *table = NULL;
183
415k
      *n = 0;
184
415k
      return zobj->properties;
185
415k
    } else {
186
63.3k
      *table = zobj->properties_table;
187
63.3k
      *n = zobj->ce->default_properties_count;
188
63.3k
      return NULL;
189
63.3k
    }
190
481k
  }
191
481k
}
192
/* }}} */
193
194
ZEND_API HashTable *zend_std_get_debug_info(zend_object *object, int *is_temp) /* {{{ */
195
17.0k
{
196
17.0k
  const zend_class_entry *ce = object->ce;
197
17.0k
  zval retval;
198
17.0k
  HashTable *ht;
199
200
17.0k
  if (!ce->__debugInfo) {
201
16.7k
    if (UNEXPECTED(zend_object_is_lazy(object))) {
202
1.00k
      return zend_lazy_object_debug_info(object, is_temp);
203
1.00k
    }
204
205
15.7k
    *is_temp = 0;
206
15.7k
    return object->handlers->get_properties(object);
207
16.7k
  }
208
209
336
  zend_call_known_instance_method_with_0_params(ce->__debugInfo, object, &retval);
210
336
  if (UNEXPECTED(Z_ISREF(retval))) {
211
6
    zend_unwrap_reference(&retval);
212
6
  }
213
336
  if (Z_TYPE(retval) == IS_ARRAY) {
214
309
    if (!Z_REFCOUNTED(retval)) {
215
32
      *is_temp = 1;
216
32
      return zend_array_dup(Z_ARRVAL(retval));
217
277
    } else if (Z_REFCOUNT(retval) <= 1) {
218
274
      *is_temp = 1;
219
274
      ht = Z_ARR(retval);
220
274
      return ht;
221
274
    } else {
222
3
      *is_temp = 0;
223
3
      zval_ptr_dtor(&retval);
224
3
      return Z_ARRVAL(retval);
225
3
    }
226
309
  } else if (Z_TYPE(retval) == IS_NULL) {
227
15
    zend_error(E_DEPRECATED, "Returning null from %s::__debugInfo() is deprecated, return an empty array instead",
228
15
      ZSTR_VAL(ce->name));
229
15
    *is_temp = 1;
230
15
    ht = zend_new_array(0);
231
15
    return ht;
232
15
  }
233
234
12
  zend_error_noreturn(E_ERROR, ZEND_DEBUGINFO_FUNC_NAME "() must return an array");
235
236
0
  return NULL; /* Compilers are dumb and don't understand that noreturn means that the function does NOT need a return value... */
237
336
}
238
/* }}} */
239
240
static void zend_std_call_getter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
241
3.57k
{
242
3.57k
  zval member;
243
3.57k
  ZVAL_STR(&member, prop_name);
244
3.57k
  zend_call_known_instance_method_with_1_params(zobj->ce->__get, zobj, retval, &member);
245
3.57k
}
246
/* }}} */
247
248
static void zend_std_call_setter(zend_object *zobj, zend_string *prop_name, zval *value) /* {{{ */
249
1.62k
{
250
1.62k
  zval args[2];
251
1.62k
  ZVAL_STR(&args[0], prop_name);
252
1.62k
  ZVAL_COPY_VALUE(&args[1], value);
253
1.62k
  zend_call_known_instance_method(zobj->ce->__set, zobj, NULL, 2, args);
254
1.62k
}
255
/* }}} */
256
257
static void zend_std_call_unsetter(zend_object *zobj, zend_string *prop_name) /* {{{ */
258
137
{
259
137
  zval member;
260
137
  ZVAL_STR(&member, prop_name);
261
137
  zend_call_known_instance_method_with_1_params(zobj->ce->__unset, zobj, NULL, &member);
262
137
}
263
/* }}} */
264
265
static void zend_std_call_issetter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
266
935
{
267
935
  zval member;
268
935
  ZVAL_STR(&member, prop_name);
269
935
  zend_call_known_instance_method_with_1_params(zobj->ce->__isset, zobj, retval, &member);
270
935
}
271
/* }}} */
272
273
274
static zend_always_inline bool is_derived_class(const zend_class_entry *child_class, const zend_class_entry *parent_class) /* {{{ */
275
1.32M
{
276
1.32M
  child_class = child_class->parent;
277
1.97M
  while (child_class) {
278
1.31M
    if (child_class == parent_class) {
279
662k
      return 1;
280
662k
    }
281
647k
    child_class = child_class->parent;
282
647k
  }
283
284
661k
  return 0;
285
1.32M
}
286
/* }}} */
287
288
static zend_never_inline int is_protected_compatible_scope(const zend_class_entry *ce, const zend_class_entry *scope) /* {{{ */
289
662k
{
290
662k
  return scope &&
291
661k
    (ce == scope || is_derived_class(ce, scope) || is_derived_class(scope, ce));
292
662k
}
293
/* }}} */
294
295
static zend_never_inline zend_property_info *zend_get_parent_private_property(const zend_class_entry *scope, const zend_class_entry *ce, zend_string *member) /* {{{ */
296
654
{
297
654
  if (scope != ce && scope && is_derived_class(ce, scope)) {
298
518
    zend_property_info *prop_info = zend_hash_find_ptr(&scope->properties_info, member);
299
518
    if (prop_info != NULL) {
300
518
      if ((prop_info->flags & ZEND_ACC_PRIVATE)
301
508
       && prop_info->ce == scope) {
302
483
        return prop_info;
303
483
      }
304
518
    }
305
518
  }
306
171
  return NULL;
307
654
}
308
/* }}} */
309
310
static ZEND_COLD zend_never_inline void zend_bad_property_access(const zend_property_info *property_info, const zend_class_entry *ce, const zend_string *member) /* {{{ */
311
120
{
312
120
  zend_throw_error(NULL, "Cannot access %s property %s::$%s", zend_visibility_string(property_info->flags), ZSTR_VAL(ce->name), ZSTR_VAL(member));
313
120
}
314
/* }}} */
315
316
static ZEND_COLD zend_never_inline void zend_bad_property_name(void) /* {{{ */
317
43
{
318
43
  zend_throw_error(NULL, "Cannot access property starting with \"\\0\"");
319
43
}
320
/* }}} */
321
322
static ZEND_COLD zend_never_inline void zend_forbidden_dynamic_property(
323
75
    const zend_class_entry *ce, const zend_string *member) {
324
75
  zend_throw_error(NULL, "Cannot create dynamic property %s::$%s",
325
75
    ZSTR_VAL(ce->name), ZSTR_VAL(member));
326
75
}
327
328
static ZEND_COLD zend_never_inline bool zend_deprecated_dynamic_property(
329
17.7k
    zend_object *obj, const zend_string *member) {
330
17.7k
  GC_ADDREF(obj);
331
17.7k
  zend_error(E_DEPRECATED, "Creation of dynamic property %s::$%s is deprecated",
332
17.7k
    ZSTR_VAL(obj->ce->name), ZSTR_VAL(member));
333
17.7k
  if (UNEXPECTED(GC_DELREF(obj) == 0)) {
334
0
    const zend_class_entry *ce = obj->ce;
335
0
    zend_objects_store_del(obj);
336
0
    if (!EG(exception)) {
337
      /* We cannot continue execution and have to throw an exception */
338
0
      zend_throw_error(NULL, "Cannot create dynamic property %s::$%s",
339
0
        ZSTR_VAL(ce->name), ZSTR_VAL(member));
340
0
    }
341
0
    return 0;
342
0
  }
343
17.7k
  return 1;
344
17.7k
}
345
346
static ZEND_COLD zend_never_inline void zend_readonly_property_unset_error(
347
51
    const zend_class_entry *ce, const zend_string *member) {
348
51
  zend_throw_error(NULL, "Cannot unset readonly property %s::$%s",
349
51
    ZSTR_VAL(ce->name), ZSTR_VAL(member));
350
51
}
351
352
static zend_always_inline const zend_class_entry *get_fake_or_executed_scope(void)
353
65.7M
{
354
65.7M
  if (UNEXPECTED(EG(fake_scope))) {
355
65.7M
    return EG(fake_scope);
356
65.7M
  } else {
357
9.59k
    return zend_get_executed_scope();
358
9.59k
  }
359
65.7M
}
360
361
static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *ce, zend_string *member, int silent, void **cache_slot, const zend_property_info **info_ptr) /* {{{ */
362
62.9M
{
363
62.9M
  zend_property_info *property_info;
364
62.9M
  uint32_t flags;
365
62.9M
  uintptr_t offset;
366
367
62.9M
  if (cache_slot && EXPECTED(ce == CACHED_PTR_EX(cache_slot))) {
368
22.0k
    *info_ptr = CACHED_PTR_EX(cache_slot + 2);
369
22.0k
    return (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
370
22.0k
  }
371
372
62.9M
  if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)
373
62.9M
   || UNEXPECTED((property_info = zend_hash_find_ptr(&ce->properties_info, member)) == NULL)) {
374
62.2k
    if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0') && ZSTR_LEN(member) != 0) {
375
95
      if (!silent) {
376
43
        zend_bad_property_name();
377
43
      }
378
95
      return ZEND_WRONG_PROPERTY_OFFSET;
379
95
    }
380
62.2k
dynamic:
381
62.2k
    if (cache_slot) {
382
16.3k
      CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
383
16.3k
      CACHE_PTR_EX(cache_slot + 2, NULL);
384
16.3k
    }
385
62.2k
    return ZEND_DYNAMIC_PROPERTY_OFFSET;
386
62.2k
  }
387
388
62.9M
  flags = property_info->flags;
389
390
62.9M
  if (flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
391
62.8M
    const zend_class_entry *scope = get_fake_or_executed_scope();
392
393
62.8M
    if (property_info->ce != scope) {
394
662k
      if (flags & ZEND_ACC_CHANGED) {
395
466
        zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
396
397
        /* If there is a public/protected instance property on ce, don't try to use a
398
         * private static property on scope. If both are static, prefer the static
399
         * property on scope. This will throw a static property notice, rather than
400
         * a visibility error. */
401
466
        if (p && (!(p->flags & ZEND_ACC_STATIC) || (flags & ZEND_ACC_STATIC))) {
402
347
          property_info = p;
403
347
          flags = property_info->flags;
404
347
          goto found;
405
347
        } else if (flags & ZEND_ACC_PUBLIC) {
406
53
          goto found;
407
53
        }
408
466
      }
409
662k
      if (flags & ZEND_ACC_PRIVATE) {
410
428
        if (property_info->ce != ce) {
411
73
          goto dynamic;
412
355
        } else {
413
647
wrong:
414
          /* Information was available, but we were denied access.  Error out. */
415
647
          if (!silent) {
416
94
            zend_bad_property_access(property_info, ce, member);
417
94
          }
418
647
          return ZEND_WRONG_PROPERTY_OFFSET;
419
355
        }
420
661k
      } else {
421
661k
        ZEND_ASSERT(flags & ZEND_ACC_PROTECTED);
422
661k
        if (UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
423
292
          goto wrong;
424
292
        }
425
661k
      }
426
662k
    }
427
62.8M
  }
428
429
62.9M
found:
430
62.9M
  if (UNEXPECTED(flags & ZEND_ACC_STATIC)) {
431
129
    if (!silent) {
432
87
      zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
433
87
    }
434
129
    return ZEND_DYNAMIC_PROPERTY_OFFSET;
435
129
  }
436
437
62.9M
  if (property_info->hooks) {
438
4.63k
    *info_ptr = property_info;
439
4.63k
    if (cache_slot) {
440
2.68k
      CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)ZEND_HOOKED_PROPERTY_OFFSET);
441
2.68k
      CACHE_PTR_EX(cache_slot + 2, property_info);
442
2.68k
    }
443
4.63k
    return ZEND_HOOKED_PROPERTY_OFFSET;
444
4.63k
  }
445
446
62.8M
  offset = property_info->offset;
447
62.8M
  if (EXPECTED(!ZEND_TYPE_IS_SET(property_info->type))) {
448
927k
    property_info = NULL;
449
61.9M
  } else {
450
61.9M
    *info_ptr = property_info;
451
61.9M
  }
452
62.8M
  if (cache_slot) {
453
21.2k
    CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)(uintptr_t)offset);
454
21.2k
    CACHE_PTR_EX(cache_slot + 2, property_info);
455
21.2k
  }
456
62.8M
  return offset;
457
62.9M
}
458
/* }}} */
459
460
static ZEND_COLD void zend_wrong_offset(zend_class_entry *ce, zend_string *member) /* {{{ */
461
36
{
462
36
  const zend_property_info *dummy;
463
464
  /* Trigger the correct error */
465
36
  zend_get_property_offset(ce, member, 0, NULL, &dummy);
466
36
}
467
/* }}} */
468
469
ZEND_API zend_property_info *zend_get_property_info(const zend_class_entry *ce, zend_string *member, int silent) /* {{{ */
470
2.88M
{
471
2.88M
  zend_property_info *property_info;
472
2.88M
  uint32_t flags;
473
474
2.88M
  if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)
475
2.87M
   || EXPECTED((property_info = zend_hash_find_ptr(&ce->properties_info, member)) == NULL)) {
476
9.66k
    if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0') && ZSTR_LEN(member) != 0) {
477
1.52k
      if (!silent) {
478
0
        zend_bad_property_name();
479
0
      }
480
1.52k
      return ZEND_WRONG_PROPERTY_INFO;
481
1.52k
    }
482
8.27k
dynamic:
483
8.27k
    return NULL;
484
9.66k
  }
485
486
2.87M
  flags = property_info->flags;
487
488
2.87M
  if (flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
489
2.86M
    const zend_class_entry *scope = get_fake_or_executed_scope();
490
2.86M
    if (property_info->ce != scope) {
491
699
      if (flags & ZEND_ACC_CHANGED) {
492
188
        zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
493
494
188
        if (p) {
495
114
          property_info = p;
496
114
          flags = property_info->flags;
497
114
          goto found;
498
114
        } else if (flags & ZEND_ACC_PUBLIC) {
499
18
          goto found;
500
18
        }
501
188
      }
502
567
      if (flags & ZEND_ACC_PRIVATE) {
503
507
        if (property_info->ce != ce) {
504
131
          goto dynamic;
505
376
        } else {
506
403
wrong:
507
          /* Information was available, but we were denied access.  Error out. */
508
403
          if (!silent) {
509
0
            zend_bad_property_access(property_info, ce, member);
510
0
          }
511
403
          return ZEND_WRONG_PROPERTY_INFO;
512
376
        }
513
507
      } else {
514
60
        ZEND_ASSERT(flags & ZEND_ACC_PROTECTED);
515
60
        if (UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
516
27
          goto wrong;
517
27
        }
518
60
      }
519
567
    }
520
2.86M
  }
521
522
2.86M
found:
523
2.86M
  if (UNEXPECTED(flags & ZEND_ACC_STATIC)) {
524
2.38k
    if (!silent) {
525
0
      zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
526
0
    }
527
2.38k
  }
528
2.86M
  return property_info;
529
2.87M
}
530
/* }}} */
531
532
ZEND_API zend_result zend_check_property_access(const zend_object *zobj, zend_string *prop_info_name, bool is_dynamic) /* {{{ */
533
2.39k
{
534
2.39k
  zend_property_info *property_info;
535
2.39k
  const char *class_name = NULL;
536
2.39k
  const char *prop_name;
537
2.39k
  zend_string *member;
538
2.39k
  size_t prop_name_len;
539
540
2.39k
  if (ZSTR_VAL(prop_info_name)[0] == 0) {
541
807
    if (is_dynamic) {
542
0
      return SUCCESS;
543
0
    }
544
545
807
    zend_unmangle_property_name_ex(prop_info_name, &class_name, &prop_name, &prop_name_len);
546
807
    member = zend_string_init(prop_name, prop_name_len, 0);
547
807
    property_info = zend_get_property_info(zobj->ce, member, 1);
548
807
    zend_string_release_ex(member, 0);
549
807
    if (property_info == NULL || property_info == ZEND_WRONG_PROPERTY_INFO) {
550
464
      return FAILURE;
551
464
    }
552
553
343
    if (class_name[0] != '*') {
554
257
      if (!(property_info->flags & ZEND_ACC_PRIVATE)) {
555
        /* we we're looking for a private prop but found a non private one of the same name */
556
9
        return FAILURE;
557
248
      } else if (strcmp(ZSTR_VAL(prop_info_name)+1, ZSTR_VAL(property_info->name)+1)) {
558
        /* we we're looking for a private prop but found a private one of the same name but another class */
559
51
        return FAILURE;
560
51
      }
561
257
    } else {
562
      /* We were looking for a protected property but found a private one
563
       * belonging to the parent class. */
564
86
      if (property_info->flags & ZEND_ACC_PRIVATE) {
565
6
        return FAILURE;
566
6
      }
567
80
      ZEND_ASSERT(property_info->flags & ZEND_ACC_PROTECTED);
568
80
    }
569
277
    return SUCCESS;
570
1.58k
  } else {
571
1.58k
    property_info = zend_get_property_info(zobj->ce, prop_info_name, 1);
572
1.58k
    if (property_info == NULL) {
573
162
      ZEND_ASSERT(is_dynamic);
574
162
      return SUCCESS;
575
1.42k
    } else if (property_info == ZEND_WRONG_PROPERTY_INFO) {
576
0
      return FAILURE;
577
0
    }
578
1.42k
    return (property_info->flags & ZEND_ACC_PUBLIC) ? SUCCESS : FAILURE;
579
1.58k
  }
580
2.39k
}
581
/* }}} */
582
583
5.43k
ZEND_API bool ZEND_FASTCALL zend_asymmetric_property_has_set_access(const zend_property_info *prop_info) {
584
5.43k
  ZEND_ASSERT(prop_info->flags & ZEND_ACC_PPP_SET_MASK);
585
5.43k
  ZEND_ASSERT(!(prop_info->flags & ZEND_ACC_PUBLIC_SET));
586
5.43k
  const zend_class_entry *scope = get_fake_or_executed_scope();
587
5.43k
  if (prop_info->ce == scope) {
588
4.59k
    return true;
589
4.59k
  }
590
845
  return EXPECTED((prop_info->flags & ZEND_ACC_PROTECTED_SET)
591
5.43k
    && is_protected_compatible_scope(prop_info->prototype->ce, scope));
592
5.43k
}
593
594
1.31k
static void zend_property_guard_dtor(zval *el) /* {{{ */ {
595
1.31k
  uint32_t *ptr = (uint32_t*)Z_PTR_P(el);
596
1.31k
  if (EXPECTED(!(((uintptr_t)ptr) & 1))) {
597
880
    efree_size(ptr, sizeof(uint32_t));
598
880
  }
599
1.31k
}
600
/* }}} */
601
602
static zend_always_inline zval *zend_get_guard_value(zend_object *zobj)
603
10.6k
{
604
10.6k
  return zobj->properties_table + zobj->ce->default_properties_count;
605
10.6k
}
606
607
ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *member) /* {{{ */
608
9.57k
{
609
9.57k
  HashTable *guards;
610
9.57k
  zval *zv;
611
9.57k
  uint32_t *ptr;
612
613
614
9.57k
  ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS);
615
9.57k
  zv = zend_get_guard_value(zobj);
616
9.57k
  if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
617
4.14k
    zend_string *str = Z_STR_P(zv);
618
4.14k
    if (EXPECTED(str == member) ||
619
        /* str and member don't necessarily have a pre-calculated hash value here */
620
2.71k
        EXPECTED(zend_string_equal_content(str, member))) {
621
2.71k
      return &Z_GUARD_P(zv);
622
2.71k
    } else if (EXPECTED(Z_GUARD_P(zv) == 0)) {
623
990
      zval_ptr_dtor_str(zv);
624
990
      ZVAL_STR_COPY(zv, member);
625
990
      return &Z_GUARD_P(zv);
626
990
    } else {
627
438
      ALLOC_HASHTABLE(guards);
628
438
      zend_hash_init(guards, 8, NULL, zend_property_guard_dtor, 0);
629
      /* mark pointer as "special" using low bit */
630
438
      zend_hash_add_new_ptr(guards, str,
631
438
        (void*)(((uintptr_t)&Z_GUARD_P(zv)) | 1));
632
438
      zval_ptr_dtor_str(zv);
633
438
      ZVAL_ARR(zv, guards);
634
438
    }
635
5.42k
  } else if (EXPECTED(Z_TYPE_P(zv) == IS_ARRAY)) {
636
3.55k
    guards = Z_ARRVAL_P(zv);
637
3.55k
    ZEND_ASSERT(guards != NULL);
638
3.55k
    void *guard = zend_hash_find_ptr(guards, member);
639
3.55k
    if (guard != NULL) {
640
3.11k
      return (uint32_t*)(((uintptr_t)guard) & ~1);
641
3.11k
    }
642
3.55k
  } else {
643
1.87k
    ZEND_ASSERT(Z_TYPE_P(zv) == IS_UNDEF);
644
1.87k
    ZVAL_STR_COPY(zv, member);
645
1.87k
    Z_GUARD_P(zv) &= ~ZEND_GUARD_PROPERTY_MASK;
646
1.87k
    return &Z_GUARD_P(zv);
647
1.87k
  }
648
  /* we have to allocate uint32_t separately because ht->arData may be reallocated */
649
880
  ptr = (uint32_t*)emalloc(sizeof(uint32_t));
650
880
  *ptr = 0;
651
880
  return (uint32_t*)zend_hash_add_new_ptr(guards, member, ptr);
652
9.57k
}
653
/* }}} */
654
655
ZEND_API uint32_t *zend_get_recursion_guard(zend_object *zobj)
656
19.6k
{
657
19.6k
  if (!(zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
658
18.5k
    return NULL;
659
18.5k
  }
660
1.11k
  zval *zv = zend_get_guard_value(zobj);
661
1.11k
  return &Z_GUARD_P(zv);
662
19.6k
}
663
664
static zend_always_inline zend_object *zend_lazy_proxy_get_guarded_instance(
665
    zend_object *zobj, zend_string *name, uint32_t guard_type)
666
53.3k
{
667
53.3k
  if (UNEXPECTED(zend_object_is_lazy_proxy(zobj)
668
53.3k
      && zend_lazy_object_initialized(zobj))) {
669
240
    zend_object *instance = zend_lazy_object_get_instance(zobj);
670
240
    if (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS) {
671
213
      uint32_t *instance_guard = zend_get_property_guard(instance, name);
672
213
      if ((*instance_guard) & guard_type) {
673
96
        return instance;
674
96
      }
675
213
    }
676
240
  }
677
678
53.2k
  return NULL;
679
53.3k
}
680
681
ZEND_COLD static void zend_typed_property_uninitialized_access(const zend_property_info *prop_info, zend_string *name)
682
260
{
683
260
  zend_throw_error(NULL, "Typed property %s::$%s must not be accessed before initialization",
684
260
    ZSTR_VAL(prop_info->ce->name),
685
260
    ZSTR_VAL(name));
686
260
}
687
688
static ZEND_FUNCTION(zend_parent_hook_get_trampoline);
689
static ZEND_FUNCTION(zend_parent_hook_set_trampoline);
690
691
static bool zend_is_in_hook(const zend_property_info *prop_info)
692
10.2k
{
693
10.2k
  const zend_execute_data *execute_data = EG(current_execute_data);
694
10.2k
  if (!execute_data || !EX(func) || !EX(func)->common.prop_info) {
695
6.91k
    return false;
696
6.91k
  }
697
698
3.35k
  const zend_property_info *parent_info = EX(func)->common.prop_info;
699
3.35k
  ZEND_ASSERT(prop_info->prototype && parent_info->prototype);
700
3.35k
  return prop_info->prototype == parent_info->prototype;
701
3.35k
}
702
703
static bool zend_should_call_hook(const zend_property_info *prop_info, const zend_object *obj)
704
9.69k
{
705
9.69k
  if (!zend_is_in_hook(prop_info)) {
706
8.35k
    return true;
707
8.35k
  }
708
709
  /* execute_data and This are guaranteed to be set if zend_is_in_hook() returns true. */
710
1.34k
  zend_object *parent_obj = Z_OBJ(EG(current_execute_data)->This);
711
1.34k
  if (parent_obj == obj) {
712
1.27k
    return false;
713
1.27k
  }
714
715
64
  if (zend_object_is_lazy_proxy(parent_obj)
716
38
   && zend_lazy_object_initialized(parent_obj)
717
38
   && zend_lazy_object_get_instance(parent_obj) == obj) {
718
38
    return false;
719
38
  }
720
721
26
  return true;
722
64
}
723
724
static ZEND_COLD void zend_throw_no_prop_backing_value_access(const zend_string *class_name, const zend_string *prop_name, bool is_read)
725
0
{
726
0
  zend_throw_error(NULL, "Must not %s virtual property %s::$%s",
727
0
    is_read ? "read from" : "write to",
728
0
    ZSTR_VAL(class_name), ZSTR_VAL(prop_name));
729
0
}
730
731
static bool zend_call_get_hook(
732
  const zend_property_info *prop_info, const zend_string *prop_name,
733
  zend_function *get, zend_object *zobj, zval *rv)
734
6.74k
{
735
6.74k
  if (!zend_should_call_hook(prop_info, zobj)) {
736
767
    if (UNEXPECTED(prop_info->flags & ZEND_ACC_VIRTUAL)) {
737
0
      zend_throw_no_prop_backing_value_access(zobj->ce->name, prop_name, /* is_read */ true);
738
0
    }
739
767
    return false;
740
767
  }
741
742
5.98k
  GC_ADDREF(zobj);
743
5.98k
  zend_call_known_instance_method_with_0_params(get, zobj, rv);
744
5.98k
  OBJ_RELEASE(zobj);
745
746
5.98k
  return true;
747
6.74k
}
748
749
ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int type, void **cache_slot, zval *rv) /* {{{ */
750
61.9M
{
751
61.9M
  zval *retval;
752
61.9M
  uintptr_t property_offset;
753
61.9M
  const zend_property_info *prop_info = NULL;
754
61.9M
  uint32_t *guard = NULL;
755
756
#if DEBUG_OBJECT_HANDLERS
757
  fprintf(stderr, "Read object #%d property: %s\n", zobj->handle, ZSTR_VAL(name));
758
#endif
759
760
  /* make zend_get_property_info silent if we have getter - we may want to use it */
761
61.9M
  property_offset = zend_get_property_offset(zobj->ce, name, (type == BP_VAR_IS) || (zobj->ce->__get != NULL), cache_slot, &prop_info);
762
763
61.9M
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
764
61.9M
try_again:
765
61.9M
    retval = OBJ_PROP(zobj, property_offset);
766
767
61.9M
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))
768
4.39k
     && (type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)
769
453
     && ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info))) {
770
453
      if (Z_TYPE_P(retval) == IS_OBJECT) {
771
        /* For objects, W/RW/UNSET fetch modes might not actually modify object.
772
         * Similar as with magic __get() allow them, but return the value as a copy
773
         * to make sure no actual modification is possible. */
774
183
        ZVAL_COPY(rv, retval);
775
183
        retval = rv;
776
183
        goto exit;
777
270
      } else if (Z_TYPE_P(retval) == IS_UNDEF && type == BP_VAR_UNSET) {
778
65
        retval = &EG(uninitialized_zval);
779
65
        goto exit;
780
65
      }
781
205
      if (prop_info->flags & ZEND_ACC_READONLY) {
782
132
        zend_readonly_property_indirect_modification_error(prop_info);
783
132
      } else {
784
73
        zend_asymmetric_visibility_property_modification_error(prop_info, "indirectly modify");
785
73
      }
786
205
      retval = &EG(uninitialized_zval);
787
205
      goto exit;
788
453
    }
789
61.9M
    if (EXPECTED(Z_TYPE_P(retval) != IS_UNDEF)) {
790
61.9M
      goto exit;
791
61.9M
    }
792
879
    if (UNEXPECTED(Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT)) {
793
      /* Skip __get() for uninitialized typed properties */
794
658
      goto uninit_error;
795
658
    }
796
20.4k
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
797
13.1k
    if (EXPECTED(zobj->properties != NULL)) {
798
3.64k
      if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
799
35
        uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
800
801
35
        if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
802
35
          Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
803
804
35
          if (EXPECTED(p->key == name) ||
805
0
                (EXPECTED(p->h == ZSTR_H(name)) &&
806
0
                 EXPECTED(p->key != NULL) &&
807
35
                 EXPECTED(zend_string_equal_content(p->key, name)))) {
808
35
            retval = &p->val;
809
35
            goto exit;
810
35
          }
811
35
        }
812
0
        CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
813
0
      }
814
3.61k
      retval = zend_hash_find(zobj->properties, name);
815
3.61k
      if (EXPECTED(retval)) {
816
1.36k
        if (cache_slot) {
817
968
          uintptr_t idx = (char*)retval - (char*)zobj->properties->arData;
818
968
          CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
819
968
        }
820
1.36k
        goto exit;
821
1.36k
      }
822
3.61k
    }
823
13.1k
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
824
6.96k
    zend_function *get = prop_info->hooks[ZEND_PROPERTY_HOOK_GET];
825
6.96k
    if (!get) {
826
313
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
827
9
        zend_throw_error(NULL, "Cannot read from set-only virtual property %s::$%s",
828
9
          ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
829
9
        return &EG(uninitialized_zval);
830
9
      }
831
      /* Cache the fact that this hook has trivial read. This only applies to
832
       * BP_VAR_R and BP_VAR_IS fetches. */
833
304
      ZEND_SET_PROPERTY_HOOK_SIMPLE_READ(cache_slot);
834
835
304
      retval = OBJ_PROP(zobj, prop_info->offset);
836
304
      if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
837
        /* As hooked properties can't be unset, the only way to end up with an undef
838
         * value is via an uninitialized property. */
839
46
        ZEND_ASSERT(Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT);
840
46
        goto uninit_error;
841
46
      }
842
843
258
      if (UNEXPECTED(type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)) {
844
17
        if (UNEXPECTED(Z_TYPE_P(retval) != IS_OBJECT)) {
845
17
          zend_throw_error(NULL, "Indirect modification of %s::$%s is not allowed",
846
17
            ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
847
17
          goto exit;
848
17
        }
849
0
        ZVAL_COPY(rv, retval);
850
0
        retval = rv;
851
0
      }
852
241
      goto exit;
853
258
    }
854
855
6.64k
    const zend_class_entry *ce = zobj->ce;
856
857
6.64k
    if (!zend_call_get_hook(prop_info, name, get, zobj, rv)) {
858
762
      if (EG(exception)) {
859
0
        return &EG(uninitialized_zval);
860
0
      }
861
862
      /* Reads from backing store can only occur in hooks, and hence will always remain simple. */
863
762
      const zend_execute_data *execute_data = EG(current_execute_data);
864
762
      if (cache_slot && EX(opline) && EX(opline)->opcode == ZEND_FETCH_OBJ_R && EX(opline)->op1_type == IS_UNUSED) {
865
426
        ZEND_SET_PROPERTY_HOOK_SIMPLE_READ(cache_slot);
866
426
      }
867
868
762
      property_offset = prop_info->offset;
869
762
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
870
649
        prop_info = NULL;
871
649
      }
872
762
      goto try_again;
873
762
    }
874
875
5.88k
    if (EXPECTED(cache_slot
876
5.88k
     && zend_execute_ex == execute_ex
877
5.88k
     && ce->default_object_handlers->read_property == zend_std_read_property
878
5.88k
     && !ce->create_object
879
5.88k
     && !zend_is_in_hook(prop_info)
880
5.88k
     && !(prop_info->hooks[ZEND_PROPERTY_HOOK_GET]->common.fn_flags & ZEND_ACC_RETURN_REFERENCE))) {
881
514
      ZEND_SET_PROPERTY_HOOK_SIMPLE_GET(cache_slot);
882
514
    }
883
884
5.88k
    if (Z_TYPE_P(rv) != IS_UNDEF) {
885
2.45k
      retval = rv;
886
2.45k
      if (!Z_ISREF_P(rv)
887
2.18k
       && (type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)
888
106
       && UNEXPECTED(Z_TYPE_P(rv) != IS_OBJECT)) {
889
74
        zend_throw_error(NULL, "Indirect modification of %s::$%s is not allowed",
890
74
          ZSTR_VAL(ce->name), ZSTR_VAL(name));
891
74
      }
892
3.42k
    } else {
893
3.42k
      retval = &EG(uninitialized_zval);
894
3.42k
    }
895
896
5.88k
    goto exit;
897
6.64k
  } else if (UNEXPECTED(EG(exception))) {
898
39
    retval = &EG(uninitialized_zval);
899
39
    goto exit;
900
39
  }
901
902
12.2k
  retval = &EG(uninitialized_zval);
903
904
  /* For initialized lazy proxies: if the real instance's magic method
905
   * guard is already set for this property, we are inside a recursive
906
   * call from the real instance's __get/__isset. Forward directly to
907
   * the real instance to avoid double invocation. (GH-21478) */
908
12.2k
  {
909
12.2k
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name,
910
12.2k
      ((type == BP_VAR_IS) && zobj->ce->__isset) ? IN_ISSET : IN_GET);
911
12.2k
    if (instance) {
912
57
      retval = zend_std_read_property(instance, name, type, cache_slot, rv);
913
57
      if (retval == &EG(uninitialized_zval)) {
914
21
        ZVAL_NULL(rv);
915
21
        retval = rv;
916
21
      }
917
57
      return retval;
918
57
    }
919
12.2k
  }
920
921
  /* magic isset */
922
12.2k
  if ((type == BP_VAR_IS) && zobj->ce->__isset) {
923
660
    zval tmp_result;
924
660
    guard = zend_get_property_guard(zobj, name);
925
926
660
    if (!((*guard) & IN_ISSET)) {
927
450
      GC_ADDREF(zobj);
928
929
450
      *guard |= IN_ISSET;
930
450
      zend_std_call_issetter(zobj, name, &tmp_result);
931
450
      *guard &= ~IN_ISSET;
932
933
450
      if (!zend_is_true(&tmp_result)) {
934
304
        retval = &EG(uninitialized_zval);
935
304
        OBJ_RELEASE(zobj);
936
304
        zval_ptr_dtor(&tmp_result);
937
304
        goto exit;
938
304
      }
939
940
146
      zval_ptr_dtor(&tmp_result);
941
942
      /* __isset() may have materialised the property by writing into
943
       * the property table. Re-check it before deferring to __get(),
944
       * so the freshly-written value is returned directly without a
945
       * redundant __get() call (GH-12695). The value is copied into
946
       * `rv` because the property table can be freed by the OBJ_RELEASE
947
       * below (e.g. when __isset() drops the last external reference
948
       * to the object). */
949
146
      if (IS_VALID_PROPERTY_OFFSET(property_offset)) {
950
15
        retval = OBJ_PROP(zobj, property_offset);
951
15
        if (Z_TYPE_P(retval) != IS_UNDEF) {
952
13
          ZVAL_COPY(rv, retval);
953
13
          retval = rv;
954
13
          OBJ_RELEASE(zobj);
955
13
          goto exit;
956
13
        }
957
131
      } else if (IS_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
958
131
        if (zobj->properties != NULL) {
959
12
          retval = zend_hash_find(zobj->properties, name);
960
12
          if (retval) {
961
12
            ZVAL_COPY(rv, retval);
962
12
            retval = rv;
963
12
            OBJ_RELEASE(zobj);
964
12
            goto exit;
965
12
          }
966
12
        }
967
131
      }
968
121
      retval = &EG(uninitialized_zval);
969
970
121
      if (zobj->ce->__get && !((*guard) & IN_GET)) {
971
71
        goto call_getter;
972
71
      }
973
50
      OBJ_RELEASE(zobj);
974
210
    } else if (zobj->ce->__get && !((*guard) & IN_GET)) {
975
87
      goto call_getter_addref;
976
87
    }
977
11.5k
  } else if (zobj->ce->__get) {
978
    /* magic get */
979
4.30k
    guard = zend_get_property_guard(zobj, name);
980
4.30k
    if (!((*guard) & IN_GET)) {
981
      /* have getter - try with it! */
982
3.47k
call_getter_addref:
983
3.47k
      GC_ADDREF(zobj);
984
3.54k
call_getter:
985
3.54k
      *guard |= IN_GET; /* prevent circular getting */
986
3.54k
      zend_std_call_getter(zobj, name, rv);
987
3.54k
      *guard &= ~IN_GET;
988
989
3.54k
      if (Z_TYPE_P(rv) != IS_UNDEF) {
990
3.08k
        retval = rv;
991
3.08k
        if (!Z_ISREF_P(rv) &&
992
2.09k
            (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
993
611
          if (UNEXPECTED(Z_TYPE_P(rv) != IS_OBJECT)) {
994
511
            zend_error(E_NOTICE, "Indirect modification of overloaded property %s::$%s has no effect", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
995
511
          }
996
611
        }
997
3.08k
      } else {
998
453
        retval = &EG(uninitialized_zval);
999
453
      }
1000
1001
3.54k
      if (prop_info) {
1002
56
        zend_verify_prop_assignable_by_ref_ex(prop_info, retval, (zobj->ce->__get->common.fn_flags & ZEND_ACC_STRICT_TYPES) != 0, ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_MAGIC_GET);
1003
56
      }
1004
1005
3.54k
      OBJ_RELEASE(zobj);
1006
3.54k
      goto exit;
1007
3.47k
    } else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1008
      /* Trigger the correct error */
1009
15
      zend_wrong_offset(zobj->ce, name);
1010
15
      ZEND_ASSERT(EG(exception));
1011
15
      retval = &EG(uninitialized_zval);
1012
15
      goto exit;
1013
15
    }
1014
4.30k
  }
1015
1016
9.03k
uninit_error:
1017
9.03k
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1018
676
    if (!prop_info || (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY)) {
1019
661
      zend_object *instance = zend_lazy_object_init(zobj);
1020
661
      if (!instance) {
1021
120
        retval = &EG(uninitialized_zval);
1022
120
        goto exit;
1023
120
      }
1024
1025
541
      if (UNEXPECTED(guard && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS))) {
1026
        /* Find which guard was used on zobj, so we can set the same
1027
         * guard on instance. */
1028
35
        uint32_t guard_type = (type == BP_VAR_IS) && zobj->ce->__isset
1029
35
          ? IN_ISSET : IN_GET;
1030
35
        guard = zend_get_property_guard(instance, name);
1031
35
        if (!((*guard) & guard_type)) {
1032
28
          (*guard) |= guard_type;
1033
28
          retval = zend_std_read_property(instance, name, type, cache_slot, rv);
1034
28
          (*guard) &= ~guard_type;
1035
28
          return retval;
1036
28
        }
1037
35
      }
1038
1039
513
      return zend_std_read_property(instance, name, type, cache_slot, rv);
1040
541
    }
1041
676
  }
1042
8.37k
  if (type != BP_VAR_IS) {
1043
7.49k
    if (prop_info) {
1044
166
      zend_typed_property_uninitialized_access(prop_info, name);
1045
7.32k
    } else {
1046
7.32k
      zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1047
7.32k
    }
1048
7.49k
  }
1049
8.37k
  retval = &EG(uninitialized_zval);
1050
1051
61.9M
exit:
1052
61.9M
  return retval;
1053
8.37k
}
1054
/* }}} */
1055
1056
1.18M
static zend_always_inline bool property_uses_strict_types(void) {
1057
1.18M
  const zend_execute_data *execute_data = EG(current_execute_data);
1058
1.18M
  return execute_data
1059
1.00M
    && execute_data->func
1060
1.00M
    && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
1061
1.18M
}
1062
1063
static zval *forward_write_to_lazy_object(zend_object *zobj,
1064
    zend_string *name, zval *value, void **cache_slot, bool guarded)
1065
309
{
1066
309
  zval *variable_ptr;
1067
1068
  /* backup value as it may change during initialization */
1069
309
  zval backup;
1070
309
  ZVAL_COPY(&backup, value);
1071
1072
309
  zend_object *instance = zend_lazy_object_init(zobj);
1073
309
  if (UNEXPECTED(!instance)) {
1074
72
    zval_ptr_dtor(&backup);
1075
72
    return &EG(error_zval);
1076
72
  }
1077
1078
237
  if (UNEXPECTED(guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS))) {
1079
28
    uint32_t *guard = zend_get_property_guard(instance, name);
1080
28
    if (!((*guard) & IN_SET)) {
1081
22
      (*guard) |= IN_SET;
1082
22
      variable_ptr = zend_std_write_property(instance, name, &backup, cache_slot);
1083
22
      (*guard) &= ~IN_SET;
1084
22
      goto exit;
1085
22
    }
1086
28
  }
1087
1088
215
  variable_ptr = zend_std_write_property(instance, name, &backup, cache_slot);
1089
1090
236
exit:
1091
236
  zval_ptr_dtor(&backup);
1092
1093
236
  if (variable_ptr == &backup) {
1094
0
    variable_ptr = value;
1095
0
  }
1096
1097
236
  return variable_ptr;
1098
215
}
1099
1100
ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zval *value, void **cache_slot) /* {{{ */
1101
1.04M
{
1102
1.04M
  zval *variable_ptr, tmp;
1103
1.04M
  uintptr_t property_offset;
1104
1.04M
  const zend_property_info *prop_info = NULL;
1105
1.04M
  uint32_t *guard = NULL;
1106
1.04M
  ZEND_ASSERT(!Z_ISREF_P(value));
1107
1108
1.04M
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__set != NULL), cache_slot, &prop_info);
1109
1110
1.04M
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1111
993k
try_again:
1112
993k
    variable_ptr = OBJ_PROP(zobj, property_offset);
1113
1114
993k
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1115
5.45k
      bool error;
1116
5.45k
      if (Z_TYPE_P(variable_ptr) != IS_UNDEF || (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_UNINIT) || !zobj->ce->__set) {
1117
5.43k
        error = true;
1118
5.43k
      } else {
1119
22
        guard = zend_get_property_guard(zobj, name);
1120
22
        error = (*guard) & IN_SET;
1121
22
      }
1122
5.45k
      if (error) {
1123
5.44k
        if ((prop_info->flags & ZEND_ACC_READONLY)
1124
4.53k
         && Z_TYPE_P(variable_ptr) != IS_UNDEF
1125
393
         && !(Z_PROP_FLAG_P(variable_ptr) & IS_PROP_REINITABLE)) {
1126
269
          zend_readonly_property_modification_error(prop_info);
1127
269
          variable_ptr = &EG(error_zval);
1128
269
          goto exit;
1129
269
        }
1130
5.17k
        if ((prop_info->flags & ZEND_ACC_PPP_SET_MASK) && !zend_asymmetric_property_has_set_access(prop_info)) {
1131
187
          zend_asymmetric_visibility_property_modification_error(prop_info, "modify");
1132
187
          variable_ptr = &EG(error_zval);
1133
187
          if (cache_slot) {
1134
            /* Reset cache slot to dodge fast path in next execution. */
1135
171
            CACHE_POLYMORPHIC_PTR_EX(cache_slot, NULL, NULL);
1136
171
            CACHE_PTR_EX(cache_slot + 2, NULL);
1137
171
          }
1138
187
          goto exit;
1139
187
        }
1140
5.17k
      }
1141
5.45k
    }
1142
1143
992k
    if (Z_TYPE_P(variable_ptr) != IS_UNDEF) {
1144
982k
      Z_TRY_ADDREF_P(value);
1145
1146
982k
      if (prop_info) {
1147
185k
typed_property:
1148
185k
        ZVAL_COPY_VALUE(&tmp, value);
1149
        // Increase refcount to prevent object from being released in __toString()
1150
185k
        GC_ADDREF(zobj);
1151
185k
        bool type_matched = zend_verify_property_type(prop_info, &tmp, property_uses_strict_types());
1152
185k
        if (UNEXPECTED(GC_DELREF(zobj) == 0)) {
1153
16
          zend_object_released_while_assigning_to_property_error(prop_info);
1154
16
          zend_objects_store_del(zobj);
1155
16
          zval_ptr_dtor(&tmp);
1156
16
          variable_ptr = &EG(error_zval);
1157
16
          goto exit;
1158
16
        }
1159
185k
        if (UNEXPECTED(!type_matched)) {
1160
405
          zval_ptr_dtor(&tmp);
1161
405
          variable_ptr = &EG(error_zval);
1162
405
          goto exit;
1163
405
        }
1164
185k
        Z_PROP_FLAG_P(variable_ptr) &= ~(IS_PROP_UNINIT|IS_PROP_REINITABLE);
1165
185k
        value = &tmp;
1166
185k
      }
1167
1168
1.00M
found:;
1169
1.00M
      zend_refcounted *garbage = NULL;
1170
1171
1.00M
      variable_ptr = zend_assign_to_variable_ex(
1172
1.00M
        variable_ptr, value, IS_TMP_VAR, property_uses_strict_types(), &garbage);
1173
1174
1.00M
      if (garbage) {
1175
6.32k
        if (GC_DELREF(garbage) == 0) {
1176
3.38k
          zend_execute_data *execute_data = EG(current_execute_data);
1177
          // Assign to result variable before calling the destructor as it may release the object
1178
3.38k
          if (execute_data
1179
1.17k
           && EX(func)
1180
1.17k
           && ZEND_USER_CODE(EX(func)->common.type)
1181
493
           && EX(opline)
1182
493
           && EX(opline)->opcode == ZEND_ASSIGN_OBJ
1183
493
           && EX(opline)->result_type) {
1184
141
            ZVAL_COPY_DEREF(EX_VAR(EX(opline)->result.var), variable_ptr);
1185
141
            variable_ptr = NULL;
1186
141
          }
1187
3.38k
          rc_dtor_func(garbage);
1188
3.38k
        } else {
1189
2.94k
          gc_check_possible_root_no_ref(garbage);
1190
2.94k
        }
1191
6.32k
      }
1192
1.00M
      goto exit;
1193
982k
    }
1194
10.2k
    if (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_UNINIT) {
1195
10.0k
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1196
810
        if (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_LAZY) {
1197
256
          goto lazy_init;
1198
256
        }
1199
810
      }
1200
      /* Writes to uninitialized typed properties bypass __set(). */
1201
9.83k
      goto write_std_property;
1202
10.0k
    }
1203
53.0k
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
1204
50.2k
    if (EXPECTED(zobj->properties != NULL)) {
1205
23.7k
      if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1206
65
        if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1207
65
          GC_DELREF(zobj->properties);
1208
65
        }
1209
65
        zobj->properties = zend_array_dup(zobj->properties);
1210
65
      }
1211
23.7k
      if ((variable_ptr = zend_hash_find(zobj->properties, name)) != NULL) {
1212
10.8k
        Z_TRY_ADDREF_P(value);
1213
10.8k
        goto found;
1214
10.8k
      }
1215
23.7k
    }
1216
50.2k
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1217
2.60k
    zend_function *set = prop_info->hooks[ZEND_PROPERTY_HOOK_SET];
1218
1219
2.60k
    if (!set) {
1220
59
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
1221
12
        zend_throw_error(NULL, "Cannot write to get-only virtual property %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1222
12
        variable_ptr = &EG(error_zval);
1223
12
        goto exit;
1224
12
      }
1225
47
      ZEND_SET_PROPERTY_HOOK_SIMPLE_WRITE(cache_slot);
1226
47
      property_offset = prop_info->offset;
1227
47
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1228
31
        prop_info = NULL;
1229
31
      }
1230
47
      goto try_again;
1231
59
    }
1232
1233
2.54k
    if (!zend_should_call_hook(prop_info, zobj)) {
1234
383
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
1235
0
        zend_throw_no_prop_backing_value_access(zobj->ce->name, name, /* is_read */ false);
1236
0
        variable_ptr = &EG(error_zval);
1237
0
        goto exit;
1238
0
      }
1239
1240
      /* Writes to backing store can only occur in hooks, and hence will always remain simple. */
1241
383
      zend_execute_data *execute_data = EG(current_execute_data);
1242
383
      if (cache_slot && EX(opline) && EX(opline)->opcode == ZEND_ASSIGN_OBJ && EX(opline)->op1_type == IS_UNUSED) {
1243
360
        ZEND_SET_PROPERTY_HOOK_SIMPLE_WRITE(cache_slot);
1244
360
      }
1245
1246
383
      property_offset = prop_info->offset;
1247
383
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1248
202
        prop_info = NULL;
1249
202
      }
1250
383
      goto try_again;
1251
383
    }
1252
1253
2.16k
    if (UNEXPECTED(prop_info->flags & ZEND_ACC_PPP_SET_MASK
1254
2.16k
     && !zend_asymmetric_property_has_set_access(prop_info))) {
1255
5
      zend_asymmetric_visibility_property_modification_error(prop_info, "modify");
1256
5
      variable_ptr = &EG(error_zval);
1257
5
      goto exit;
1258
5
    }
1259
1260
2.16k
    GC_ADDREF(zobj);
1261
2.16k
    zend_call_known_instance_method_with_1_params(set, zobj, NULL, value);
1262
2.16k
    OBJ_RELEASE(zobj);
1263
1264
2.16k
    variable_ptr = value;
1265
2.16k
    goto exit;
1266
2.16k
  } else if (UNEXPECTED(EG(exception))) {
1267
40
    variable_ptr = &EG(error_zval);
1268
40
    goto exit;
1269
40
  }
1270
1271
  /* For initialized lazy proxies: if the real instance's __set guard
1272
   * is already set, we are inside a recursive call from the real
1273
   * instance's __set. Forward directly to avoid double invocation. */
1274
39.7k
  {
1275
39.7k
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_SET);
1276
39.7k
    if (instance) {
1277
22
      return zend_std_write_property(instance, name, value, cache_slot);
1278
22
    }
1279
39.7k
  }
1280
1281
  /* magic set */
1282
39.7k
  if (zobj->ce->__set) {
1283
1.86k
    if (!guard) {
1284
1.85k
      guard = zend_get_property_guard(zobj, name);
1285
1.85k
    }
1286
1287
1.86k
    if (!((*guard) & IN_SET)) {
1288
1.62k
      GC_ADDREF(zobj);
1289
1.62k
      (*guard) |= IN_SET; /* prevent circular setting */
1290
1.62k
      zend_std_call_setter(zobj, name, value);
1291
1.62k
      (*guard) &= ~IN_SET;
1292
1.62k
      OBJ_RELEASE(zobj);
1293
1.62k
      variable_ptr = value;
1294
1.62k
    } else if (EXPECTED(!IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1295
234
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1296
28
        return forward_write_to_lazy_object(zobj, name, value,
1297
28
            cache_slot, /* guarded */ true);
1298
28
      }
1299
1300
206
      goto write_std_property;
1301
234
    } else {
1302
      /* Trigger the correct error */
1303
12
      zend_wrong_offset(zobj->ce, name);
1304
12
      ZEND_ASSERT(EG(exception));
1305
12
      variable_ptr = &EG(error_zval);
1306
12
      goto exit;
1307
12
    }
1308
37.8k
  } else {
1309
37.8k
    ZEND_ASSERT(!IS_WRONG_PROPERTY_OFFSET(property_offset));
1310
37.8k
    if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1311
25
      goto lazy_init;
1312
25
    }
1313
47.8k
write_std_property:
1314
47.8k
    if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1315
9.95k
      variable_ptr = OBJ_PROP(zobj, property_offset);
1316
1317
9.95k
      Z_TRY_ADDREF_P(value);
1318
9.95k
      if (prop_info) {
1319
9.55k
        goto typed_property;
1320
9.55k
      }
1321
1322
396
      ZVAL_COPY_VALUE(variable_ptr, value);
1323
37.9k
    } else {
1324
37.9k
      if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
1325
54
        zend_forbidden_dynamic_property(zobj->ce, name);
1326
54
        variable_ptr = &EG(error_zval);
1327
54
        goto exit;
1328
54
      }
1329
37.8k
      if (UNEXPECTED(!(zobj->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES))) {
1330
16.3k
        if (UNEXPECTED(!zend_deprecated_dynamic_property(zobj, name))) {
1331
0
          variable_ptr = &EG(error_zval);
1332
0
          goto exit;
1333
0
        }
1334
16.3k
      }
1335
1336
37.8k
      Z_TRY_ADDREF_P(value);
1337
37.8k
      variable_ptr = zend_hash_add_new(zend_std_get_properties(zobj), name, value);
1338
37.8k
    }
1339
47.8k
  }
1340
1341
1.04M
exit:
1342
1.04M
  return variable_ptr;
1343
1344
281
lazy_init:
1345
281
  return forward_write_to_lazy_object(zobj, name, value, cache_slot,
1346
281
      /* guarded */ false);
1347
39.7k
}
1348
/* }}} */
1349
1350
static ZEND_COLD zend_never_inline void zend_bad_array_access(const zend_class_entry *ce) /* {{{ */
1351
46
{
1352
46
  zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
1353
46
}
1354
/* }}} */
1355
1356
ZEND_API zval *zend_std_read_dimension(zend_object *object, zval *offset, int type, zval *rv) /* {{{ */
1357
1.30k
{
1358
1.30k
  const zend_class_entry *ce = object->ce;
1359
1.30k
  zval tmp_offset;
1360
1361
  /* arrayaccess_funcs_ptr is set if (and only if) the class implements zend_ce_arrayaccess */
1362
1.30k
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1363
1.30k
  if (EXPECTED(funcs)) {
1364
1.26k
    if (offset == NULL) {
1365
      /* [] construct */
1366
12
      ZVAL_NULL(&tmp_offset);
1367
1.25k
    } else {
1368
1.25k
      ZVAL_COPY_DEREF(&tmp_offset, offset);
1369
1.25k
    }
1370
1371
1.26k
    GC_ADDREF(object);
1372
1.26k
    if (type == BP_VAR_IS) {
1373
189
      zend_call_known_instance_method_with_1_params(funcs->zf_offsetexists, object, rv, &tmp_offset);
1374
189
      if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
1375
5
        OBJ_RELEASE(object);
1376
5
        zval_ptr_dtor(&tmp_offset);
1377
5
        return NULL;
1378
5
      }
1379
184
      if (!i_zend_is_true(rv)) {
1380
81
        OBJ_RELEASE(object);
1381
81
        zval_ptr_dtor(&tmp_offset);
1382
81
        zval_ptr_dtor(rv);
1383
81
        return &EG(uninitialized_zval);
1384
81
      }
1385
103
      zval_ptr_dtor(rv);
1386
103
    }
1387
1388
1.18k
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetget, object, rv, &tmp_offset);
1389
1390
1.18k
    OBJ_RELEASE(object);
1391
1.18k
    zval_ptr_dtor(&tmp_offset);
1392
1393
1.18k
    if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
1394
13
      if (UNEXPECTED(!EG(exception))) {
1395
0
        zend_throw_error(NULL, "Undefined offset for object of type %s used as array", ZSTR_VAL(ce->name));
1396
0
      }
1397
13
      return NULL;
1398
13
    }
1399
1.16k
    return rv;
1400
1.18k
  } else {
1401
36
      zend_bad_array_access(ce);
1402
36
    return NULL;
1403
36
  }
1404
1.30k
}
1405
/* }}} */
1406
1407
ZEND_API void zend_std_write_dimension(zend_object *object, zval *offset, zval *value) /* {{{ */
1408
425
{
1409
425
  const zend_class_entry *ce = object->ce;
1410
425
  zval tmp_offset;
1411
1412
425
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1413
425
  if (EXPECTED(funcs)) {
1414
420
    if (!offset) {
1415
29
      ZVAL_NULL(&tmp_offset);
1416
391
    } else {
1417
391
      ZVAL_COPY_DEREF(&tmp_offset, offset);
1418
391
    }
1419
420
    GC_ADDREF(object);
1420
420
    zend_call_known_instance_method_with_2_params(funcs->zf_offsetset, object, NULL, &tmp_offset, value);
1421
420
    OBJ_RELEASE(object);
1422
420
    zval_ptr_dtor(&tmp_offset);
1423
420
  } else {
1424
5
      zend_bad_array_access(ce);
1425
5
  }
1426
425
}
1427
/* }}} */
1428
1429
// todo: make zend_std_has_dimension return bool as well
1430
ZEND_API int zend_std_has_dimension(zend_object *object, zval *offset, int check_empty) /* {{{ */
1431
224
{
1432
224
  const zend_class_entry *ce = object->ce;
1433
224
  zval retval, tmp_offset;
1434
224
  bool result;
1435
1436
224
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1437
224
  if (EXPECTED(funcs)) {
1438
224
    ZVAL_COPY_DEREF(&tmp_offset, offset);
1439
224
    GC_ADDREF(object);
1440
224
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetexists, object, &retval, &tmp_offset);
1441
224
    result = i_zend_is_true(&retval);
1442
224
    zval_ptr_dtor(&retval);
1443
224
    if (check_empty && result && EXPECTED(!EG(exception))) {
1444
19
      zend_call_known_instance_method_with_1_params(funcs->zf_offsetget, object, &retval, &tmp_offset);
1445
19
      result = i_zend_is_true(&retval);
1446
19
      zval_ptr_dtor(&retval);
1447
19
    }
1448
224
    OBJ_RELEASE(object);
1449
224
    zval_ptr_dtor(&tmp_offset);
1450
224
  } else {
1451
0
      zend_bad_array_access(ce);
1452
0
    return 0;
1453
0
  }
1454
1455
224
  return result;
1456
224
}
1457
/* }}} */
1458
1459
ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *name, int type, void **cache_slot) /* {{{ */
1460
14.5k
{
1461
14.5k
  zval *retval = NULL;
1462
14.5k
  uintptr_t property_offset;
1463
14.5k
  const zend_property_info *prop_info = NULL;
1464
1465
14.5k
  ZEND_ASSERT(type != BP_VAR_R && type != BP_VAR_IS);
1466
1467
#if DEBUG_OBJECT_HANDLERS
1468
  fprintf(stderr, "Ptr object #%d property: %s\n", zobj->handle, ZSTR_VAL(name));
1469
#endif
1470
1471
14.5k
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__get != NULL), cache_slot, &prop_info);
1472
1473
14.5k
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1474
7.00k
try_again:
1475
7.00k
    retval = OBJ_PROP(zobj, property_offset);
1476
7.00k
    if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1477
920
      if (EXPECTED(!zobj->ce->__get) ||
1478
62
          UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
1479
865
          UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
1480
865
        if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1481
189
          bool guarded = zobj->ce->__get
1482
0
            && (*zend_get_property_guard(zobj, name) & IN_GET);
1483
189
          zend_object *instance = zend_lazy_object_init(zobj);
1484
189
          if (!instance) {
1485
15
            return &EG(error_zval);
1486
15
          }
1487
1488
174
          if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1489
0
            uint32_t *guard = zend_get_property_guard(instance, name);
1490
0
            if (!(*guard & IN_GET)) {
1491
0
              (*guard) |= IN_GET;
1492
0
              retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1493
0
              (*guard) &= ~IN_GET;
1494
0
              return retval;
1495
0
            }
1496
0
          }
1497
1498
174
          return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1499
174
        }
1500
676
        if (UNEXPECTED(type == BP_VAR_RW)) {
1501
116
          if (prop_info) {
1502
94
            zend_typed_property_uninitialized_access(prop_info, name);
1503
94
            retval = &EG(error_zval);
1504
94
          } else {
1505
22
            zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1506
            /* An error handler may set the property */
1507
22
             if (EXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1508
22
              ZVAL_NULL(retval);
1509
22
             }
1510
22
          }
1511
560
        } else if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1512
173
          if ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info)) {
1513
149
            retval = NULL;
1514
149
          }
1515
387
        } else if (!prop_info || !ZEND_TYPE_IS_SET(prop_info->type)) {
1516
18
          ZVAL_NULL(retval);
1517
18
        }
1518
676
      } else {
1519
        /* we do have getter - fail and let it try again with usual get/set */
1520
55
        retval = NULL;
1521
55
      }
1522
6.08k
    } else if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1523
590
      if ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info)) {
1524
547
        retval = NULL;
1525
547
      }
1526
590
    }
1527
7.67k
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
1528
7.05k
    if (EXPECTED(zobj->properties)) {
1529
3.35k
      if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1530
61
        if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1531
61
          GC_DELREF(zobj->properties);
1532
61
        }
1533
61
        zobj->properties = zend_array_dup(zobj->properties);
1534
61
      }
1535
3.35k
        if (EXPECTED((retval = zend_hash_find(zobj->properties, name)) != NULL)) {
1536
2.40k
        return retval;
1537
2.40k
        }
1538
3.35k
    }
1539
4.65k
    if (EXPECTED(!zobj->ce->__get) ||
1540
3.37k
        UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
1541
3.37k
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1542
163
        bool guarded = (zobj->ce->__get != NULL);
1543
163
        zend_object *instance = zend_lazy_object_init(zobj);
1544
163
        if (!instance) {
1545
18
          return &EG(error_zval);
1546
18
        }
1547
1548
145
        if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1549
65
          uint32_t *guard = zend_get_property_guard(instance, name);
1550
65
          if (!(*guard & IN_GET)) {
1551
65
            (*guard) |= IN_GET;
1552
65
            retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1553
65
            (*guard) &= ~IN_GET;
1554
65
            return retval;
1555
65
          }
1556
65
        }
1557
1558
80
        return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1559
145
      }
1560
3.21k
      if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
1561
21
        zend_forbidden_dynamic_property(zobj->ce, name);
1562
21
        return &EG(error_zval);
1563
21
      }
1564
3.19k
      if (UNEXPECTED(!(zobj->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES))) {
1565
1.39k
        if (UNEXPECTED(!zend_deprecated_dynamic_property(zobj, name))) {
1566
0
          return &EG(error_zval);
1567
0
        }
1568
1.39k
      }
1569
3.19k
      if (UNEXPECTED(!zobj->properties)) {
1570
2.43k
        rebuild_object_properties_internal(zobj);
1571
2.43k
      }
1572
3.19k
      if (UNEXPECTED(type == BP_VAR_RW)) {
1573
540
        zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1574
540
      }
1575
3.19k
      retval = zend_hash_add(zobj->properties, name, &EG(uninitialized_zval));
1576
3.19k
    }
1577
4.65k
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1578
513
    if (!(prop_info->flags & ZEND_ACC_VIRTUAL) && !zend_should_call_hook(prop_info, zobj)) {
1579
166
      property_offset = prop_info->offset;
1580
166
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1581
160
        prop_info = NULL;
1582
160
      }
1583
166
      goto try_again;
1584
166
    }
1585
513
  } else if (zobj->ce->__get == NULL) {
1586
16
    retval = &EG(error_zval);
1587
16
  }
1588
1589
11.7k
  return retval;
1590
14.5k
}
1591
/* }}} */
1592
1593
ZEND_API void zend_std_unset_property(zend_object *zobj, zend_string *name, void **cache_slot) /* {{{ */
1594
1.80k
{
1595
1.80k
  uintptr_t property_offset;
1596
1.80k
  const zend_property_info *prop_info = NULL;
1597
1.80k
  uint32_t *guard = NULL;
1598
1599
1.80k
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__unset != NULL), cache_slot, &prop_info);
1600
1601
1.80k
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1602
1.06k
    zval *slot = OBJ_PROP(zobj, property_offset);
1603
1604
1.06k
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1605
282
      bool error;
1606
282
      if (Z_TYPE_P(slot) != IS_UNDEF || Z_PROP_FLAG_P(slot) & IS_PROP_UNINIT || !zobj->ce->__unset) {
1607
255
        error = true;
1608
255
      } else {
1609
27
        guard = zend_get_property_guard(zobj, name);
1610
27
        error = (*guard) & IN_UNSET;
1611
27
      }
1612
282
      if (error) {
1613
261
        if ((prop_info->flags & ZEND_ACC_READONLY)
1614
108
         && Z_TYPE_P(slot) != IS_UNDEF
1615
59
         && !(Z_PROP_FLAG_P(slot) & IS_PROP_REINITABLE)) {
1616
51
          zend_readonly_property_unset_error(prop_info->ce, name);
1617
51
          return;
1618
51
        }
1619
210
        if ((prop_info->flags & ZEND_ACC_PPP_SET_MASK) && !zend_asymmetric_property_has_set_access(prop_info)) {
1620
96
          zend_asymmetric_visibility_property_modification_error(prop_info, "unset");
1621
96
          return;
1622
96
        }
1623
210
      }
1624
282
    }
1625
1626
914
    if (Z_TYPE_P(slot) != IS_UNDEF) {
1627
725
      if (UNEXPECTED(Z_ISREF_P(slot)) &&
1628
106
          (ZEND_DEBUG || ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(slot)))) {
1629
106
        if (prop_info) {
1630
95
          ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(slot), prop_info);
1631
95
        }
1632
106
      }
1633
725
      zval tmp;
1634
725
      ZVAL_COPY_VALUE(&tmp, slot);
1635
725
      ZVAL_UNDEF(slot);
1636
725
      zval_ptr_dtor(&tmp);
1637
725
      if (zobj->properties) {
1638
250
        HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
1639
250
      }
1640
725
      return;
1641
725
    }
1642
189
    if (UNEXPECTED(Z_PROP_FLAG_P(slot) & IS_PROP_UNINIT)) {
1643
142
      if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(slot) & IS_PROP_LAZY))) {
1644
29
        zobj = zend_lazy_object_init(zobj);
1645
29
        if (!zobj) {
1646
2
          return;
1647
2
        }
1648
27
        zend_std_unset_property(zobj, name, cache_slot);
1649
27
        return;
1650
29
      }
1651
1652
      /* Reset the IS_PROP_UNINIT flag, if it exists and bypass __unset(). */
1653
113
      Z_PROP_FLAG_P(slot) = 0;
1654
113
      return;
1655
142
    }
1656
746
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))
1657
671
   && EXPECTED(zobj->properties != NULL)) {
1658
427
    if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1659
2
      if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1660
2
        GC_DELREF(zobj->properties);
1661
2
      }
1662
2
      zobj->properties = zend_array_dup(zobj->properties);
1663
2
    }
1664
427
    if (EXPECTED(zend_hash_del(zobj->properties, name) != FAILURE)) {
1665
281
      return;
1666
281
    }
1667
427
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1668
45
    zend_throw_error(NULL, "Cannot unset hooked property %s::$%s",
1669
45
      ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1670
45
    return;
1671
274
  } else if (UNEXPECTED(EG(exception))) {
1672
6
    return;
1673
6
  }
1674
1675
  /* For initialized lazy proxies: if the real instance's __unset guard
1676
   * is already set, we are inside a recursive call from the real
1677
   * instance's __unset. Forward directly to avoid double invocation. */
1678
461
  {
1679
461
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_UNSET);
1680
461
    if (instance) {
1681
5
      zend_std_unset_property(instance, name, cache_slot);
1682
5
      return;
1683
5
    }
1684
461
  }
1685
1686
  /* magic unset */
1687
456
  if (zobj->ce->__unset) {
1688
204
    if (!guard) {
1689
183
      guard = zend_get_property_guard(zobj, name);
1690
183
    }
1691
204
    if (!((*guard) & IN_UNSET)) {
1692
      /* have unsetter - try with it! */
1693
137
      GC_ADDREF(zobj);
1694
137
      (*guard) |= IN_UNSET; /* prevent circular unsetting */
1695
137
      zend_std_call_unsetter(zobj, name);
1696
137
      (*guard) &= ~IN_UNSET;
1697
137
      OBJ_RELEASE(zobj);
1698
137
      return;
1699
137
    } else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1700
      /* Trigger the correct error */
1701
9
      zend_wrong_offset(zobj->ce, name);
1702
9
      ZEND_ASSERT(EG(exception));
1703
9
      return;
1704
58
    } else {
1705
      /* Nothing to do: The property already does not exist. */
1706
58
    }
1707
204
  }
1708
1709
310
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1710
58
    zobj = zend_lazy_object_init(zobj);
1711
58
    if (!zobj) {
1712
2
      return;
1713
2
    }
1714
1715
56
    if (UNEXPECTED(guard && zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1716
16
      guard = zend_get_property_guard(zobj, name);
1717
16
      if (!((*guard) & IN_UNSET)) {
1718
11
        (*guard) |= IN_UNSET;
1719
11
        zend_std_unset_property(zobj, name, cache_slot);
1720
11
        (*guard) &= ~IN_UNSET;
1721
11
        return;
1722
11
      }
1723
16
    }
1724
1725
45
    zend_std_unset_property(zobj, name, cache_slot);
1726
45
    return;
1727
56
  }
1728
310
}
1729
/* }}} */
1730
1731
ZEND_API void zend_std_unset_dimension(zend_object *object, zval *offset) /* {{{ */
1732
207
{
1733
207
  const zend_class_entry *ce = object->ce;
1734
207
  zval tmp_offset;
1735
1736
207
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1737
207
  if (EXPECTED(funcs)) {
1738
202
    ZVAL_COPY_DEREF(&tmp_offset, offset);
1739
202
    GC_ADDREF(object);
1740
202
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetunset, object, NULL, &tmp_offset);
1741
202
    OBJ_RELEASE(object);
1742
202
    zval_ptr_dtor(&tmp_offset);
1743
202
  } else {
1744
5
      zend_bad_array_access(ce);
1745
5
  }
1746
207
}
1747
/* }}} */
1748
1749
static zend_never_inline zend_function *zend_get_parent_private_method(const zend_class_entry *scope, const zend_class_entry *ce, zend_string *function_name) /* {{{ */
1750
74
{
1751
74
  if (scope != ce && scope && is_derived_class(ce, scope)) {
1752
58
    zend_function *fbc = zend_hash_find_ptr(&scope->function_table, function_name);
1753
58
    if (fbc != NULL) {
1754
58
      if ((fbc->common.fn_flags & ZEND_ACC_PRIVATE)
1755
58
       && fbc->common.scope == scope) {
1756
47
        return fbc;
1757
47
      }
1758
58
    }
1759
58
  }
1760
27
  return NULL;
1761
74
}
1762
/* }}} */
1763
1764
/* Ensures that we're allowed to call a protected method.
1765
 */
1766
ZEND_API bool zend_check_protected(const zend_class_entry *ce, const zend_class_entry *scope) /* {{{ */
1767
745
{
1768
745
  const zend_class_entry *fbc_scope = ce;
1769
1770
  /* Is the context that's calling the function, the same as one of
1771
   * the function's parents?
1772
   */
1773
1.45k
  while (fbc_scope) {
1774
851
    if (fbc_scope==scope) {
1775
142
      return 1;
1776
142
    }
1777
709
    fbc_scope = fbc_scope->parent;
1778
709
  }
1779
1780
  /* Is the function's scope the same as our current object context,
1781
   * or any of the parents of our context?
1782
   */
1783
1.01k
  while (scope) {
1784
718
    if (scope==ce) {
1785
302
      return 1;
1786
302
    }
1787
416
    scope = scope->parent;
1788
416
  }
1789
301
  return 0;
1790
603
}
1791
/* }}} */
1792
1793
ZEND_API ZEND_ATTRIBUTE_NONNULL zend_function *zend_get_call_trampoline_func(
1794
  const zend_function *fbc, zend_string *method_name) /* {{{ */
1795
7.13k
{
1796
7.13k
  size_t mname_len;
1797
7.13k
  zend_op_array *func;
1798
  /* We use non-NULL value to avoid useless run_time_cache allocation.
1799
   * The low bit must be zero, to not be interpreted as a MAP_PTR offset.
1800
   */
1801
7.13k
  static const void *dummy = (void*)(intptr_t)2;
1802
1803
7.13k
  if (EXPECTED(EG(trampoline).common.function_name == NULL)) {
1804
5.79k
    func = &EG(trampoline).op_array;
1805
5.79k
  } else {
1806
1.33k
    func = ecalloc(1, sizeof(zend_op_array));
1807
1.33k
  }
1808
1809
7.13k
  func->type = ZEND_USER_FUNCTION;
1810
7.13k
  func->arg_flags[0] = 0;
1811
7.13k
  func->arg_flags[1] = 0;
1812
7.13k
  func->arg_flags[2] = 0;
1813
7.13k
  func->fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE
1814
7.13k
    | ZEND_ACC_PUBLIC
1815
7.13k
    | ZEND_ACC_VARIADIC
1816
7.13k
    | (fbc->common.fn_flags & (ZEND_ACC_RETURN_REFERENCE|ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED|ZEND_ACC_NODISCARD|ZEND_ACC_STATIC));
1817
7.13k
  func->fn_flags2 = 0;
1818
  /* Attributes outlive the trampoline because they are created by the compiler. */
1819
7.13k
  func->attributes = fbc->common.attributes;
1820
7.13k
  func->opcodes = &EG(call_trampoline_op);
1821
7.13k
  ZEND_MAP_PTR_INIT(func->run_time_cache, (void**)dummy);
1822
7.13k
  func->scope = fbc->common.scope;
1823
  /* reserve space for arguments, local and temporary variables */
1824
  /* EG(trampoline) is reused from other places, like FFI (e.g. zend_ffi_cdata_get_closure()) where
1825
   * it is used as an internal function. It may set fields that don't belong to common, thus
1826
   * modifying zend_op_array specific data, most significantly last_var. We need to reset this
1827
   * value so that it doesn't contain garbage when the engine allocates space for the next stack
1828
   * frame. This didn't cause any issues until now due to "lucky" structure layout. */
1829
7.13k
  func->last_var = 0;
1830
7.13k
  uint32_t min_T = 2 + ZEND_OBSERVER_ENABLED;
1831
7.13k
  func->T = (fbc->type == ZEND_USER_FUNCTION)? MAX(fbc->op_array.last_var + fbc->op_array.T, min_T) : min_T;
1832
7.13k
  func->filename = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.filename : ZSTR_EMPTY_ALLOC();
1833
7.13k
  func->line_start = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_start : 0;
1834
7.13k
  func->line_end = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_end : 0;
1835
1836
  //??? keep compatibility for "\0" characters
1837
  //??? see: Zend/tests/bug46238.phpt
1838
7.13k
  if (UNEXPECTED((mname_len = strlen(ZSTR_VAL(method_name))) != ZSTR_LEN(method_name))) {
1839
82
    func->function_name = zend_string_init(ZSTR_VAL(method_name), mname_len, 0);
1840
7.04k
  } else {
1841
7.04k
    func->function_name = zend_string_copy(method_name);
1842
7.04k
  }
1843
1844
7.13k
  func->prototype = NULL;
1845
7.13k
  func->prop_info = NULL;
1846
7.13k
  func->num_args = 0;
1847
7.13k
  func->required_num_args = 0;
1848
7.13k
  func->arg_info = zend_call_trampoline_arginfo;
1849
1850
7.13k
  return (zend_function*)func;
1851
7.13k
}
1852
/* }}} */
1853
1854
ZEND_API void zend_free_trampoline(zend_function *func)
1855
7.84k
{
1856
7.84k
  ZEND_ASSERT(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE);
1857
1858
7.84k
  if (func == &EG(trampoline)) {
1859
6.11k
    EG(trampoline).common.attributes = NULL;
1860
6.11k
    EG(trampoline).common.function_name = NULL;
1861
6.11k
  } else {
1862
1.73k
    efree(func);
1863
1.73k
  }
1864
7.84k
}
1865
1866
static ZEND_FUNCTION(zend_parent_hook_get_trampoline)
1867
304
{
1868
304
  zend_object *obj = Z_PTR_P(ZEND_THIS);
1869
304
  zend_string *prop_name = EX(func)->internal_function.reserved[0];
1870
1871
304
  if (UNEXPECTED(ZEND_NUM_ARGS() != 0)) {
1872
14
    zend_wrong_parameters_none_error();
1873
14
    goto clean;
1874
14
  }
1875
1876
290
  zval rv;
1877
290
  const zval *retval = obj->handlers->read_property(obj, prop_name, BP_VAR_R, NULL, &rv);
1878
290
  if (retval == &rv) {
1879
0
    RETVAL_COPY_VALUE(retval);
1880
290
  } else {
1881
290
    RETVAL_COPY(retval);
1882
290
  }
1883
1884
304
clean:
1885
304
  zend_string_release(EX(func)->common.function_name);
1886
304
  zend_free_trampoline(EX(func));
1887
304
  EX(func) = NULL;
1888
304
}
1889
1890
static ZEND_FUNCTION(zend_parent_hook_set_trampoline)
1891
37
{
1892
37
  zend_object *obj = Z_PTR_P(ZEND_THIS);
1893
37
  zend_string *prop_name = EX(func)->internal_function.reserved[0];
1894
1895
37
  zval *value;
1896
1897
97
  ZEND_PARSE_PARAMETERS_START(1, 1)
1898
97
    Z_PARAM_ZVAL(value)
1899
92
  ZEND_PARSE_PARAMETERS_END_EX(goto clean);
1900
1901
23
  RETVAL_COPY(obj->handlers->write_property(obj, prop_name, value, NULL));
1902
1903
37
clean:
1904
37
  zend_string_release(EX(func)->common.function_name);
1905
37
  zend_free_trampoline(EX(func));
1906
37
  EX(func) = NULL;
1907
37
}
1908
1909
ZEND_API zend_function *zend_get_property_hook_trampoline(
1910
  const zend_property_info *prop_info,
1911
  zend_property_hook_kind kind, zend_string *prop_name)
1912
346
{
1913
346
  zend_function *func;
1914
346
  if (EXPECTED(EG(trampoline).common.function_name == NULL)) {
1915
346
    func = &EG(trampoline);
1916
346
  } else {
1917
0
    func = (zend_function *)(uintptr_t)ecalloc(1, sizeof(zend_internal_function));
1918
0
  }
1919
346
  func->type = ZEND_INTERNAL_FUNCTION;
1920
  /* This trampoline does not use the call_trampoline_op, so it won't reuse the call frame,
1921
   * which means we don't even need to reserve a temporary for observers. */
1922
346
  func->common.T = 0;
1923
346
  func->common.arg_flags[0] = 0;
1924
346
  func->common.arg_flags[1] = 0;
1925
346
  func->common.arg_flags[2] = 0;
1926
346
  func->common.fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE;
1927
346
  func->common.fn_flags2 = 0;
1928
346
  func->common.function_name = zend_string_concat3(
1929
346
    "$", 1, ZSTR_VAL(prop_name), ZSTR_LEN(prop_name),
1930
346
    kind == ZEND_PROPERTY_HOOK_GET ? "::get" : "::set", 5);
1931
  /* set to 0 to avoid arg_info[] allocation, because all values are passed by value anyway */
1932
346
  uint32_t args = kind == ZEND_PROPERTY_HOOK_GET ? 0 : 1;
1933
346
  func->common.num_args = args;
1934
346
  func->common.required_num_args = args;
1935
346
  func->common.scope = prop_info->ce;
1936
346
  func->common.prototype = NULL;
1937
346
  func->common.prop_info = prop_info;
1938
346
  func->common.arg_info = zend_property_hook_arginfo;
1939
346
  func->internal_function.handler = kind == ZEND_PROPERTY_HOOK_GET
1940
346
    ? ZEND_FN(zend_parent_hook_get_trampoline)
1941
346
    : ZEND_FN(zend_parent_hook_set_trampoline);
1942
346
  func->internal_function.module = NULL;
1943
1944
346
  func->internal_function.reserved[0] = prop_name;
1945
346
  func->internal_function.reserved[1] = NULL;
1946
1947
346
  return func;
1948
346
}
1949
1950
ZEND_API ZEND_COLD zend_never_inline void zend_bad_method_call(const zend_function *fbc, const zend_string *method_name, const zend_class_entry *scope) /* {{{ */
1951
72
{
1952
72
  zend_throw_error(NULL, "Call to %s method %s::%s() from %s%s",
1953
72
    zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(method_name),
1954
72
    scope ? "scope " : "global scope",
1955
72
    scope ? ZSTR_VAL(scope->name) : ""
1956
72
  );
1957
72
}
1958
/* }}} */
1959
1960
ZEND_API ZEND_COLD zend_never_inline void zend_abstract_method_call(const zend_function *fbc) /* {{{ */
1961
37
{
1962
37
  zend_throw_error(NULL, "Cannot call abstract method %s::%s()",
1963
37
    ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
1964
37
}
1965
/* }}} */
1966
1967
ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *method_name, const zval *key) /* {{{ */
1968
103k
{
1969
103k
  zend_object *zobj = *obj_ptr;
1970
103k
  zend_function *fbc;
1971
103k
  zend_string *lc_method_name;
1972
103k
  ALLOCA_FLAG(use_heap);
1973
1974
103k
  if (EXPECTED(key != NULL)) {
1975
97.9k
    lc_method_name = Z_STR_P(key);
1976
#ifdef ZEND_ALLOCA_MAX_SIZE
1977
    use_heap = 0;
1978
#endif
1979
97.9k
  } else {
1980
5.77k
    ZSTR_ALLOCA_ALLOC(lc_method_name, ZSTR_LEN(method_name), use_heap);
1981
5.77k
    zend_str_tolower_copy(ZSTR_VAL(lc_method_name), ZSTR_VAL(method_name), ZSTR_LEN(method_name));
1982
5.77k
  }
1983
1984
103k
  fbc = zend_hash_find_ptr(&zobj->ce->function_table, lc_method_name);
1985
103k
  if (UNEXPECTED(fbc == NULL)) {
1986
6.39k
    if (UNEXPECTED(!key)) {
1987
4.90k
      ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
1988
4.90k
    }
1989
6.39k
    if (zobj->ce->__call) {
1990
5.36k
      return zend_get_call_trampoline_func(zobj->ce->__call, method_name);
1991
5.36k
    } else {
1992
1.03k
      return NULL;
1993
1.03k
    }
1994
6.39k
  }
1995
1996
  /* Check access level */
1997
97.3k
  if (fbc->op_array.fn_flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
1998
575
    const zend_class_entry *scope = zend_get_executed_scope();
1999
2000
575
    if (fbc->common.scope != scope) {
2001
257
      if (fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
2002
74
        zend_function *updated_fbc = zend_get_parent_private_method(scope, zobj->ce, lc_method_name);
2003
2004
74
        if (EXPECTED(updated_fbc != NULL)) {
2005
47
          fbc = updated_fbc;
2006
47
          goto exit;
2007
47
        } else if (fbc->op_array.fn_flags & ZEND_ACC_PUBLIC) {
2008
21
          goto exit;
2009
21
        }
2010
74
      }
2011
189
      if (UNEXPECTED(fbc->op_array.fn_flags & ZEND_ACC_PRIVATE)
2012
118
       || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
2013
118
        if (zobj->ce->__call) {
2014
85
          fbc = zend_get_call_trampoline_func(zobj->ce->__call, method_name);
2015
85
        } else {
2016
33
          zend_bad_method_call(fbc, method_name, scope);
2017
33
          fbc = NULL;
2018
33
        }
2019
118
      }
2020
189
    }
2021
575
  }
2022
2023
97.3k
exit:
2024
97.3k
  if (fbc && UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
2025
0
    zend_abstract_method_call(fbc);
2026
0
    fbc = NULL;
2027
0
  }
2028
97.3k
  if (UNEXPECTED(!key)) {
2029
868
    ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
2030
868
  }
2031
97.3k
  return fbc;
2032
97.3k
}
2033
/* }}} */
2034
2035
static zend_always_inline zend_function *get_static_method_fallback(
2036
    const zend_class_entry *ce, zend_string *function_name)
2037
1.92k
{
2038
1.92k
  zend_object *object;
2039
1.92k
  if (ce->__call &&
2040
1.12k
    (object = zend_get_this_object(EG(current_execute_data))) != NULL &&
2041
772
    instanceof_function(object->ce, ce)) {
2042
    /* Call the top-level defined __call().
2043
     * see: tests/classes/__call_004.phpt  */
2044
2045
767
    ZEND_ASSERT(object->ce->__call);
2046
767
    return zend_get_call_trampoline_func(object->ce->__call, function_name);
2047
1.15k
  } else if (ce->__callstatic) {
2048
903
    return zend_get_call_trampoline_func(ce->__callstatic, function_name);
2049
903
  } else {
2050
253
    return NULL;
2051
253
  }
2052
1.92k
}
2053
2054
ZEND_API zend_function *zend_std_get_static_method(const zend_class_entry *ce, zend_string *function_name, const zval *key) /* {{{ */
2055
7.15k
{
2056
7.15k
  zend_function *fbc;
2057
7.15k
  if (EXPECTED(key != NULL)) {
2058
6.20k
    fbc = zend_hash_find_ptr(&ce->function_table, Z_STR_P(key));
2059
6.20k
  } else {
2060
950
    fbc = zend_hash_find_ptr_lc(&ce->function_table, function_name);
2061
950
  }
2062
2063
7.15k
  if (EXPECTED(fbc)) {
2064
5.29k
    if (!(fbc->common.fn_flags & ZEND_ACC_PUBLIC)) {
2065
188
      const zend_class_entry *scope = zend_get_executed_scope();
2066
188
      ZEND_ASSERT(!(fbc->common.fn_flags & ZEND_ACC_PUBLIC));
2067
188
      if (!zend_check_method_accessible(fbc, scope)) {
2068
63
        zend_function *fallback_fbc = get_static_method_fallback(ce, function_name);
2069
63
        if (!fallback_fbc) {
2070
28
          zend_bad_method_call(fbc, function_name, scope);
2071
28
        }
2072
63
        fbc = fallback_fbc;
2073
63
      }
2074
188
    }
2075
5.29k
  } else {
2076
1.86k
    fbc = get_static_method_fallback(ce, function_name);
2077
1.86k
  }
2078
2079
7.15k
  if (EXPECTED(fbc)) {
2080
6.90k
    if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
2081
31
      zend_abstract_method_call(fbc);
2082
31
      goto fail;
2083
6.87k
    } else if (UNEXPECTED(fbc->common.scope->ce_flags & ZEND_ACC_TRAIT)) {
2084
22
      zend_error(E_DEPRECATED,
2085
22
        "Calling static trait method %s::%s is deprecated, "
2086
22
        "it should only be called on a class using the trait",
2087
22
        ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2088
22
      if (EG(exception)) {
2089
0
        goto fail;
2090
0
      }
2091
22
    }
2092
6.90k
  }
2093
2094
7.12k
  return fbc;
2095
2096
31
 fail:
2097
31
  if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
2098
4
    zend_string_release_ex(fbc->common.function_name, 0);
2099
4
    zend_free_trampoline(fbc);
2100
4
  }
2101
2102
31
  return NULL;
2103
7.15k
}
2104
/* }}} */
2105
2106
ZEND_API void zend_class_init_statics(zend_class_entry *class_type) /* {{{ */
2107
1.71k
{
2108
1.71k
  zval *p;
2109
2110
1.71k
  if (class_type->default_static_members_count && !CE_STATIC_MEMBERS(class_type)) {
2111
1.62k
    if (class_type->parent) {
2112
135
      zend_class_init_statics(class_type->parent);
2113
135
    }
2114
2115
1.62k
    ZEND_MAP_PTR_SET(class_type->static_members_table, emalloc(sizeof(zval) * class_type->default_static_members_count));
2116
4.48k
    for (uint32_t i = 0; i < class_type->default_static_members_count; i++) {
2117
2.86k
      p = &class_type->default_static_members_table[i];
2118
2.86k
      if (Z_TYPE_P(p) == IS_INDIRECT) {
2119
143
        zval *q = &CE_STATIC_MEMBERS(class_type->parent)[i];
2120
143
        ZVAL_DEINDIRECT(q);
2121
143
        ZVAL_INDIRECT(&CE_STATIC_MEMBERS(class_type)[i], q);
2122
2.71k
      } else {
2123
2.71k
        ZVAL_COPY_OR_DUP(&CE_STATIC_MEMBERS(class_type)[i], p);
2124
2.71k
      }
2125
2.86k
    }
2126
1.62k
  }
2127
1.71k
} /* }}} */
2128
2129
ZEND_API zval *zend_std_get_static_property_with_info(zend_class_entry *ce, zend_string *property_name, int type, zend_property_info **property_info_ptr) /* {{{ */
2130
4.41k
{
2131
4.41k
  zval *ret;
2132
4.41k
  zend_property_info *property_info = zend_hash_find_ptr(&ce->properties_info, property_name);
2133
4.41k
  *property_info_ptr = property_info;
2134
2135
4.41k
  if (UNEXPECTED(property_info == NULL)) {
2136
561
    goto undeclared_property;
2137
561
  }
2138
2139
3.85k
  if (!(property_info->flags & ZEND_ACC_PUBLIC)) {
2140
1.07k
    const zend_class_entry *scope = get_fake_or_executed_scope();
2141
1.07k
    if (property_info->ce != scope) {
2142
177
      if (UNEXPECTED(property_info->flags & ZEND_ACC_PRIVATE)
2143
125
       || UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
2144
125
        if (type != BP_VAR_IS) {
2145
26
          zend_bad_property_access(property_info, ce, property_name);
2146
26
        }
2147
125
        return NULL;
2148
125
      }
2149
177
    }
2150
1.07k
  }
2151
2152
3.73k
  if (UNEXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0)) {
2153
599
undeclared_property:
2154
599
    if (type != BP_VAR_IS) {
2155
332
      zend_throw_error(NULL, "Access to undeclared static property %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
2156
332
    }
2157
599
    return NULL;
2158
38
  }
2159
2160
3.69k
  if (UNEXPECTED(!(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
2161
292
    if (UNEXPECTED(zend_update_class_constants(ce) != SUCCESS)) {
2162
34
      return NULL;
2163
34
    }
2164
292
  }
2165
2166
  /* Ensure static properties are initialized. */
2167
3.66k
  if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
2168
1.44k
    zend_class_init_statics(ce);
2169
1.44k
  }
2170
2171
3.66k
  ret = CE_STATIC_MEMBERS(ce) + property_info->offset;
2172
3.66k
  ZVAL_DEINDIRECT(ret);
2173
2174
3.66k
  if (UNEXPECTED((type == BP_VAR_R || type == BP_VAR_RW)
2175
3.66k
        && Z_TYPE_P(ret) == IS_UNDEF && ZEND_TYPE_IS_SET(property_info->type))) {
2176
19
    zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
2177
19
      ZSTR_VAL(property_info->ce->name), ZSTR_VAL(property_name));
2178
19
    return NULL;
2179
19
  }
2180
2181
3.64k
  if (UNEXPECTED(ce->ce_flags & ZEND_ACC_TRAIT)) {
2182
93
    zend_error(E_DEPRECATED,
2183
93
      "Accessing static trait property %s::$%s is deprecated, "
2184
93
      "it should only be accessed on a class using the trait",
2185
93
      ZSTR_VAL(property_info->ce->name), ZSTR_VAL(property_name));
2186
93
  }
2187
2188
3.64k
  return ret;
2189
3.66k
}
2190
/* }}} */
2191
2192
ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, int type) /* {{{ */
2193
19
{
2194
19
  zend_property_info *prop_info;
2195
19
  return zend_std_get_static_property_with_info(ce, property_name, type, &prop_info);
2196
19
}
2197
2198
ZEND_API ZEND_COLD void zend_std_unset_static_property(const zend_class_entry *ce, const zend_string *property_name) /* {{{ */
2199
9
{
2200
9
  zend_throw_error(NULL, "Attempt to unset static property %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
2201
9
}
2202
/* }}} */
2203
2204
static ZEND_COLD zend_never_inline void zend_bad_constructor_call(const zend_function *constructor, const zend_class_entry *scope) /* {{{ */
2205
53
{
2206
53
  if (scope) {
2207
11
    zend_throw_error(NULL, "Call to %s %s::__construct() from scope %s",
2208
11
      zend_visibility_string(constructor->common.fn_flags),
2209
11
      ZSTR_VAL(constructor->common.scope->name),
2210
11
      ZSTR_VAL(scope->name)
2211
11
    );
2212
42
  } else {
2213
42
    zend_throw_error(NULL, "Call to %s %s::__construct() from global scope",
2214
42
      zend_visibility_string(constructor->common.fn_flags),
2215
42
      ZSTR_VAL(constructor->common.scope->name)
2216
42
    );
2217
42
  }
2218
53
}
2219
/* }}} */
2220
2221
ZEND_API zend_function *zend_std_get_constructor(zend_object *zobj) /* {{{ */
2222
493k
{
2223
493k
  zend_function *constructor = zobj->ce->constructor;
2224
2225
493k
  if (constructor) {
2226
385k
    if (UNEXPECTED(!(constructor->common.fn_flags & ZEND_ACC_PUBLIC))) {
2227
83
      const zend_class_entry *scope = get_fake_or_executed_scope();
2228
83
      ZEND_ASSERT(!(constructor->common.fn_flags & ZEND_ACC_PUBLIC));
2229
83
      if (!zend_check_method_accessible(constructor, scope)) {
2230
53
        zend_bad_constructor_call(constructor, scope);
2231
53
        zend_object_store_ctor_failed(zobj);
2232
53
        constructor = NULL;
2233
53
      }
2234
83
    }
2235
385k
  }
2236
2237
493k
  return constructor;
2238
493k
}
2239
/* }}} */
2240
2241
ZEND_API int zend_std_compare_objects(zval *o1, zval *o2) /* {{{ */
2242
876
{
2243
876
  zend_object *zobj1, *zobj2;
2244
2245
876
  if (zend_objects_check_stack_limit()) {
2246
0
    zend_throw_error(NULL, "Maximum call stack size reached during object comparison");
2247
0
    return ZEND_UNCOMPARABLE;
2248
0
  }
2249
2250
876
  if (Z_TYPE_P(o1) != Z_TYPE_P(o2)) {
2251
    /* Object and non-object */
2252
665
    zval *object;
2253
665
    zval *value;
2254
665
    zval casted;
2255
665
    bool object_lhs;
2256
665
    if (Z_TYPE_P(o1) == IS_OBJECT) {
2257
489
      object = o1;
2258
489
      value = o2;
2259
489
      object_lhs = true;
2260
489
    } else {
2261
176
      object = o2;
2262
176
      value = o1;
2263
176
      object_lhs = false;
2264
176
    }
2265
665
    ZEND_ASSERT(Z_TYPE_P(value) != IS_OBJECT);
2266
665
    uint8_t target_type = Z_TYPE_P(value);
2267
    /* Should be handled in zend_compare(). */
2268
665
    ZEND_ASSERT(target_type != IS_FALSE && target_type != IS_TRUE);
2269
665
    if (Z_OBJ_HT_P(object)->cast_object(Z_OBJ_P(object), &casted, target_type) == FAILURE) {
2270
      // TODO: Less crazy.
2271
588
      if (target_type == IS_LONG || target_type == IS_DOUBLE) {
2272
319
        zend_error(E_NOTICE, "Object of class %s could not be converted to %s",
2273
319
               ZSTR_VAL(Z_OBJCE_P(object)->name), zend_get_type_by_const(target_type));
2274
319
        if (target_type == IS_LONG) {
2275
283
          ZVAL_LONG(&casted, 1);
2276
283
        } else {
2277
36
          ZVAL_DOUBLE(&casted, 1.0);
2278
36
        }
2279
319
      } else {
2280
269
        return object_lhs ? 1 : -1;
2281
269
      }
2282
588
    }
2283
396
    int ret = object_lhs ? zend_compare(&casted, value) : zend_compare(value, &casted);
2284
396
    zval_ptr_dtor(&casted);
2285
396
    return ret;
2286
665
  }
2287
2288
211
  zobj1 = Z_OBJ_P(o1);
2289
211
  zobj2 = Z_OBJ_P(o2);
2290
2291
211
  if (zobj1 == zobj2) {
2292
0
    return 0; /* the same object */
2293
0
  }
2294
211
  if (zobj1->ce != zobj2->ce) {
2295
29
    return ZEND_UNCOMPARABLE; /* different classes */
2296
29
  }
2297
182
  if (!zobj1->properties && !zobj2->properties
2298
139
      && !zend_object_is_lazy(zobj1) && !zend_object_is_lazy(zobj2)) {
2299
112
    zend_property_info *info;
2300
112
    int i;
2301
2302
112
    if (!zobj1->ce->default_properties_count) {
2303
59
      return 0;
2304
59
    }
2305
2306
    /* It's enough to protect only one of the objects.
2307
     * The second one may be referenced from the first and this may cause
2308
     * false recursion detection.
2309
     */
2310
    /* use bitwise OR to make only one conditional jump */
2311
53
    if (UNEXPECTED(Z_IS_RECURSIVE_P(o1))) {
2312
6
      zend_throw_error(NULL, "Nesting level too deep - recursive dependency?");
2313
6
      return ZEND_UNCOMPARABLE;
2314
6
    }
2315
47
    Z_PROTECT_RECURSION_P(o1);
2316
2317
47
    GC_ADDREF(zobj1);
2318
47
    GC_ADDREF(zobj2);
2319
47
    int ret;
2320
2321
82
    for (i = 0; i < zobj1->ce->default_properties_count; i++) {
2322
74
      zval *p1, *p2;
2323
2324
74
      info = zobj1->ce->properties_info_table[i];
2325
2326
74
      if (!info) {
2327
10
        continue;
2328
10
      }
2329
2330
64
      p1 = OBJ_PROP(zobj1, info->offset);
2331
64
      p2 = OBJ_PROP(zobj2, info->offset);
2332
2333
64
      if (Z_TYPE_P(p1) != IS_UNDEF) {
2334
64
        if (Z_TYPE_P(p2) != IS_UNDEF) {
2335
64
          ret = zend_compare(p1, p2);
2336
64
          if (ret != 0) {
2337
39
            Z_UNPROTECT_RECURSION_P(o1);
2338
39
            goto done;
2339
39
          }
2340
64
        } else {
2341
0
          Z_UNPROTECT_RECURSION_P(o1);
2342
0
          ret = 1;
2343
0
          goto done;
2344
0
        }
2345
64
      } else {
2346
0
        if (Z_TYPE_P(p2) != IS_UNDEF) {
2347
0
          Z_UNPROTECT_RECURSION_P(o1);
2348
0
          ret = 1;
2349
0
          goto done;
2350
0
        }
2351
0
      }
2352
64
    }
2353
2354
8
    Z_UNPROTECT_RECURSION_P(o1);
2355
8
    ret = 0;
2356
2357
47
done:
2358
47
    OBJ_RELEASE(zobj1);
2359
47
    OBJ_RELEASE(zobj2);
2360
2361
47
    return ret;
2362
70
  } else {
2363
70
    GC_ADDREF(zobj1);
2364
70
    GC_ADDREF(zobj2);
2365
2366
70
    int ret = zend_compare_symbol_tables(
2367
70
        zend_std_get_properties_ex(zobj1),
2368
70
        zend_std_get_properties_ex(zobj2));
2369
2370
70
    OBJ_RELEASE(zobj1);
2371
70
    OBJ_RELEASE(zobj2);
2372
2373
70
    return ret;
2374
70
  }
2375
182
}
2376
/* }}} */
2377
2378
ZEND_API int zend_objects_not_comparable(zval *o1, zval *o2)
2379
550
{
2380
550
  return ZEND_UNCOMPARABLE;
2381
550
}
2382
2383
// todo: make zend_std_has_property return bool as well
2384
ZEND_API int zend_std_has_property(zend_object *zobj, zend_string *name, int has_set_exists, void **cache_slot) /* {{{ */
2385
1.45k
{
2386
1.45k
  bool result;
2387
1.45k
  zval *value = NULL;
2388
1.45k
  uintptr_t property_offset;
2389
1.45k
  const zend_property_info *prop_info = NULL;
2390
2391
1.45k
  property_offset = zend_get_property_offset(zobj->ce, name, 1, cache_slot, &prop_info);
2392
2393
1.45k
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
2394
299
try_again:
2395
299
    value = OBJ_PROP(zobj, property_offset);
2396
299
    if (Z_TYPE_P(value) != IS_UNDEF) {
2397
148
      goto found;
2398
148
    }
2399
151
    if (UNEXPECTED(Z_PROP_FLAG_P(value) & IS_PROP_UNINIT)) {
2400
      /* Skip __isset() for uninitialized typed properties */
2401
86
      goto lazy_init;
2402
86
    }
2403
1.16k
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
2404
1.01k
    if (EXPECTED(zobj->properties != NULL)) {
2405
367
      if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
2406
6
        uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
2407
2408
6
        if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
2409
6
          Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
2410
2411
6
          if (EXPECTED(p->key == name) ||
2412
3
                (EXPECTED(p->h == ZSTR_H(name)) &&
2413
3
                 EXPECTED(p->key != NULL) &&
2414
3
                 EXPECTED(zend_string_equal_content(p->key, name)))) {
2415
3
            value = &p->val;
2416
3
            goto found;
2417
3
          }
2418
6
        }
2419
3
        CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
2420
3
      }
2421
364
      value = zend_hash_find(zobj->properties, name);
2422
364
      if (value) {
2423
256
        if (cache_slot) {
2424
77
          uintptr_t idx = (char*)value - (char*)zobj->properties->arData;
2425
77
          CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
2426
77
        }
2427
407
found:
2428
407
        if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY) {
2429
25
          result = zend_is_true(value);
2430
382
        } else if (has_set_exists < ZEND_PROPERTY_NOT_EMPTY) {
2431
333
          ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_ISSET);
2432
333
          ZVAL_DEREF(value);
2433
333
          result = (Z_TYPE_P(value) != IS_NULL);
2434
333
        } else {
2435
49
          ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_EXISTS);
2436
49
          result = true;
2437
49
        }
2438
407
        goto exit;
2439
407
      }
2440
364
    }
2441
1.01k
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
2442
109
    zend_function *get = prop_info->hooks[ZEND_PROPERTY_HOOK_GET];
2443
2444
109
    if (has_set_exists == ZEND_PROPERTY_EXISTS) {
2445
0
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
2446
0
        return true;
2447
0
      }
2448
0
      property_offset = prop_info->offset;
2449
0
      goto try_again;
2450
0
    }
2451
2452
109
    if (!get) {
2453
9
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
2454
5
        zend_throw_error(NULL, "Cannot read from set-only virtual property %s::$%s",
2455
5
          ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
2456
5
        return 0;
2457
5
      } else {
2458
4
        property_offset = prop_info->offset;
2459
4
        goto try_again;
2460
4
      }
2461
9
    }
2462
2463
100
    zval rv;
2464
100
    if (!zend_call_get_hook(prop_info, name, get, zobj, &rv)) {
2465
5
      if (EG(exception)) {
2466
0
        return 0;
2467
0
      }
2468
5
      property_offset = prop_info->offset;
2469
5
      goto try_again;
2470
5
    }
2471
2472
95
    if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY) {
2473
25
      result = zend_is_true(&rv);
2474
70
    } else {
2475
70
      ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_ISSET);
2476
70
      result = Z_TYPE(rv) != IS_NULL
2477
50
        && (Z_TYPE(rv) != IS_REFERENCE || Z_TYPE_P(Z_REFVAL(rv)) != IS_NULL);
2478
70
    }
2479
95
    zval_ptr_dtor(&rv);
2480
95
    return result;
2481
95
  } else if (UNEXPECTED(EG(exception))) {
2482
0
    result = false;
2483
0
    goto exit;
2484
0
  }
2485
2486
  /* For initialized lazy proxies: if the real instance's __isset guard
2487
   * is already set, we are inside a recursive call from the real
2488
   * instance's __isset. Forward directly to avoid double invocation. */
2489
865
  {
2490
865
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_ISSET);
2491
865
    if (instance) {
2492
12
      return zend_std_has_property(instance, name, has_set_exists, cache_slot);
2493
12
    }
2494
865
  }
2495
2496
853
  if (!zobj->ce->__isset) {
2497
235
    goto lazy_init;
2498
235
  }
2499
2500
618
  result = false;
2501
618
  if (has_set_exists != ZEND_PROPERTY_EXISTS) {
2502
609
    uint32_t *guard = zend_get_property_guard(zobj, name);
2503
2504
609
    if (!((*guard) & IN_ISSET)) {
2505
485
      zval rv;
2506
2507
      /* have issetter - try with it! */
2508
485
      GC_ADDREF(zobj);
2509
485
      (*guard) |= IN_ISSET; /* prevent circular getting */
2510
485
      zend_std_call_issetter(zobj, name, &rv);
2511
485
      result = zend_is_true(&rv);
2512
485
      zval_ptr_dtor(&rv);
2513
485
      if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY && result) {
2514
        /* GH-12695, see above. */
2515
67
        zval *prop = NULL;
2516
67
        if (IS_VALID_PROPERTY_OFFSET(property_offset)) {
2517
0
          prop = OBJ_PROP(zobj, property_offset);
2518
0
          if (Z_TYPE_P(prop) == IS_UNDEF) {
2519
0
            prop = NULL;
2520
0
          }
2521
67
        } else if (IS_DYNAMIC_PROPERTY_OFFSET(property_offset)
2522
67
            && zobj->properties != NULL) {
2523
28
          prop = zend_hash_find(zobj->properties, name);
2524
28
        }
2525
67
        if (prop) {
2526
25
          result = i_zend_is_true(prop);
2527
42
        } else if (EXPECTED(!EG(exception)) && zobj->ce->__get && !((*guard) & IN_GET)) {
2528
37
          (*guard) |= IN_GET;
2529
37
          zend_std_call_getter(zobj, name, &rv);
2530
37
          (*guard) &= ~IN_GET;
2531
37
          result = i_zend_is_true(&rv);
2532
37
          zval_ptr_dtor(&rv);
2533
37
        } else {
2534
5
          result = false;
2535
5
        }
2536
67
      }
2537
485
      (*guard) &= ~IN_ISSET;
2538
485
      OBJ_RELEASE(zobj);
2539
485
    } else {
2540
124
      goto lazy_init;
2541
124
    }
2542
609
  }
2543
2544
1.32k
exit:
2545
1.32k
  return result;
2546
2547
445
lazy_init:
2548
445
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
2549
26
    if (!value || (Z_PROP_FLAG_P(value) & IS_PROP_LAZY)) {
2550
26
      zobj = zend_lazy_object_init(zobj);
2551
26
      if (!zobj) {
2552
5
        result = false;
2553
5
        goto exit;
2554
5
      }
2555
2556
21
      if (UNEXPECTED(zobj->ce->__isset)) {
2557
11
        uint32_t *guard = zend_get_property_guard(zobj, name);
2558
11
        if (!((*guard) & IN_ISSET)) {
2559
11
          (*guard) |= IN_ISSET;
2560
11
          result = zend_std_has_property(zobj, name, has_set_exists, cache_slot);
2561
11
          (*guard) &= ~IN_ISSET;
2562
11
          return result;
2563
11
        }
2564
11
      }
2565
2566
10
      return zend_std_has_property(zobj, name, has_set_exists, cache_slot);
2567
21
    }
2568
26
  }
2569
2570
419
  result = false;
2571
419
  goto exit;
2572
445
}
2573
/* }}} */
2574
2575
ZEND_API zend_string *zend_std_get_class_name(const zend_object *zobj) /* {{{ */
2576
19.9k
{
2577
19.9k
  return zend_string_copy(zobj->ce->name);
2578
19.9k
}
2579
/* }}} */
2580
2581
ZEND_API zend_result zend_std_cast_object_tostring(zend_object *readobj, zval *writeobj, int type) /* {{{ */
2582
12.7k
{
2583
12.7k
  switch (type) {
2584
10.1k
    case IS_STRING: {
2585
10.1k
      const zend_class_entry *ce = readobj->ce;
2586
10.1k
      if (ce->__tostring) {
2587
8.89k
        zval retval;
2588
8.89k
        GC_ADDREF(readobj);
2589
8.89k
        zend_call_known_instance_method_with_0_params(ce->__tostring, readobj, &retval);
2590
8.89k
        zend_object_release(readobj);
2591
8.89k
        if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {
2592
6.28k
is_string:
2593
6.28k
          ZVAL_COPY_VALUE(writeobj, &retval);
2594
6.28k
          return SUCCESS;
2595
6.28k
        } else if (Z_ISREF(retval)) {
2596
6
          zend_unwrap_reference(&retval);
2597
6
          goto is_string;
2598
6
        }
2599
2.60k
        zval_ptr_dtor(&retval);
2600
2.60k
        if (!EG(exception)) {
2601
0
          zend_throw_error(NULL, "Method %s::__toString() must return a string value", ZSTR_VAL(ce->name));
2602
0
        }
2603
2.60k
      }
2604
3.90k
      return FAILURE;
2605
10.1k
    }
2606
571
    case _IS_BOOL:
2607
571
      ZVAL_TRUE(writeobj);
2608
571
      return SUCCESS;
2609
1.98k
    default:
2610
1.98k
      return FAILURE;
2611
12.7k
  }
2612
12.7k
}
2613
/* }}} */
2614
2615
ZEND_API zend_result zend_std_get_closure(zend_object *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zend_object **obj_ptr, bool check_only) /* {{{ */
2616
317
{
2617
317
  zend_class_entry *ce = obj->ce;
2618
317
  zend_function *func = zend_hash_find_ex_ptr(
2619
317
    &ce->function_table, ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE), /* known_hash */ true);
2620
2621
317
  if (func == NULL) {
2622
34
    return FAILURE;
2623
34
  }
2624
283
  *fptr_ptr = func;
2625
283
  *ce_ptr = ce;
2626
283
  *obj_ptr = obj;
2627
2628
283
  return SUCCESS;
2629
317
}
2630
/* }}} */
2631
2632
19.3k
ZEND_API HashTable *zend_std_get_properties_for(zend_object *obj, zend_prop_purpose purpose) {
2633
19.3k
  HashTable *ht;
2634
19.3k
  switch (purpose) {
2635
18.2k
    case ZEND_PROP_PURPOSE_DEBUG:
2636
18.2k
      if (obj->handlers->get_debug_info) {
2637
18.2k
        int is_temp;
2638
18.2k
        ht = obj->handlers->get_debug_info(obj, &is_temp);
2639
18.2k
        if (ht && !is_temp) {
2640
16.4k
          GC_TRY_ADDREF(ht);
2641
16.4k
        }
2642
18.2k
        return ht;
2643
18.2k
      }
2644
0
      ZEND_FALLTHROUGH;
2645
253
    case ZEND_PROP_PURPOSE_JSON:
2646
581
    case ZEND_PROP_PURPOSE_GET_OBJECT_VARS:
2647
760
    case ZEND_PROP_PURPOSE_VAR_EXPORT:
2648
760
      if (obj->ce->num_hooked_props) {
2649
456
        return zend_hooked_object_build_properties(obj);
2650
456
      }
2651
304
      ht = obj->handlers->get_properties(obj);
2652
304
      if (ht) {
2653
304
        GC_TRY_ADDREF(ht);
2654
304
      }
2655
304
      return ht;
2656
167
    case ZEND_PROP_PURPOSE_ARRAY_CAST:
2657
167
      ht = zend_get_properties_no_lazy_init(obj);
2658
167
      if (ht) {
2659
167
        GC_TRY_ADDREF(ht);
2660
167
      }
2661
167
      return ht;
2662
205
    case ZEND_PROP_PURPOSE_SERIALIZE: {
2663
205
      if (zend_object_is_lazy(obj)
2664
135
          && !zend_lazy_object_initialize_on_serialize(obj)) {
2665
39
        ht = zend_get_properties_no_lazy_init(obj);
2666
166
      } else {
2667
166
        ht = obj->handlers->get_properties(obj);
2668
166
      }
2669
205
      if (ht) {
2670
205
        GC_TRY_ADDREF(ht);
2671
205
      }
2672
205
      return ht;
2673
760
    }
2674
0
    default:
2675
0
      ZEND_UNREACHABLE();
2676
0
      return NULL;
2677
19.3k
  }
2678
19.3k
}
2679
2680
20.3k
ZEND_API HashTable *zend_get_properties_for(zval *obj, zend_prop_purpose purpose) {
2681
20.3k
  zend_object *zobj = Z_OBJ_P(obj);
2682
2683
20.3k
  if (zobj->handlers->get_properties_for) {
2684
1.01k
    return zobj->handlers->get_properties_for(zobj, purpose);
2685
1.01k
  }
2686
2687
19.3k
  return zend_std_get_properties_for(zobj, purpose);
2688
20.3k
}
2689
2690
ZEND_API const zend_object_handlers std_object_handlers = {
2691
  0,                    /* offset */
2692
2693
  zend_object_std_dtor,         /* free_obj */
2694
  zend_objects_destroy_object,      /* dtor_obj */
2695
  zend_objects_clone_obj,         /* clone_obj */
2696
  zend_objects_clone_obj_with,      /* clone_obj_with */
2697
2698
  zend_std_read_property,         /* read_property */
2699
  zend_std_write_property,        /* write_property */
2700
  zend_std_read_dimension,        /* read_dimension */
2701
  zend_std_write_dimension,       /* write_dimension */
2702
  zend_std_get_property_ptr_ptr,      /* get_property_ptr_ptr */
2703
  zend_std_has_property,          /* has_property */
2704
  zend_std_unset_property,        /* unset_property */
2705
  zend_std_has_dimension,         /* has_dimension */
2706
  zend_std_unset_dimension,       /* unset_dimension */
2707
  zend_std_get_properties,        /* get_properties */
2708
  zend_std_get_method,          /* get_method */
2709
  zend_std_get_constructor,       /* get_constructor */
2710
  zend_std_get_class_name,        /* get_class_name */
2711
  zend_std_cast_object_tostring,      /* cast_object */
2712
  NULL,                 /* count_elements */
2713
  zend_std_get_debug_info,        /* get_debug_info */
2714
  zend_std_get_closure,         /* get_closure */
2715
  zend_std_get_gc,            /* get_gc */
2716
  NULL,                 /* do_operation */
2717
  zend_std_compare_objects,       /* compare */
2718
  NULL,                 /* get_properties_for */
2719
};
2720
2721
16
void zend_object_handlers_startup(void) {
2722
16
  zend_call_trampoline_arginfo[0].name = ZSTR_KNOWN(ZEND_STR_ARGUMENTS);
2723
  zend_call_trampoline_arginfo[0].type = (zend_type)ZEND_TYPE_INIT_CODE(IS_MIXED, false, _ZEND_ARG_INFO_FLAGS(false, 1, 0));
2724
16
  zend_property_hook_arginfo[0].name = ZSTR_KNOWN(ZEND_STR_VALUE);
2725
16
}