Coverage Report

Created: 2026-10-28 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/zend_object_handlers.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright © Zend Technologies Ltd., a subsidiary company of          |
6
   |     Perforce Software, Inc., and Contributors.                       |
7
   +----------------------------------------------------------------------+
8
   | This source file is subject to the Modified BSD License that is      |
9
   | bundled with this package in the file LICENSE, and is available      |
10
   | through the World Wide Web at <https://www.php.net/license/>.        |
11
   |                                                                      |
12
   | SPDX-License-Identifier: BSD-3-Clause                                |
13
   +----------------------------------------------------------------------+
14
   | Authors: Andi Gutmans <andi@php.net>                                 |
15
   |          Zeev Suraski <zeev@php.net>                                 |
16
   |          Dmitry Stogov <dmitry@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend.h"
21
#include "zend_globals.h"
22
#include "zend_lazy_objects.h"
23
#include "zend_variables.h"
24
#include "zend_API.h"
25
#include "zend_objects.h"
26
#include "zend_objects_API.h"
27
#include "zend_object_handlers.h"
28
#include "zend_interfaces.h"
29
#include "zend_exceptions.h"
30
#include "zend_closures.h"
31
#include "zend_compile.h"
32
#include "zend_hash.h"
33
#include "zend_property_hooks.h"
34
#include "zend_observer.h"
35
36
#define DEBUG_OBJECT_HANDLERS 0
37
38
22
#define ZEND_WRONG_PROPERTY_OFFSET   0
39
27
#define ZEND_HOOKED_PROPERTY_OFFSET 1
40
41
/* guard flags */
42
226
#define IN_GET    ZEND_GUARD_PROPERTY_GET
43
48.7k
#define IN_SET    ZEND_GUARD_PROPERTY_SET
44
0
#define IN_UNSET  ZEND_GUARD_PROPERTY_UNSET
45
4
#define IN_ISSET  ZEND_GUARD_PROPERTY_ISSET
46
#define IN_HOOK   ZEND_GUARD_PROPERTY_HOOK
47
48
static zend_arg_info zend_call_trampoline_arginfo[1] = {{0}};
49
static zend_arg_info zend_property_hook_arginfo[1] = {{0}};
50
51
static zend_always_inline bool zend_objects_check_stack_limit(void)
52
20
{
53
20
#ifdef ZEND_CHECK_STACK_LIMIT
54
20
  return zend_call_stack_overflowed(EG(stack_limit));
55
#else
56
  return false;
57
#endif
58
20
}
59
60
/*
61
  __X accessors explanation:
62
63
  if we have __get and property that is not part of the properties array is
64
  requested, we call __get handler. If it fails, we return uninitialized.
65
66
  if we have __set and property that is not part of the properties array is
67
  set, we call __set handler. If it fails, we do not change the array.
68
69
  for both handlers above, when we are inside __get/__set, no further calls for
70
  __get/__set for this property of this object will be made, to prevent endless
71
  recursion and enable accessors to change properties array.
72
73
  if we have __call and method which is not part of the class function table is
74
  called, we cal __call handler.
75
*/
76
77
ZEND_API HashTable *rebuild_object_properties_internal(zend_object *zobj) /* {{{ */
78
677k
{
79
677k
  if (!zobj->properties) {
80
677k
    zend_property_info *prop_info;
81
677k
    zend_class_entry *ce = zobj->ce;
82
677k
    int i;
83
84
677k
    zobj->properties = zend_new_array(ce->default_properties_count);
85
677k
    if (ce->default_properties_count) {
86
159k
      zend_hash_real_init_mixed(zobj->properties);
87
1.27M
      for (i = 0; i < ce->default_properties_count; i++) {
88
1.11M
        prop_info = ce->properties_info_table[i];
89
90
1.11M
        if (!prop_info) {
91
2
          continue;
92
2
        }
93
94
1.11M
        if (UNEXPECTED(Z_TYPE_P(OBJ_PROP(zobj, prop_info->offset)) == IS_UNDEF)) {
95
420
          HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
96
420
        }
97
98
1.11M
        _zend_hash_append_ind(zobj->properties, prop_info->name,
99
1.11M
          OBJ_PROP(zobj, prop_info->offset));
100
1.11M
      }
101
159k
    }
102
677k
  }
103
104
677k
  return zobj->properties;
105
677k
}
106
/* }}} */
107
108
/* Implements the fast path for array cast */
109
ZEND_API HashTable *zend_std_build_object_properties_array(zend_object *zobj) /* {{{ */
110
0
{
111
0
  const zend_class_entry *ce = zobj->ce;
112
0
  HashTable *ht;
113
0
  zval* prop;
114
0
  int i;
115
116
0
  ZEND_ASSERT(!(zend_object_is_lazy_proxy(zobj) && zend_lazy_object_initialized(zobj)));
117
0
  ZEND_ASSERT(!zobj->properties);
118
0
  ht = zend_new_array(ce->default_properties_count);
119
0
  if (ce->default_properties_count) {
120
0
    zend_hash_real_init_mixed(ht);
121
0
    for (i = 0; i < ce->default_properties_count; i++) {
122
0
      const zend_property_info *prop_info = ce->properties_info_table[i];
123
124
0
      if (!prop_info) {
125
0
        continue;
126
0
      }
127
128
0
      prop = OBJ_PROP(zobj, prop_info->offset);
129
0
      if (UNEXPECTED(Z_TYPE_P(prop) == IS_UNDEF)) {
130
0
        continue;
131
0
      }
132
133
0
      if (Z_ISREF_P(prop) && Z_REFCOUNT_P(prop) == 1) {
134
0
        prop = Z_REFVAL_P(prop);
135
0
      }
136
137
0
      Z_TRY_ADDREF_P(prop);
138
0
      _zend_hash_append(ht, prop_info->name, prop);
139
0
    }
140
0
  }
141
0
  return ht;
142
0
}
143
/* }}} */
144
145
ZEND_API HashTable *zend_std_get_properties(zend_object *zobj) /* {{{ */
146
1.50M
{
147
1.50M
  return zend_std_get_properties_ex(zobj);
148
1.50M
}
149
/* }}} */
150
151
/* Fetch properties HashTable without triggering lazy initialization */
152
ZEND_API HashTable *zend_get_properties_no_lazy_init(zend_object *zobj)
153
2
{
154
2
  if (zobj->handlers->get_properties == zend_std_get_properties) {
155
2
    if (UNEXPECTED(zend_object_is_lazy_proxy(zobj)
156
2
        && zend_lazy_object_initialized(zobj))) {
157
0
      zend_object *instance = zend_lazy_object_get_instance(zobj);
158
0
      return zend_get_properties_no_lazy_init(instance);
159
0
    }
160
161
2
    if (!zobj->properties) {
162
0
      rebuild_object_properties_internal(zobj);
163
0
    }
164
2
    return zobj->properties;
165
2
  }
166
167
0
  ZEND_ASSERT(!zend_object_is_lazy(zobj));
168
169
0
  return zobj->handlers->get_properties(zobj);
170
0
}
171
172
ZEND_API HashTable *zend_std_get_gc(zend_object *zobj, zval **table, int *n) /* {{{ */
173
440k
{
174
440k
  if (zobj->handlers->get_properties != zend_std_get_properties) {
175
0
    *table = NULL;
176
0
    *n = 0;
177
0
    return zobj->handlers->get_properties(zobj);
178
440k
  } else {
179
440k
    if (UNEXPECTED(zend_object_is_lazy(zobj))) {
180
0
      return zend_lazy_object_get_gc(zobj, table, n);
181
440k
    } else if (zobj->properties) {
182
439k
      *table = NULL;
183
439k
      *n = 0;
184
439k
      return zobj->properties;
185
439k
    } else {
186
739
      *table = zobj->properties_table;
187
739
      *n = zobj->ce->default_properties_count;
188
739
      return NULL;
189
739
    }
190
440k
  }
191
440k
}
192
/* }}} */
193
194
ZEND_API HashTable *zend_std_get_debug_info(zend_object *object, int *is_temp) /* {{{ */
195
103
{
196
103
  const zend_class_entry *ce = object->ce;
197
103
  zval retval;
198
103
  HashTable *ht;
199
200
103
  if (!ce->__debugInfo) {
201
101
    if (UNEXPECTED(zend_object_is_lazy(object))) {
202
0
      return zend_lazy_object_debug_info(object, is_temp);
203
0
    }
204
205
101
    *is_temp = 0;
206
101
    return object->handlers->get_properties(object);
207
101
  }
208
209
2
  zend_call_known_instance_method_with_0_params(ce->__debugInfo, object, &retval);
210
2
  if (UNEXPECTED(Z_ISREF(retval))) {
211
0
    zend_unwrap_reference(&retval);
212
0
  }
213
2
  if (Z_TYPE(retval) == IS_ARRAY) {
214
2
    if (!Z_REFCOUNTED(retval)) {
215
0
      *is_temp = 1;
216
0
      return zend_array_dup(Z_ARRVAL(retval));
217
2
    } else if (Z_REFCOUNT(retval) <= 1) {
218
2
      *is_temp = 1;
219
2
      ht = Z_ARR(retval);
220
2
      return ht;
221
2
    } else {
222
0
      *is_temp = 0;
223
0
      zval_ptr_dtor(&retval);
224
0
      return Z_ARRVAL(retval);
225
0
    }
226
2
  } else if (Z_TYPE(retval) == IS_NULL) {
227
0
    zend_error(E_DEPRECATED, "Returning null from %s::__debugInfo() is deprecated, return an empty array instead",
228
0
      ZSTR_VAL(ce->name));
229
0
    *is_temp = 1;
230
0
    ht = zend_new_array(0);
231
0
    return ht;
232
0
  }
233
234
0
  zend_error_noreturn(E_ERROR, ZEND_DEBUGINFO_FUNC_NAME "() must return an array");
235
0
}
236
/* }}} */
237
238
static void zend_std_call_getter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
239
9
{
240
9
  zval member;
241
9
  ZVAL_STR(&member, prop_name);
242
9
  zend_call_known_instance_method_with_1_params(zobj->ce->__get, zobj, retval, &member);
243
9
}
244
/* }}} */
245
246
static void zend_std_call_setter(zend_object *zobj, zend_string *prop_name, zval *value) /* {{{ */
247
2
{
248
2
  zval args[2];
249
2
  ZVAL_STR(&args[0], prop_name);
250
2
  ZVAL_COPY_VALUE(&args[1], value);
251
2
  zend_call_known_instance_method(zobj->ce->__set, zobj, NULL, 2, args);
252
2
}
253
/* }}} */
254
255
static void zend_std_call_unsetter(zend_object *zobj, zend_string *prop_name) /* {{{ */
256
0
{
257
0
  zval member;
258
0
  ZVAL_STR(&member, prop_name);
259
0
  zend_call_known_instance_method_with_1_params(zobj->ce->__unset, zobj, NULL, &member);
260
0
}
261
/* }}} */
262
263
static void zend_std_call_issetter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
264
0
{
265
0
  zval member;
266
0
  ZVAL_STR(&member, prop_name);
267
0
  zend_call_known_instance_method_with_1_params(zobj->ce->__isset, zobj, retval, &member);
268
0
}
269
/* }}} */
270
271
272
static zend_always_inline bool is_derived_class(const zend_class_entry *child_class, const zend_class_entry *parent_class) /* {{{ */
273
362k
{
274
362k
  child_class = child_class->parent;
275
542k
  while (child_class) {
276
361k
    if (child_class == parent_class) {
277
181k
      return 1;
278
181k
    }
279
179k
    child_class = child_class->parent;
280
179k
  }
281
282
181k
  return 0;
283
362k
}
284
/* }}} */
285
286
static zend_never_inline int is_protected_compatible_scope(const zend_class_entry *ce, const zend_class_entry *scope) /* {{{ */
287
181k
{
288
181k
  return scope &&
289
181k
    (ce == scope || is_derived_class(ce, scope) || is_derived_class(scope, ce));
290
181k
}
291
/* }}} */
292
293
static zend_never_inline zend_property_info *zend_get_parent_private_property(const zend_class_entry *scope, const zend_class_entry *ce, zend_string *member) /* {{{ */
294
1
{
295
1
  if (scope != ce && scope && is_derived_class(ce, scope)) {
296
1
    zend_property_info *prop_info = zend_hash_find_ptr(&scope->properties_info, member);
297
1
    if (prop_info != NULL) {
298
1
      if ((prop_info->flags & ZEND_ACC_PRIVATE)
299
1
       && prop_info->ce == scope) {
300
1
        return prop_info;
301
1
      }
302
1
    }
303
1
  }
304
0
  return NULL;
305
1
}
306
/* }}} */
307
308
static ZEND_COLD zend_never_inline void zend_bad_property_access(const zend_property_info *property_info, const zend_class_entry *ce, const zend_string *member) /* {{{ */
309
1
{
310
1
  zend_throw_error(NULL, "Cannot access %s property %s::$%s", zend_visibility_string(property_info->flags), ZSTR_VAL(ce->name), ZSTR_VAL(member));
311
1
}
312
/* }}} */
313
314
static ZEND_COLD zend_never_inline void zend_bad_property_name(void) /* {{{ */
315
14
{
316
14
  zend_throw_error(NULL, "Cannot access property starting with \"\\0\"");
317
14
}
318
/* }}} */
319
320
static ZEND_COLD zend_never_inline void zend_forbidden_dynamic_property(
321
0
    const zend_class_entry *ce, const zend_string *member) {
322
0
  zend_throw_error(NULL, "Cannot create dynamic property %s::$%s",
323
0
    ZSTR_VAL(ce->name), ZSTR_VAL(member));
324
0
}
325
326
static ZEND_COLD zend_never_inline bool zend_deprecated_dynamic_property(
327
10.5k
    zend_object *obj, const zend_string *member) {
328
10.5k
  GC_ADDREF(obj);
329
10.5k
  zend_error(E_DEPRECATED, "Creation of dynamic property %s::$%s is deprecated",
330
10.5k
    ZSTR_VAL(obj->ce->name), ZSTR_VAL(member));
331
10.5k
  if (UNEXPECTED(GC_DELREF(obj) == 0)) {
332
0
    const zend_class_entry *ce = obj->ce;
333
0
    zend_objects_store_del(obj);
334
0
    if (!EG(exception)) {
335
      /* We cannot continue execution and have to throw an exception */
336
0
      zend_throw_error(NULL, "Cannot create dynamic property %s::$%s",
337
0
        ZSTR_VAL(ce->name), ZSTR_VAL(member));
338
0
    }
339
0
    return 0;
340
0
  }
341
10.5k
  return 1;
342
10.5k
}
343
344
static ZEND_COLD zend_never_inline void zend_readonly_property_unset_error(
345
0
    const zend_class_entry *ce, const zend_string *member) {
346
0
  zend_throw_error(NULL, "Cannot unset readonly property %s::$%s",
347
0
    ZSTR_VAL(ce->name), ZSTR_VAL(member));
348
0
}
349
350
static zend_always_inline const zend_class_entry *get_fake_or_executed_scope(void)
351
2.03M
{
352
2.03M
  if (UNEXPECTED(EG(fake_scope))) {
353
2.03M
    return EG(fake_scope);
354
2.03M
  } else {
355
12
    return zend_get_executed_scope();
356
12
  }
357
2.03M
}
358
359
static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *ce, zend_string *member, int silent, void **cache_slot, const zend_property_info **info_ptr) /* {{{ */
360
706k
{
361
706k
  zend_property_info *property_info;
362
706k
  uint32_t flags;
363
706k
  uintptr_t offset;
364
365
706k
  if (cache_slot && EXPECTED(ce == CACHED_PTR_EX(cache_slot))) {
366
11
    *info_ptr = CACHED_PTR_EX(cache_slot + 2);
367
11
    return (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
368
11
  }
369
370
706k
  if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)
371
647k
   || UNEXPECTED((property_info = zend_hash_find_ptr(&ce->properties_info, member)) == NULL)) {
372
59.3k
    if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0') && ZSTR_LEN(member) != 0) {
373
14
      if (!silent) {
374
14
        zend_bad_property_name();
375
14
      }
376
14
      return ZEND_WRONG_PROPERTY_OFFSET;
377
14
    }
378
59.3k
dynamic:
379
59.3k
    if (cache_slot) {
380
162
      CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
381
162
      CACHE_PTR_EX(cache_slot + 2, NULL);
382
162
    }
383
59.3k
    return ZEND_DYNAMIC_PROPERTY_OFFSET;
384
59.3k
  }
385
386
647k
  flags = property_info->flags;
387
388
647k
  if (flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
389
647k
    const zend_class_entry *scope = get_fake_or_executed_scope();
390
391
647k
    if (property_info->ce != scope) {
392
181k
      if (flags & ZEND_ACC_CHANGED) {
393
1
        zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
394
395
        /* If there is a public/protected instance property on ce, don't try to use a
396
         * private static property on scope. If both are static, prefer the static
397
         * property on scope. This will throw a static property notice, rather than
398
         * a visibility error. */
399
1
        if (p && (!(p->flags & ZEND_ACC_STATIC) || (flags & ZEND_ACC_STATIC))) {
400
1
          property_info = p;
401
1
          flags = property_info->flags;
402
1
          goto found;
403
1
        } else if (flags & ZEND_ACC_PUBLIC) {
404
0
          goto found;
405
0
        }
406
1
      }
407
181k
      if (flags & ZEND_ACC_PRIVATE) {
408
6
        if (property_info->ce != ce) {
409
0
          goto dynamic;
410
6
        } else {
411
8
wrong:
412
          /* Information was available, but we were denied access.  Error out. */
413
8
          if (!silent) {
414
1
            zend_bad_property_access(property_info, ce, member);
415
1
          }
416
8
          return ZEND_WRONG_PROPERTY_OFFSET;
417
6
        }
418
181k
      } else {
419
181k
        ZEND_ASSERT(flags & ZEND_ACC_PROTECTED);
420
181k
        if (UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
421
2
          goto wrong;
422
2
        }
423
181k
      }
424
181k
    }
425
647k
  }
426
427
647k
found:
428
647k
  if (UNEXPECTED(flags & ZEND_ACC_STATIC)) {
429
0
    if (!silent) {
430
0
      zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
431
0
    }
432
0
    return ZEND_DYNAMIC_PROPERTY_OFFSET;
433
0
  }
434
435
647k
  if (property_info->hooks) {
436
27
    *info_ptr = property_info;
437
27
    if (cache_slot) {
438
19
      CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)ZEND_HOOKED_PROPERTY_OFFSET);
439
19
      CACHE_PTR_EX(cache_slot + 2, property_info);
440
19
    }
441
27
    return ZEND_HOOKED_PROPERTY_OFFSET;
442
27
  }
443
444
647k
  offset = property_info->offset;
445
647k
  if (EXPECTED(!ZEND_TYPE_IS_SET(property_info->type))) {
446
364k
    property_info = NULL;
447
364k
  } else {
448
282k
    *info_ptr = property_info;
449
282k
  }
450
647k
  if (cache_slot) {
451
53
    CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)(uintptr_t)offset);
452
53
    CACHE_PTR_EX(cache_slot + 2, property_info);
453
53
  }
454
647k
  return offset;
455
647k
}
456
/* }}} */
457
458
static ZEND_COLD void zend_wrong_offset(zend_class_entry *ce, zend_string *member) /* {{{ */
459
1
{
460
1
  const zend_property_info *dummy;
461
462
  /* Trigger the correct error */
463
1
  zend_get_property_offset(ce, member, 0, NULL, &dummy);
464
1
}
465
/* }}} */
466
467
ZEND_API zend_property_info *zend_get_property_info(const zend_class_entry *ce, zend_string *member, int silent) /* {{{ */
468
1.39M
{
469
1.39M
  zend_property_info *property_info;
470
1.39M
  uint32_t flags;
471
472
1.39M
  if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)
473
1.38M
   || EXPECTED((property_info = zend_hash_find_ptr(&ce->properties_info, member)) == NULL)) {
474
10.5k
    if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0') && ZSTR_LEN(member) != 0) {
475
2.18k
      if (!silent) {
476
0
        zend_bad_property_name();
477
0
      }
478
2.18k
      return ZEND_WRONG_PROPERTY_INFO;
479
2.18k
    }
480
8.32k
dynamic:
481
8.32k
    return NULL;
482
10.5k
  }
483
484
1.38M
  flags = property_info->flags;
485
486
1.38M
  if (flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
487
1.38M
    const zend_class_entry *scope = get_fake_or_executed_scope();
488
1.38M
    if (property_info->ce != scope) {
489
0
      if (flags & ZEND_ACC_CHANGED) {
490
0
        zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
491
492
0
        if (p) {
493
0
          property_info = p;
494
0
          flags = property_info->flags;
495
0
          goto found;
496
0
        } else if (flags & ZEND_ACC_PUBLIC) {
497
0
          goto found;
498
0
        }
499
0
      }
500
0
      if (flags & ZEND_ACC_PRIVATE) {
501
0
        if (property_info->ce != ce) {
502
0
          goto dynamic;
503
0
        } else {
504
0
wrong:
505
          /* Information was available, but we were denied access.  Error out. */
506
0
          if (!silent) {
507
0
            zend_bad_property_access(property_info, ce, member);
508
0
          }
509
0
          return ZEND_WRONG_PROPERTY_INFO;
510
0
        }
511
0
      } else {
512
0
        ZEND_ASSERT(flags & ZEND_ACC_PROTECTED);
513
0
        if (UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
514
0
          goto wrong;
515
0
        }
516
0
      }
517
0
    }
518
1.38M
  }
519
520
1.38M
found:
521
1.38M
  if (UNEXPECTED(flags & ZEND_ACC_STATIC)) {
522
10
    if (!silent) {
523
0
      zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
524
0
    }
525
10
  }
526
1.38M
  return property_info;
527
1.38M
}
528
/* }}} */
529
530
ZEND_API zend_result zend_check_property_access(const zend_object *zobj, zend_string *prop_info_name, bool is_dynamic) /* {{{ */
531
6
{
532
6
  zend_property_info *property_info;
533
6
  const char *class_name = NULL;
534
6
  const char *prop_name;
535
6
  zend_string *member;
536
6
  size_t prop_name_len;
537
538
6
  if (ZSTR_VAL(prop_info_name)[0] == 0) {
539
0
    if (is_dynamic) {
540
0
      return SUCCESS;
541
0
    }
542
543
0
    zend_unmangle_property_name_ex(prop_info_name, &class_name, &prop_name, &prop_name_len);
544
0
    member = zend_string_init(prop_name, prop_name_len, 0);
545
0
    property_info = zend_get_property_info(zobj->ce, member, 1);
546
0
    zend_string_release_ex(member, 0);
547
0
    if (property_info == NULL || property_info == ZEND_WRONG_PROPERTY_INFO) {
548
0
      return FAILURE;
549
0
    }
550
551
0
    if (class_name[0] != '*') {
552
0
      if (!(property_info->flags & ZEND_ACC_PRIVATE)) {
553
        /* we we're looking for a private prop but found a non private one of the same name */
554
0
        return FAILURE;
555
0
      } else if (strcmp(ZSTR_VAL(prop_info_name)+1, ZSTR_VAL(property_info->name)+1)) {
556
        /* we we're looking for a private prop but found a private one of the same name but another class */
557
0
        return FAILURE;
558
0
      }
559
0
    } else {
560
      /* We were looking for a protected property but found a private one
561
       * belonging to the parent class. */
562
0
      if (property_info->flags & ZEND_ACC_PRIVATE) {
563
0
        return FAILURE;
564
0
      }
565
0
      ZEND_ASSERT(property_info->flags & ZEND_ACC_PROTECTED);
566
0
    }
567
0
    return SUCCESS;
568
6
  } else {
569
6
    property_info = zend_get_property_info(zobj->ce, prop_info_name, 1);
570
6
    if (property_info == NULL) {
571
0
      ZEND_ASSERT(is_dynamic);
572
0
      return SUCCESS;
573
6
    } else if (property_info == ZEND_WRONG_PROPERTY_INFO) {
574
0
      return FAILURE;
575
0
    }
576
6
    return (property_info->flags & ZEND_ACC_PUBLIC) ? SUCCESS : FAILURE;
577
6
  }
578
6
}
579
/* }}} */
580
581
66
ZEND_API bool ZEND_FASTCALL zend_asymmetric_property_has_set_access(const zend_property_info *prop_info) {
582
66
  ZEND_ASSERT(prop_info->flags & ZEND_ACC_PPP_SET_MASK);
583
66
  ZEND_ASSERT(!(prop_info->flags & ZEND_ACC_PUBLIC_SET));
584
66
  const zend_class_entry *scope = get_fake_or_executed_scope();
585
66
  if (prop_info->ce == scope) {
586
66
    return true;
587
66
  }
588
0
  return EXPECTED((prop_info->flags & ZEND_ACC_PROTECTED_SET)
589
66
    && is_protected_compatible_scope(prop_info->prototype->ce, scope));
590
66
}
591
592
0
static void zend_property_guard_dtor(zval *el) /* {{{ */ {
593
0
  uint32_t *ptr = (uint32_t*)Z_PTR_P(el);
594
0
  if (EXPECTED(!(((uintptr_t)ptr) & 1))) {
595
0
    efree_size(ptr, sizeof(uint32_t));
596
0
  }
597
0
}
598
/* }}} */
599
600
static zend_always_inline zval *zend_get_guard_value(zend_object *zobj)
601
32
{
602
32
  return zobj->properties_table + zobj->ce->default_properties_count;
603
32
}
604
605
ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *member) /* {{{ */
606
16
{
607
16
  HashTable *guards;
608
16
  zval *zv;
609
16
  uint32_t *ptr;
610
611
612
16
  ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS);
613
16
  zv = zend_get_guard_value(zobj);
614
16
  if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
615
5
    zend_string *str = Z_STR_P(zv);
616
5
    if (EXPECTED(str == member) ||
617
        /* str and member don't necessarily have a pre-calculated hash value here */
618
5
        EXPECTED(zend_string_equal_content(str, member))) {
619
5
      return &Z_GUARD_P(zv);
620
5
    } else if (EXPECTED(Z_GUARD_P(zv) == 0)) {
621
0
      zval_ptr_dtor_str(zv);
622
0
      ZVAL_STR_COPY(zv, member);
623
0
      return &Z_GUARD_P(zv);
624
0
    } else {
625
0
      ALLOC_HASHTABLE(guards);
626
0
      zend_hash_init(guards, 8, NULL, zend_property_guard_dtor, 0);
627
      /* mark pointer as "special" using low bit */
628
0
      zend_hash_add_new_ptr(guards, str,
629
0
        (void*)(((uintptr_t)&Z_GUARD_P(zv)) | 1));
630
0
      zval_ptr_dtor_str(zv);
631
0
      ZVAL_ARR(zv, guards);
632
0
    }
633
11
  } else if (EXPECTED(Z_TYPE_P(zv) == IS_ARRAY)) {
634
0
    guards = Z_ARRVAL_P(zv);
635
0
    ZEND_ASSERT(guards != NULL);
636
0
    void *guard = zend_hash_find_ptr(guards, member);
637
0
    if (guard != NULL) {
638
0
      return (uint32_t*)(((uintptr_t)guard) & ~1);
639
0
    }
640
11
  } else {
641
11
    ZEND_ASSERT(Z_TYPE_P(zv) == IS_UNDEF);
642
11
    ZVAL_STR_COPY(zv, member);
643
11
    Z_GUARD_P(zv) &= ~ZEND_GUARD_PROPERTY_MASK;
644
11
    return &Z_GUARD_P(zv);
645
11
  }
646
  /* we have to allocate uint32_t separately because ht->arData may be reallocated */
647
0
  ptr = (uint32_t*)emalloc(sizeof(uint32_t));
648
0
  *ptr = 0;
649
0
  return (uint32_t*)zend_hash_add_new_ptr(guards, member, ptr);
650
16
}
651
/* }}} */
652
653
ZEND_API uint32_t *zend_get_recursion_guard(zend_object *zobj)
654
163
{
655
163
  if (!(zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
656
147
    return NULL;
657
147
  }
658
16
  zval *zv = zend_get_guard_value(zobj);
659
16
  return &Z_GUARD_P(zv);
660
163
}
661
662
static zend_always_inline zend_object *zend_lazy_proxy_get_guarded_instance(
663
    zend_object *zobj, zend_string *name, uint32_t guard_type)
664
48.9k
{
665
48.9k
  if (UNEXPECTED(zend_object_is_lazy_proxy(zobj)
666
48.9k
      && zend_lazy_object_initialized(zobj))) {
667
0
    zend_object *instance = zend_lazy_object_get_instance(zobj);
668
0
    if (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS) {
669
0
      uint32_t *instance_guard = zend_get_property_guard(instance, name);
670
0
      if ((*instance_guard) & guard_type) {
671
0
        return instance;
672
0
      }
673
0
    }
674
0
  }
675
676
48.9k
  return NULL;
677
48.9k
}
678
679
ZEND_COLD static void zend_typed_property_uninitialized_access(const zend_property_info *prop_info, zend_string *name)
680
0
{
681
0
  zend_throw_error(NULL, "Typed property %s::$%s must not be accessed before initialization",
682
0
    ZSTR_VAL(prop_info->ce->name),
683
0
    ZSTR_VAL(name));
684
0
}
685
686
static ZEND_FUNCTION(zend_parent_hook_get_trampoline);
687
static ZEND_FUNCTION(zend_parent_hook_set_trampoline);
688
689
static bool zend_is_in_hook(const zend_property_info *prop_info)
690
22
{
691
22
  const zend_execute_data *execute_data = EG(current_execute_data);
692
22
  if (!execute_data || !EX(func) || !EX(func)->common.prop_info) {
693
16
    return false;
694
16
  }
695
696
6
  const zend_property_info *parent_info = EX(func)->common.prop_info;
697
6
  ZEND_ASSERT(prop_info->prototype && parent_info->prototype);
698
6
  return prop_info->prototype == parent_info->prototype;
699
6
}
700
701
static bool zend_should_call_hook(const zend_property_info *prop_info, const zend_object *obj)
702
22
{
703
22
  if (!zend_is_in_hook(prop_info)) {
704
16
    return true;
705
16
  }
706
707
  /* execute_data and This are guaranteed to be set if zend_is_in_hook() returns true. */
708
6
  zend_object *parent_obj = Z_OBJ(EG(current_execute_data)->This);
709
6
  if (parent_obj == obj) {
710
6
    return false;
711
6
  }
712
713
0
  if (zend_object_is_lazy_proxy(parent_obj)
714
0
   && zend_lazy_object_initialized(parent_obj)
715
0
   && zend_lazy_object_get_instance(parent_obj) == obj) {
716
0
    return false;
717
0
  }
718
719
0
  return true;
720
0
}
721
722
static ZEND_COLD void zend_throw_no_prop_backing_value_access(const zend_string *class_name, const zend_string *prop_name, bool is_read)
723
0
{
724
0
  zend_throw_error(NULL, "Must not %s virtual property %s::$%s",
725
0
    is_read ? "read from" : "write to",
726
0
    ZSTR_VAL(class_name), ZSTR_VAL(prop_name));
727
0
}
728
729
static bool zend_call_get_hook(
730
  const zend_property_info *prop_info, const zend_string *prop_name,
731
  zend_function *get, zend_object *zobj, zval *rv)
732
12
{
733
12
  if (!zend_should_call_hook(prop_info, zobj)) {
734
2
    if (UNEXPECTED(prop_info->flags & ZEND_ACC_VIRTUAL)) {
735
0
      zend_throw_no_prop_backing_value_access(zobj->ce->name, prop_name, /* is_read */ true);
736
0
    }
737
2
    return false;
738
2
  }
739
740
10
  GC_ADDREF(zobj);
741
10
  zend_call_known_instance_method_with_0_params(get, zobj, rv);
742
10
  OBJ_RELEASE(zobj);
743
744
10
  return true;
745
12
}
746
747
ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int type, void **cache_slot, zval *rv) /* {{{ */
748
303k
{
749
303k
  zval *retval;
750
303k
  uintptr_t property_offset;
751
303k
  const zend_property_info *prop_info = NULL;
752
303k
  uint32_t *guard = NULL;
753
303k
  bool release_zobj = false;
754
755
#if DEBUG_OBJECT_HANDLERS
756
  fprintf(stderr, "Read object #%d property: %s\n", zobj->handle, ZSTR_VAL(name));
757
#endif
758
759
  /* make zend_get_property_info silent if we have getter - we may want to use it */
760
303k
  property_offset = zend_get_property_offset(zobj->ce, name, (type == BP_VAR_IS) || (zobj->ce->__get != NULL), cache_slot, &prop_info);
761
762
303k
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
763
303k
try_again:
764
303k
    retval = OBJ_PROP(zobj, property_offset);
765
766
303k
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))
767
81
     && (type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)
768
1
     && ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info))) {
769
1
      if (Z_TYPE_P(retval) == IS_OBJECT) {
770
        /* For objects, W/RW/UNSET fetch modes might not actually modify object.
771
         * Similar as with magic __get() allow them, but return the value as a copy
772
         * to make sure no actual modification is possible. */
773
0
        ZVAL_COPY(rv, retval);
774
0
        retval = rv;
775
0
        goto exit;
776
1
      } else if (Z_TYPE_P(retval) == IS_UNDEF && type == BP_VAR_UNSET) {
777
0
        retval = &EG(uninitialized_zval);
778
0
        goto exit;
779
0
      }
780
1
      if (prop_info->flags & ZEND_ACC_READONLY) {
781
1
        zend_readonly_property_indirect_modification_error(prop_info);
782
1
      } else {
783
0
        zend_asymmetric_visibility_property_modification_error(prop_info, "indirectly modify");
784
0
      }
785
1
      retval = &EG(uninitialized_zval);
786
1
      goto exit;
787
1
    }
788
303k
    if (EXPECTED(Z_TYPE_P(retval) != IS_UNDEF)) {
789
303k
      goto exit;
790
303k
    }
791
4
    if (UNEXPECTED(Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT)) {
792
      /* Skip __get() for uninitialized typed properties */
793
2
      goto uninit_error;
794
2
    }
795
223
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
796
200
    if (EXPECTED(zobj->properties != NULL)) {
797
8
      if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
798
0
        uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
799
800
0
        if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
801
0
          Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
802
803
0
          if (EXPECTED(p->key == name) ||
804
0
                (EXPECTED(p->h == ZSTR_H(name)) &&
805
0
                 EXPECTED(p->key != NULL) &&
806
0
                 EXPECTED(zend_string_equal_content(p->key, name)))) {
807
0
            retval = &p->val;
808
0
            goto exit;
809
0
          }
810
0
        }
811
0
        CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
812
0
      }
813
8
      retval = zend_hash_find(zobj->properties, name);
814
8
      if (EXPECTED(retval)) {
815
8
        if (cache_slot) {
816
8
          uintptr_t idx = (char*)retval - (char*)zobj->properties->arData;
817
8
          CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
818
8
        }
819
8
        goto exit;
820
8
      }
821
8
    }
822
200
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
823
19
    zend_function *get = prop_info->hooks[ZEND_PROPERTY_HOOK_GET];
824
19
    if (!get) {
825
7
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
826
0
        zend_throw_error(NULL, "Cannot read from set-only virtual property %s::$%s",
827
0
          ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
828
0
        return &EG(uninitialized_zval);
829
0
      }
830
      /* Cache the fact that this hook has trivial read. This only applies to
831
       * BP_VAR_R and BP_VAR_IS fetches. */
832
7
      ZEND_SET_PROPERTY_HOOK_SIMPLE_READ(cache_slot);
833
834
7
      retval = OBJ_PROP(zobj, prop_info->offset);
835
7
      if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
836
        /* As hooked properties can't be unset, the only way to end up with an undef
837
         * value is via an uninitialized property. */
838
3
        ZEND_ASSERT(Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT);
839
3
        goto uninit_error;
840
3
      }
841
842
4
      if (UNEXPECTED(type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)) {
843
0
        if (UNEXPECTED(Z_TYPE_P(retval) != IS_OBJECT)) {
844
0
          zend_throw_error(NULL, "Indirect modification of %s::$%s is not allowed",
845
0
            ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
846
0
          goto exit;
847
0
        }
848
0
        ZVAL_COPY(rv, retval);
849
0
        retval = rv;
850
0
      }
851
4
      goto exit;
852
4
    }
853
854
12
    const zend_class_entry *ce = zobj->ce;
855
856
12
    if (!zend_call_get_hook(prop_info, name, get, zobj, rv)) {
857
2
      if (EG(exception)) {
858
0
        return &EG(uninitialized_zval);
859
0
      }
860
861
      /* Reads from backing store can only occur in hooks, and hence will always remain simple. */
862
2
      const zend_execute_data *execute_data = EG(current_execute_data);
863
2
      if (cache_slot && EX(opline) && EX(opline)->opcode == ZEND_FETCH_OBJ_R && EX(opline)->op1_type == IS_UNUSED) {
864
2
        ZEND_SET_PROPERTY_HOOK_SIMPLE_READ(cache_slot);
865
2
      }
866
867
2
      property_offset = prop_info->offset;
868
2
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
869
2
        prop_info = NULL;
870
2
      }
871
2
      goto try_again;
872
2
    }
873
874
10
    if (EXPECTED(cache_slot
875
10
     && zend_execute_ex == execute_ex
876
10
     && ce->default_object_handlers->read_property == zend_std_read_property
877
10
     && !ce->create_object
878
10
     && !zend_is_in_hook(prop_info)
879
10
     && !(prop_info->hooks[ZEND_PROPERTY_HOOK_GET]->common.fn_flags & ZEND_ACC_RETURN_REFERENCE))) {
880
0
      ZEND_SET_PROPERTY_HOOK_SIMPLE_GET(cache_slot);
881
0
    }
882
883
10
    if (Z_TYPE_P(rv) != IS_UNDEF) {
884
9
      retval = rv;
885
9
      if (!Z_ISREF_P(rv)
886
5
       && (type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET)
887
0
       && UNEXPECTED(Z_TYPE_P(rv) != IS_OBJECT)) {
888
0
        zend_throw_error(NULL, "Indirect modification of %s::$%s is not allowed",
889
0
          ZSTR_VAL(ce->name), ZSTR_VAL(name));
890
0
      }
891
9
    } else {
892
1
      retval = &EG(uninitialized_zval);
893
1
    }
894
895
10
    goto exit;
896
12
  } else if (UNEXPECTED(EG(exception))) {
897
0
    retval = &EG(uninitialized_zval);
898
0
    goto exit;
899
0
  }
900
901
198
  retval = &EG(uninitialized_zval);
902
903
  /* For initialized lazy proxies: if the real instance's magic method
904
   * guard is already set for this property, we are inside a recursive
905
   * call from the real instance's __get/__isset. Forward directly to
906
   * the real instance to avoid double invocation. (GH-21478) */
907
198
  {
908
198
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name,
909
198
      ((type == BP_VAR_IS) && zobj->ce->__isset) ? IN_ISSET : IN_GET);
910
198
    if (instance) {
911
0
      retval = zend_std_read_property(instance, name, type, cache_slot, rv);
912
0
      if (retval == &EG(uninitialized_zval)) {
913
0
        ZVAL_NULL(rv);
914
0
        retval = rv;
915
0
      }
916
0
      return retval;
917
0
    }
918
198
  }
919
920
  /* magic isset */
921
198
  if ((type == BP_VAR_IS) && zobj->ce->__isset) {
922
0
    zval tmp_result;
923
0
    guard = zend_get_property_guard(zobj, name);
924
925
0
    if (!((*guard) & IN_ISSET)) {
926
0
      GC_ADDREF(zobj);
927
928
0
      *guard |= IN_ISSET;
929
0
      zend_std_call_issetter(zobj, name, &tmp_result);
930
0
      *guard &= ~IN_ISSET;
931
932
0
      if (!zend_is_true(&tmp_result)) {
933
0
        retval = &EG(uninitialized_zval);
934
0
        OBJ_RELEASE(zobj);
935
0
        zval_ptr_dtor(&tmp_result);
936
0
        goto exit;
937
0
      }
938
939
0
      zval_ptr_dtor(&tmp_result);
940
941
      /* __isset() may have materialised the property by writing into
942
       * the property table. Re-check it before deferring to __get(),
943
       * so the freshly-written value is returned directly without a
944
       * redundant __get() call (GH-12695). The value is copied into
945
       * `rv` because the property table can be freed by the OBJ_RELEASE
946
       * below (e.g. when __isset() drops the last external reference
947
       * to the object). */
948
0
      if (IS_VALID_PROPERTY_OFFSET(property_offset)) {
949
0
        retval = OBJ_PROP(zobj, property_offset);
950
0
        if (Z_TYPE_P(retval) != IS_UNDEF) {
951
0
          ZVAL_COPY(rv, retval);
952
0
          retval = rv;
953
0
          OBJ_RELEASE(zobj);
954
0
          goto exit;
955
0
        }
956
0
      } else if (IS_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
957
0
        if (zobj->properties != NULL) {
958
0
          retval = zend_hash_find(zobj->properties, name);
959
0
          if (retval) {
960
0
            ZVAL_COPY(rv, retval);
961
0
            retval = rv;
962
0
            OBJ_RELEASE(zobj);
963
0
            goto exit;
964
0
          }
965
0
        }
966
0
      }
967
0
      retval = &EG(uninitialized_zval);
968
969
0
      if (zobj->ce->__get && !((*guard) & IN_GET)) {
970
0
        goto call_getter;
971
0
      }
972
0
      release_zobj = true;
973
0
    } else if (zobj->ce->__get && !((*guard) & IN_GET)) {
974
0
      goto call_getter_addref;
975
0
    }
976
198
  } else if (zobj->ce->__get) {
977
    /* magic get */
978
10
    guard = zend_get_property_guard(zobj, name);
979
10
    if (!((*guard) & IN_GET)) {
980
      /* have getter - try with it! */
981
9
call_getter_addref:
982
9
      GC_ADDREF(zobj);
983
9
call_getter:
984
9
      *guard |= IN_GET; /* prevent circular getting */
985
9
      zend_std_call_getter(zobj, name, rv);
986
9
      *guard &= ~IN_GET;
987
988
9
      if (Z_TYPE_P(rv) != IS_UNDEF) {
989
6
        retval = rv;
990
6
        if (!Z_ISREF_P(rv) &&
991
4
            (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
992
1
          if (UNEXPECTED(Z_TYPE_P(rv) != IS_OBJECT)) {
993
0
            zend_error(E_NOTICE, "Indirect modification of overloaded property %s::$%s has no effect", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
994
0
          }
995
1
        }
996
6
      } else {
997
3
        retval = &EG(uninitialized_zval);
998
3
      }
999
1000
9
      if (prop_info) {
1001
2
        zend_verify_prop_assignable_by_ref_ex(prop_info, retval, (zobj->ce->__get->common.fn_flags & ZEND_ACC_STRICT_TYPES) != 0, ZEND_VERIFY_PROP_ASSIGNABLE_BY_REF_CONTEXT_MAGIC_GET);
1002
2
      }
1003
1004
9
      OBJ_RELEASE(zobj);
1005
9
      goto exit;
1006
9
    } else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1007
      /* Trigger the correct error */
1008
1
      zend_wrong_offset(zobj->ce, name);
1009
1
      ZEND_ASSERT(EG(exception));
1010
1
      retval = &EG(uninitialized_zval);
1011
1
      goto exit;
1012
1
    }
1013
10
  }
1014
1015
193
uninit_error:
1016
193
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1017
2
    if (!prop_info || (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY)) {
1018
2
      zend_object *instance = zend_lazy_object_init(zobj);
1019
2
      if (!instance) {
1020
0
        retval = &EG(uninitialized_zval);
1021
0
        goto release_zobj_exit;
1022
0
      }
1023
1024
2
      if (UNEXPECTED(guard && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS))) {
1025
        /* Find which guard was used on zobj, so we can set the same
1026
         * guard on instance. */
1027
0
        uint32_t guard_type = (type == BP_VAR_IS) && zobj->ce->__isset
1028
0
          ? IN_ISSET : IN_GET;
1029
0
        guard = zend_get_property_guard(instance, name);
1030
0
        if (!((*guard) & guard_type)) {
1031
0
          (*guard) |= guard_type;
1032
0
          retval = zend_std_read_property(instance, name, type, cache_slot, rv);
1033
0
          (*guard) &= ~guard_type;
1034
0
          goto release_zobj_exit;
1035
0
        }
1036
0
      }
1037
1038
2
      retval = zend_std_read_property(instance, name, type, cache_slot, rv);
1039
2
      goto release_zobj_exit;
1040
2
    }
1041
2
  }
1042
191
  if (type != BP_VAR_IS) {
1043
185
    if (prop_info) {
1044
0
      zend_typed_property_uninitialized_access(prop_info, name);
1045
185
    } else {
1046
185
      zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1047
185
    }
1048
185
  }
1049
191
  retval = &EG(uninitialized_zval);
1050
1051
193
release_zobj_exit:
1052
193
  if (release_zobj) {
1053
0
    OBJ_RELEASE(zobj);
1054
0
  }
1055
303k
exit:
1056
303k
  return retval;
1057
193
}
1058
/* }}} */
1059
1060
396k
static zend_always_inline bool property_uses_strict_types(void) {
1061
396k
  const zend_execute_data *execute_data = EG(current_execute_data);
1062
396k
  return execute_data
1063
181k
    && execute_data->func
1064
181k
    && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
1065
396k
}
1066
1067
static zval *forward_write_to_lazy_object(zend_object *zobj,
1068
    zend_string *name, zval *value, void **cache_slot, bool guarded)
1069
0
{
1070
0
  zval *variable_ptr;
1071
1072
  /* backup value as it may change during initialization */
1073
0
  zval backup;
1074
0
  ZVAL_COPY(&backup, value);
1075
1076
0
  zend_object *instance = zend_lazy_object_init(zobj);
1077
0
  if (UNEXPECTED(!instance)) {
1078
0
    zval_ptr_dtor(&backup);
1079
0
    return &EG(error_zval);
1080
0
  }
1081
1082
0
  if (UNEXPECTED(guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS))) {
1083
0
    uint32_t *guard = zend_get_property_guard(instance, name);
1084
0
    if (!((*guard) & IN_SET)) {
1085
0
      (*guard) |= IN_SET;
1086
0
      variable_ptr = zend_std_write_property(instance, name, &backup, cache_slot);
1087
0
      (*guard) &= ~IN_SET;
1088
0
      goto exit;
1089
0
    }
1090
0
  }
1091
1092
0
  variable_ptr = zend_std_write_property(instance, name, &backup, cache_slot);
1093
1094
0
exit:
1095
0
  zval_ptr_dtor(&backup);
1096
1097
0
  if (variable_ptr == &backup) {
1098
0
    variable_ptr = value;
1099
0
  }
1100
1101
0
  return variable_ptr;
1102
0
}
1103
1104
ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zval *value, void **cache_slot) /* {{{ */
1105
403k
{
1106
403k
  zval *variable_ptr, tmp;
1107
403k
  uintptr_t property_offset;
1108
403k
  const zend_property_info *prop_info = NULL;
1109
403k
  uint32_t *guard = NULL;
1110
403k
  ZEND_ASSERT(!Z_ISREF_P(value));
1111
1112
403k
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__set != NULL), cache_slot, &prop_info);
1113
1114
403k
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1115
344k
try_again:
1116
344k
    variable_ptr = OBJ_PROP(zobj, property_offset);
1117
1118
344k
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1119
100
      bool error;
1120
100
      if (Z_TYPE_P(variable_ptr) != IS_UNDEF || (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_UNINIT) || !zobj->ce->__set) {
1121
100
        error = true;
1122
100
      } else {
1123
0
        guard = zend_get_property_guard(zobj, name);
1124
0
        error = (*guard) & IN_SET;
1125
0
      }
1126
100
      if (error) {
1127
100
        if ((prop_info->flags & ZEND_ACC_READONLY)
1128
100
         && Z_TYPE_P(variable_ptr) != IS_UNDEF
1129
0
         && !(Z_PROP_FLAG_P(variable_ptr) & IS_PROP_REINITABLE)) {
1130
0
          zend_readonly_property_modification_error(prop_info);
1131
0
          variable_ptr = &EG(error_zval);
1132
0
          goto exit;
1133
0
        }
1134
100
        if ((prop_info->flags & ZEND_ACC_PPP_SET_MASK) && !zend_asymmetric_property_has_set_access(prop_info)) {
1135
0
          zend_asymmetric_visibility_property_modification_error(prop_info, "modify");
1136
0
          variable_ptr = &EG(error_zval);
1137
0
          if (cache_slot) {
1138
            /* Reset cache slot to dodge fast path in next execution. */
1139
0
            CACHE_POLYMORPHIC_PTR_EX(cache_slot, NULL, NULL);
1140
0
            CACHE_PTR_EX(cache_slot + 2, NULL);
1141
0
          }
1142
0
          goto exit;
1143
0
        }
1144
100
      }
1145
100
    }
1146
1147
344k
    if (Z_TYPE_P(variable_ptr) != IS_UNDEF) {
1148
343k
      Z_TRY_ADDREF_P(value);
1149
1150
343k
      if (prop_info) {
1151
41.6k
typed_property:
1152
41.6k
        ZVAL_COPY_VALUE(&tmp, value);
1153
        // Increase refcount to prevent object from being released in __toString()
1154
41.6k
        GC_ADDREF(zobj);
1155
41.6k
        bool type_matched = zend_verify_property_type(prop_info, &tmp, property_uses_strict_types());
1156
41.6k
        if (UNEXPECTED(GC_DELREF(zobj) == 0)) {
1157
0
          zend_object_released_while_assigning_to_property_error(prop_info);
1158
0
          zend_objects_store_del(zobj);
1159
0
          zval_ptr_dtor(&tmp);
1160
0
          variable_ptr = &EG(error_zval);
1161
0
          goto exit;
1162
0
        }
1163
41.6k
        if (UNEXPECTED(!type_matched)) {
1164
1
          zval_ptr_dtor(&tmp);
1165
1
          variable_ptr = &EG(error_zval);
1166
1
          goto exit;
1167
1
        }
1168
41.6k
        Z_PROP_FLAG_P(variable_ptr) &= ~(IS_PROP_UNINIT|IS_PROP_REINITABLE);
1169
41.6k
        value = &tmp;
1170
41.6k
      }
1171
1172
354k
found:;
1173
354k
      zend_refcounted *garbage = NULL;
1174
1175
354k
      variable_ptr = zend_assign_to_variable_ex(
1176
354k
        variable_ptr, value, IS_TMP_VAR, property_uses_strict_types(), &garbage);
1177
1178
354k
      if (garbage) {
1179
20.7k
        if (GC_DELREF(garbage) == 0) {
1180
2.21k
          zend_execute_data *execute_data = EG(current_execute_data);
1181
          // Assign to result variable before calling the destructor as it may release the object
1182
2.21k
          if (execute_data
1183
4
           && EX(func)
1184
4
           && ZEND_USER_CODE(EX(func)->common.type)
1185
4
           && EX(opline)
1186
4
           && EX(opline)->opcode == ZEND_ASSIGN_OBJ
1187
4
           && EX(opline)->result_type) {
1188
3
            ZVAL_COPY_DEREF(EX_VAR(EX(opline)->result.var), variable_ptr);
1189
3
            variable_ptr = NULL;
1190
3
          }
1191
2.21k
          rc_dtor_func(garbage);
1192
18.5k
        } else {
1193
18.5k
          gc_check_possible_root_no_ref(garbage);
1194
18.5k
        }
1195
20.7k
      }
1196
354k
      goto exit;
1197
343k
    }
1198
103
    if (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_UNINIT) {
1199
103
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1200
0
        if (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_LAZY) {
1201
0
          goto lazy_init;
1202
0
        }
1203
0
      }
1204
      /* Writes to uninitialized typed properties bypass __set(). */
1205
103
      goto write_std_property;
1206
103
    }
1207
59.0k
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
1208
59.0k
    if (EXPECTED(zobj->properties != NULL)) {
1209
31.7k
      if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1210
0
        if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1211
0
          GC_DELREF(zobj->properties);
1212
0
        }
1213
0
        zobj->properties = zend_array_dup(zobj->properties);
1214
0
      }
1215
31.7k
      if ((variable_ptr = zend_hash_find(zobj->properties, name)) != NULL) {
1216
10.3k
        Z_TRY_ADDREF_P(value);
1217
10.3k
        goto found;
1218
10.3k
      }
1219
31.7k
    }
1220
59.0k
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1221
8
    zend_function *set = prop_info->hooks[ZEND_PROPERTY_HOOK_SET];
1222
1223
8
    if (!set) {
1224
2
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
1225
1
        zend_throw_error(NULL, "Cannot write to get-only virtual property %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1226
1
        variable_ptr = &EG(error_zval);
1227
1
        goto exit;
1228
1
      }
1229
1
      ZEND_SET_PROPERTY_HOOK_SIMPLE_WRITE(cache_slot);
1230
1
      property_offset = prop_info->offset;
1231
1
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1232
1
        prop_info = NULL;
1233
1
      }
1234
1
      goto try_again;
1235
2
    }
1236
1237
6
    if (!zend_should_call_hook(prop_info, zobj)) {
1238
2
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
1239
0
        zend_throw_no_prop_backing_value_access(zobj->ce->name, name, /* is_read */ false);
1240
0
        variable_ptr = &EG(error_zval);
1241
0
        goto exit;
1242
0
      }
1243
1244
      /* Writes to backing store can only occur in hooks, and hence will always remain simple. */
1245
2
      zend_execute_data *execute_data = EG(current_execute_data);
1246
2
      if (cache_slot && EX(opline) && EX(opline)->opcode == ZEND_ASSIGN_OBJ && EX(opline)->op1_type == IS_UNUSED) {
1247
1
        ZEND_SET_PROPERTY_HOOK_SIMPLE_WRITE(cache_slot);
1248
1
      }
1249
1250
2
      property_offset = prop_info->offset;
1251
2
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1252
1
        prop_info = NULL;
1253
1
      }
1254
2
      goto try_again;
1255
2
    }
1256
1257
4
    if (UNEXPECTED(prop_info->flags & ZEND_ACC_PPP_SET_MASK
1258
4
     && !zend_asymmetric_property_has_set_access(prop_info))) {
1259
0
      zend_asymmetric_visibility_property_modification_error(prop_info, "modify");
1260
0
      variable_ptr = &EG(error_zval);
1261
0
      goto exit;
1262
0
    }
1263
1264
4
    GC_ADDREF(zobj);
1265
4
    zend_call_known_instance_method_with_1_params(set, zobj, NULL, value);
1266
4
    OBJ_RELEASE(zobj);
1267
1268
4
    variable_ptr = value;
1269
4
    goto exit;
1270
14
  } else if (UNEXPECTED(EG(exception))) {
1271
14
    variable_ptr = &EG(error_zval);
1272
14
    goto exit;
1273
14
  }
1274
1275
  /* For initialized lazy proxies: if the real instance's __set guard
1276
   * is already set, we are inside a recursive call from the real
1277
   * instance's __set. Forward directly to avoid double invocation. */
1278
48.6k
  {
1279
48.6k
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_SET);
1280
48.6k
    if (instance) {
1281
0
      return zend_std_write_property(instance, name, value, cache_slot);
1282
0
    }
1283
48.6k
  }
1284
1285
  /* magic set */
1286
48.6k
  if (zobj->ce->__set) {
1287
2
    if (!guard) {
1288
2
      guard = zend_get_property_guard(zobj, name);
1289
2
    }
1290
1291
2
    if (!((*guard) & IN_SET)) {
1292
2
      GC_ADDREF(zobj);
1293
2
      (*guard) |= IN_SET; /* prevent circular setting */
1294
2
      zend_std_call_setter(zobj, name, value);
1295
2
      (*guard) &= ~IN_SET;
1296
2
      OBJ_RELEASE(zobj);
1297
2
      variable_ptr = value;
1298
2
    } else if (EXPECTED(!IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1299
0
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1300
0
        return forward_write_to_lazy_object(zobj, name, value,
1301
0
            cache_slot, /* guarded */ true);
1302
0
      }
1303
1304
0
      goto write_std_property;
1305
0
    } else {
1306
      /* Trigger the correct error */
1307
0
      zend_wrong_offset(zobj->ce, name);
1308
0
      ZEND_ASSERT(EG(exception));
1309
0
      variable_ptr = &EG(error_zval);
1310
0
      goto exit;
1311
0
    }
1312
48.6k
  } else {
1313
48.6k
    ZEND_ASSERT(!IS_WRONG_PROPERTY_OFFSET(property_offset));
1314
48.6k
    if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1315
0
      goto lazy_init;
1316
0
    }
1317
48.8k
write_std_property:
1318
48.8k
    if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1319
103
      variable_ptr = OBJ_PROP(zobj, property_offset);
1320
1321
103
      Z_TRY_ADDREF_P(value);
1322
103
      if (prop_info) {
1323
103
        goto typed_property;
1324
103
      }
1325
1326
0
      ZVAL_COPY_VALUE(variable_ptr, value);
1327
48.6k
    } else {
1328
48.6k
      if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
1329
0
        zend_forbidden_dynamic_property(zobj->ce, name);
1330
0
        variable_ptr = &EG(error_zval);
1331
0
        goto exit;
1332
0
      }
1333
48.6k
      if (UNEXPECTED(!(zobj->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES))) {
1334
10.5k
        if (UNEXPECTED(!zend_deprecated_dynamic_property(zobj, name))) {
1335
0
          variable_ptr = &EG(error_zval);
1336
0
          goto exit;
1337
0
        }
1338
10.5k
      }
1339
1340
48.6k
      Z_TRY_ADDREF_P(value);
1341
48.6k
      variable_ptr = zend_hash_add_new(zend_std_get_properties(zobj), name, value);
1342
48.6k
    }
1343
48.8k
  }
1344
1345
403k
exit:
1346
403k
  return variable_ptr;
1347
1348
0
lazy_init:
1349
0
  return forward_write_to_lazy_object(zobj, name, value, cache_slot,
1350
0
      /* guarded */ false);
1351
48.6k
}
1352
/* }}} */
1353
1354
static ZEND_COLD zend_never_inline void zend_bad_array_access(const zend_class_entry *ce) /* {{{ */
1355
1
{
1356
1
  zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
1357
1
}
1358
/* }}} */
1359
1360
ZEND_API zval *zend_std_read_dimension(zend_object *object, zval *offset, int type, zval *rv) /* {{{ */
1361
1
{
1362
1
  const zend_class_entry *ce = object->ce;
1363
1
  zval tmp_offset;
1364
1365
  /* arrayaccess_funcs_ptr is set if (and only if) the class implements zend_ce_arrayaccess */
1366
1
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1367
1
  if (EXPECTED(funcs)) {
1368
0
    if (offset == NULL) {
1369
      /* [] construct */
1370
0
      ZVAL_NULL(&tmp_offset);
1371
0
    } else {
1372
0
      ZVAL_COPY_DEREF(&tmp_offset, offset);
1373
0
    }
1374
1375
0
    GC_ADDREF(object);
1376
0
    if (type == BP_VAR_IS) {
1377
0
      zend_call_known_instance_method_with_1_params(funcs->zf_offsetexists, object, rv, &tmp_offset);
1378
0
      if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
1379
0
        OBJ_RELEASE(object);
1380
0
        zval_ptr_dtor(&tmp_offset);
1381
0
        return NULL;
1382
0
      }
1383
0
      if (!i_zend_is_true(rv)) {
1384
0
        OBJ_RELEASE(object);
1385
0
        zval_ptr_dtor(&tmp_offset);
1386
0
        zval_ptr_dtor(rv);
1387
0
        return &EG(uninitialized_zval);
1388
0
      }
1389
0
      zval_ptr_dtor(rv);
1390
0
    }
1391
1392
0
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetget, object, rv, &tmp_offset);
1393
1394
0
    OBJ_RELEASE(object);
1395
0
    zval_ptr_dtor(&tmp_offset);
1396
1397
0
    if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
1398
0
      if (UNEXPECTED(!EG(exception))) {
1399
0
        zend_throw_error(NULL, "Undefined offset for object of type %s used as array", ZSTR_VAL(ce->name));
1400
0
      }
1401
0
      return NULL;
1402
0
    }
1403
0
    return rv;
1404
1
  } else {
1405
1
      zend_bad_array_access(ce);
1406
1
    return NULL;
1407
1
  }
1408
1
}
1409
/* }}} */
1410
1411
ZEND_API void zend_std_write_dimension(zend_object *object, zval *offset, zval *value) /* {{{ */
1412
0
{
1413
0
  const zend_class_entry *ce = object->ce;
1414
0
  zval tmp_offset;
1415
1416
0
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1417
0
  if (EXPECTED(funcs)) {
1418
0
    if (!offset) {
1419
0
      ZVAL_NULL(&tmp_offset);
1420
0
    } else {
1421
0
      ZVAL_COPY_DEREF(&tmp_offset, offset);
1422
0
    }
1423
0
    GC_ADDREF(object);
1424
0
    zend_call_known_instance_method_with_2_params(funcs->zf_offsetset, object, NULL, &tmp_offset, value);
1425
0
    OBJ_RELEASE(object);
1426
0
    zval_ptr_dtor(&tmp_offset);
1427
0
  } else {
1428
0
      zend_bad_array_access(ce);
1429
0
  }
1430
0
}
1431
/* }}} */
1432
1433
// todo: make zend_std_has_dimension return bool as well
1434
ZEND_API int zend_std_has_dimension(zend_object *object, zval *offset, int check_empty) /* {{{ */
1435
0
{
1436
0
  const zend_class_entry *ce = object->ce;
1437
0
  zval retval, tmp_offset;
1438
0
  bool result;
1439
1440
0
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1441
0
  if (EXPECTED(funcs)) {
1442
0
    ZVAL_COPY_DEREF(&tmp_offset, offset);
1443
0
    GC_ADDREF(object);
1444
0
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetexists, object, &retval, &tmp_offset);
1445
0
    result = i_zend_is_true(&retval);
1446
0
    zval_ptr_dtor(&retval);
1447
0
    if (check_empty && result && EXPECTED(!EG(exception))) {
1448
0
      zend_call_known_instance_method_with_1_params(funcs->zf_offsetget, object, &retval, &tmp_offset);
1449
0
      result = i_zend_is_true(&retval);
1450
0
      zval_ptr_dtor(&retval);
1451
0
    }
1452
0
    OBJ_RELEASE(object);
1453
0
    zval_ptr_dtor(&tmp_offset);
1454
0
  } else {
1455
0
      zend_bad_array_access(ce);
1456
0
    return 0;
1457
0
  }
1458
1459
0
  return result;
1460
0
}
1461
/* }}} */
1462
1463
ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *name, int type, void **cache_slot) /* {{{ */
1464
108
{
1465
108
  zval *retval = NULL;
1466
108
  uintptr_t property_offset;
1467
108
  const zend_property_info *prop_info = NULL;
1468
1469
108
  ZEND_ASSERT(type != BP_VAR_R && type != BP_VAR_IS);
1470
1471
#if DEBUG_OBJECT_HANDLERS
1472
  fprintf(stderr, "Ptr object #%d property: %s\n", zobj->handle, ZSTR_VAL(name));
1473
#endif
1474
1475
108
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__get != NULL), cache_slot, &prop_info);
1476
1477
108
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1478
16
try_again:
1479
16
    retval = OBJ_PROP(zobj, property_offset);
1480
16
    if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1481
3
      if (EXPECTED(!zobj->ce->__get) ||
1482
0
          UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
1483
3
          UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
1484
3
        if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1485
0
          bool guarded = zobj->ce->__get
1486
0
            && (*zend_get_property_guard(zobj, name) & IN_GET);
1487
0
          zend_object *instance = zend_lazy_object_init(zobj);
1488
0
          if (!instance) {
1489
0
            return &EG(error_zval);
1490
0
          }
1491
1492
0
          if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1493
0
            uint32_t *guard = zend_get_property_guard(instance, name);
1494
0
            if (!(*guard & IN_GET)) {
1495
0
              (*guard) |= IN_GET;
1496
0
              retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1497
0
              (*guard) &= ~IN_GET;
1498
0
              return retval;
1499
0
            }
1500
0
          }
1501
1502
0
          return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1503
0
        }
1504
3
        if (UNEXPECTED(type == BP_VAR_RW)) {
1505
0
          if (prop_info) {
1506
0
            zend_typed_property_uninitialized_access(prop_info, name);
1507
0
            retval = &EG(error_zval);
1508
0
          } else {
1509
0
            zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1510
            /* An error handler may set the property */
1511
0
             if (EXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1512
0
              ZVAL_NULL(retval);
1513
0
             }
1514
0
          }
1515
3
        } else if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1516
0
          if ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info)) {
1517
0
            retval = NULL;
1518
0
          }
1519
3
        } else if (!prop_info || !ZEND_TYPE_IS_SET(prop_info->type)) {
1520
0
          ZVAL_NULL(retval);
1521
0
        }
1522
3
      } else {
1523
        /* we do have getter - fail and let it try again with usual get/set */
1524
0
        retval = NULL;
1525
0
      }
1526
13
    } else if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1527
1
      if ((prop_info->flags & ZEND_ACC_READONLY) || !zend_asymmetric_property_has_set_access(prop_info)) {
1528
1
        retval = NULL;
1529
1
      }
1530
1
    }
1531
94
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
1532
88
    if (EXPECTED(zobj->properties)) {
1533
80
      if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1534
35
        if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1535
35
          GC_DELREF(zobj->properties);
1536
35
        }
1537
35
        zobj->properties = zend_array_dup(zobj->properties);
1538
35
      }
1539
80
        if (EXPECTED((retval = zend_hash_find(zobj->properties, name)) != NULL)) {
1540
68
        return retval;
1541
68
        }
1542
80
    }
1543
20
    if (EXPECTED(!zobj->ce->__get) ||
1544
16
        UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
1545
16
      if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1546
0
        bool guarded = (zobj->ce->__get != NULL);
1547
0
        zend_object *instance = zend_lazy_object_init(zobj);
1548
0
        if (!instance) {
1549
0
          return &EG(error_zval);
1550
0
        }
1551
1552
0
        if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1553
0
          uint32_t *guard = zend_get_property_guard(instance, name);
1554
0
          if (!(*guard & IN_GET)) {
1555
0
            (*guard) |= IN_GET;
1556
0
            retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1557
0
            (*guard) &= ~IN_GET;
1558
0
            return retval;
1559
0
          }
1560
0
        }
1561
1562
0
        return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1563
0
      }
1564
16
      if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
1565
0
        zend_forbidden_dynamic_property(zobj->ce, name);
1566
0
        return &EG(error_zval);
1567
0
      }
1568
16
      if (UNEXPECTED(!(zobj->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES))) {
1569
3
        if (UNEXPECTED(!zend_deprecated_dynamic_property(zobj, name))) {
1570
0
          return &EG(error_zval);
1571
0
        }
1572
3
      }
1573
16
      if (UNEXPECTED(!zobj->properties)) {
1574
4
        rebuild_object_properties_internal(zobj);
1575
4
      }
1576
16
      if (UNEXPECTED(type == BP_VAR_RW)) {
1577
1
        zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1578
1
      }
1579
16
      retval = zend_hash_add(zobj->properties, name, &EG(uninitialized_zval));
1580
16
    }
1581
20
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1582
4
    if (!(prop_info->flags & ZEND_ACC_VIRTUAL) && !zend_should_call_hook(prop_info, zobj)) {
1583
2
      property_offset = prop_info->offset;
1584
2
      if (!ZEND_TYPE_IS_SET(prop_info->type)) {
1585
2
        prop_info = NULL;
1586
2
      }
1587
2
      goto try_again;
1588
2
    }
1589
4
  } else if (zobj->ce->__get == NULL) {
1590
0
    retval = &EG(error_zval);
1591
0
  }
1592
1593
40
  return retval;
1594
108
}
1595
/* }}} */
1596
1597
ZEND_API void zend_std_unset_property(zend_object *zobj, zend_string *name, void **cache_slot) /* {{{ */
1598
19
{
1599
19
  uintptr_t property_offset;
1600
19
  const zend_property_info *prop_info = NULL;
1601
19
  uint32_t *guard = NULL;
1602
1603
19
  property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__unset != NULL), cache_slot, &prop_info);
1604
1605
19
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1606
19
    zval *slot = OBJ_PROP(zobj, property_offset);
1607
1608
19
    if (prop_info && UNEXPECTED(prop_info->flags & (ZEND_ACC_READONLY|ZEND_ACC_PPP_SET_MASK))) {
1609
0
      bool error;
1610
0
      if (Z_TYPE_P(slot) != IS_UNDEF || Z_PROP_FLAG_P(slot) & IS_PROP_UNINIT || !zobj->ce->__unset) {
1611
0
        error = true;
1612
0
      } else {
1613
0
        guard = zend_get_property_guard(zobj, name);
1614
0
        error = (*guard) & IN_UNSET;
1615
0
      }
1616
0
      if (error) {
1617
0
        if ((prop_info->flags & ZEND_ACC_READONLY)
1618
0
         && Z_TYPE_P(slot) != IS_UNDEF
1619
0
         && !(Z_PROP_FLAG_P(slot) & IS_PROP_REINITABLE)) {
1620
0
          zend_readonly_property_unset_error(prop_info->ce, name);
1621
0
          return;
1622
0
        }
1623
0
        if ((prop_info->flags & ZEND_ACC_PPP_SET_MASK) && !zend_asymmetric_property_has_set_access(prop_info)) {
1624
0
          zend_asymmetric_visibility_property_modification_error(prop_info, "unset");
1625
0
          return;
1626
0
        }
1627
0
      }
1628
0
    }
1629
1630
19
    if (Z_TYPE_P(slot) != IS_UNDEF) {
1631
17
      if (UNEXPECTED(Z_ISREF_P(slot)) &&
1632
5
          (ZEND_DEBUG || ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(slot)))) {
1633
5
        if (prop_info) {
1634
0
          ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(slot), prop_info);
1635
0
        }
1636
5
      }
1637
17
      zval tmp;
1638
17
      ZVAL_COPY_VALUE(&tmp, slot);
1639
17
      ZVAL_UNDEF(slot);
1640
17
      zval_ptr_dtor(&tmp);
1641
17
      if (zobj->properties) {
1642
17
        HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
1643
17
      }
1644
17
      return;
1645
17
    }
1646
2
    if (UNEXPECTED(Z_PROP_FLAG_P(slot) & IS_PROP_UNINIT)) {
1647
2
      if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(slot) & IS_PROP_LAZY))) {
1648
0
        zobj = zend_lazy_object_init(zobj);
1649
0
        if (!zobj) {
1650
0
          return;
1651
0
        }
1652
0
        zend_std_unset_property(zobj, name, cache_slot);
1653
0
        return;
1654
0
      }
1655
1656
      /* Reset the IS_PROP_UNINIT flag, if it exists and bypass __unset(). */
1657
2
      Z_PROP_FLAG_P(slot) = 0;
1658
2
      return;
1659
2
    }
1660
2
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))
1661
0
   && EXPECTED(zobj->properties != NULL)) {
1662
0
    if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1663
0
      if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1664
0
        GC_DELREF(zobj->properties);
1665
0
      }
1666
0
      zobj->properties = zend_array_dup(zobj->properties);
1667
0
    }
1668
0
    if (EXPECTED(zend_hash_del(zobj->properties, name) != FAILURE)) {
1669
0
      return;
1670
0
    }
1671
0
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
1672
0
    zend_throw_error(NULL, "Cannot unset hooked property %s::$%s",
1673
0
      ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
1674
0
    return;
1675
0
  } else if (UNEXPECTED(EG(exception))) {
1676
0
    return;
1677
0
  }
1678
1679
  /* For initialized lazy proxies: if the real instance's __unset guard
1680
   * is already set, we are inside a recursive call from the real
1681
   * instance's __unset. Forward directly to avoid double invocation. */
1682
0
  {
1683
0
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_UNSET);
1684
0
    if (instance) {
1685
0
      zend_std_unset_property(instance, name, cache_slot);
1686
0
      return;
1687
0
    }
1688
0
  }
1689
1690
  /* magic unset */
1691
0
  if (zobj->ce->__unset) {
1692
0
    if (!guard) {
1693
0
      guard = zend_get_property_guard(zobj, name);
1694
0
    }
1695
0
    if (!((*guard) & IN_UNSET)) {
1696
      /* have unsetter - try with it! */
1697
0
      GC_ADDREF(zobj);
1698
0
      (*guard) |= IN_UNSET; /* prevent circular unsetting */
1699
0
      zend_std_call_unsetter(zobj, name);
1700
0
      (*guard) &= ~IN_UNSET;
1701
0
      OBJ_RELEASE(zobj);
1702
0
      return;
1703
0
    } else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
1704
      /* Trigger the correct error */
1705
0
      zend_wrong_offset(zobj->ce, name);
1706
0
      ZEND_ASSERT(EG(exception));
1707
0
      return;
1708
0
    } else {
1709
      /* Nothing to do: The property already does not exist. */
1710
0
    }
1711
0
  }
1712
1713
0
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1714
0
    zobj = zend_lazy_object_init(zobj);
1715
0
    if (!zobj) {
1716
0
      return;
1717
0
    }
1718
1719
0
    if (UNEXPECTED(guard && zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1720
0
      guard = zend_get_property_guard(zobj, name);
1721
0
      if (!((*guard) & IN_UNSET)) {
1722
0
        (*guard) |= IN_UNSET;
1723
0
        zend_std_unset_property(zobj, name, cache_slot);
1724
0
        (*guard) &= ~IN_UNSET;
1725
0
        return;
1726
0
      }
1727
0
    }
1728
1729
0
    zend_std_unset_property(zobj, name, cache_slot);
1730
0
    return;
1731
0
  }
1732
0
}
1733
/* }}} */
1734
1735
ZEND_API void zend_std_unset_dimension(zend_object *object, zval *offset) /* {{{ */
1736
0
{
1737
0
  const zend_class_entry *ce = object->ce;
1738
0
  zval tmp_offset;
1739
1740
0
  zend_class_arrayaccess_funcs *funcs = ce->arrayaccess_funcs_ptr;
1741
0
  if (EXPECTED(funcs)) {
1742
0
    ZVAL_COPY_DEREF(&tmp_offset, offset);
1743
0
    GC_ADDREF(object);
1744
0
    zend_call_known_instance_method_with_1_params(funcs->zf_offsetunset, object, NULL, &tmp_offset);
1745
0
    OBJ_RELEASE(object);
1746
0
    zval_ptr_dtor(&tmp_offset);
1747
0
  } else {
1748
0
      zend_bad_array_access(ce);
1749
0
  }
1750
0
}
1751
/* }}} */
1752
1753
static zend_never_inline zend_function *zend_get_parent_private_method(const zend_class_entry *scope, const zend_class_entry *ce, zend_string *function_name) /* {{{ */
1754
0
{
1755
0
  if (scope != ce && scope && is_derived_class(ce, scope)) {
1756
0
    zend_function *fbc = zend_hash_find_ptr(&scope->function_table, function_name);
1757
0
    if (fbc != NULL) {
1758
0
      if ((fbc->common.fn_flags & ZEND_ACC_PRIVATE)
1759
0
       && fbc->common.scope == scope) {
1760
0
        return fbc;
1761
0
      }
1762
0
    }
1763
0
  }
1764
0
  return NULL;
1765
0
}
1766
/* }}} */
1767
1768
/* Ensures that we're allowed to call a protected method.
1769
 */
1770
ZEND_API bool zend_check_protected(const zend_class_entry *ce, const zend_class_entry *scope) /* {{{ */
1771
2
{
1772
2
  const zend_class_entry *fbc_scope = ce;
1773
1774
  /* Is the context that's calling the function, the same as one of
1775
   * the function's parents?
1776
   */
1777
4
  while (fbc_scope) {
1778
2
    if (fbc_scope==scope) {
1779
0
      return 1;
1780
0
    }
1781
2
    fbc_scope = fbc_scope->parent;
1782
2
  }
1783
1784
  /* Is the function's scope the same as our current object context,
1785
   * or any of the parents of our context?
1786
   */
1787
4
  while (scope) {
1788
2
    if (scope==ce) {
1789
0
      return 1;
1790
0
    }
1791
2
    scope = scope->parent;
1792
2
  }
1793
2
  return 0;
1794
2
}
1795
/* }}} */
1796
1797
ZEND_API ZEND_ATTRIBUTE_NONNULL zend_function *zend_get_call_trampoline_func(
1798
  const zend_function *fbc, zend_string *method_name) /* {{{ */
1799
13
{
1800
13
  size_t mname_len;
1801
13
  zend_op_array *func;
1802
  /* We use non-NULL value to avoid useless run_time_cache allocation.
1803
   * The low bit must be zero, to not be interpreted as a MAP_PTR offset.
1804
   */
1805
13
  static const void *dummy = (void*)(intptr_t)2;
1806
1807
13
  if (EXPECTED(EG(trampoline).common.function_name == NULL)) {
1808
13
    func = &EG(trampoline).op_array;
1809
13
  } else {
1810
0
    func = ecalloc(1, sizeof(zend_op_array));
1811
0
  }
1812
1813
13
  func->type = ZEND_USER_FUNCTION;
1814
13
  func->arg_flags[0] = 0;
1815
13
  func->arg_flags[1] = 0;
1816
13
  func->arg_flags[2] = 0;
1817
13
  func->fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE
1818
13
    | ZEND_ACC_PUBLIC
1819
13
    | ZEND_ACC_VARIADIC
1820
13
    | (fbc->common.fn_flags & (ZEND_ACC_RETURN_REFERENCE|ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED|ZEND_ACC_NODISCARD|ZEND_ACC_STATIC));
1821
13
  func->fn_flags2 = 0;
1822
  /* Attributes outlive the trampoline because they are created by the compiler. */
1823
13
  func->attributes = fbc->common.attributes;
1824
13
  func->opcodes = &EG(call_trampoline_op);
1825
13
  ZEND_MAP_PTR_INIT(func->run_time_cache, (void**)dummy);
1826
13
  func->scope = fbc->common.scope;
1827
  /* reserve space for arguments, local and temporary variables */
1828
  /* EG(trampoline) is reused from other places, like FFI (e.g. zend_ffi_cdata_get_closure()) where
1829
   * it is used as an internal function. It may set fields that don't belong to common, thus
1830
   * modifying zend_op_array specific data, most significantly last_var. We need to reset this
1831
   * value so that it doesn't contain garbage when the engine allocates space for the next stack
1832
   * frame. This didn't cause any issues until now due to "lucky" structure layout. */
1833
13
  func->last_var = 0;
1834
13
  uint32_t min_T = 2 + ZEND_OBSERVER_ENABLED;
1835
13
  func->T = (fbc->type == ZEND_USER_FUNCTION)? MAX(fbc->op_array.last_var + fbc->op_array.T, min_T) : min_T;
1836
13
  func->filename = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.filename : ZSTR_EMPTY_ALLOC();
1837
13
  func->line_start = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_start : 0;
1838
13
  func->line_end = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_end : 0;
1839
1840
  //??? keep compatibility for "\0" characters
1841
  //??? see: Zend/tests/bug46238.phpt
1842
13
  if (UNEXPECTED((mname_len = strlen(ZSTR_VAL(method_name))) != ZSTR_LEN(method_name))) {
1843
0
    func->function_name = zend_string_init(ZSTR_VAL(method_name), mname_len, 0);
1844
13
  } else {
1845
13
    func->function_name = zend_string_copy(method_name);
1846
13
  }
1847
1848
13
  func->prototype = NULL;
1849
13
  func->prop_info = NULL;
1850
13
  func->num_args = 0;
1851
13
  func->required_num_args = 0;
1852
13
  func->arg_info = zend_call_trampoline_arginfo;
1853
1854
13
  return (zend_function*)func;
1855
13
}
1856
/* }}} */
1857
1858
ZEND_API void zend_free_trampoline(zend_function *func)
1859
31
{
1860
31
  ZEND_ASSERT(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE);
1861
1862
31
  if (func == &EG(trampoline)) {
1863
14
    EG(trampoline).common.attributes = NULL;
1864
14
    EG(trampoline).common.function_name = NULL;
1865
17
  } else {
1866
17
    efree(func);
1867
17
  }
1868
31
}
1869
1870
static ZEND_FUNCTION(zend_parent_hook_get_trampoline)
1871
0
{
1872
0
  zend_object *obj = Z_PTR_P(ZEND_THIS);
1873
0
  zend_string *prop_name = EX(func)->internal_function.reserved[0];
1874
1875
0
  if (UNEXPECTED(ZEND_NUM_ARGS() != 0)) {
1876
0
    zend_wrong_parameters_none_error();
1877
0
    goto clean;
1878
0
  }
1879
1880
0
  zval rv;
1881
0
  const zval *retval = obj->handlers->read_property(obj, prop_name, BP_VAR_R, NULL, &rv);
1882
0
  if (retval == &rv) {
1883
0
    RETVAL_COPY_VALUE(retval);
1884
0
  } else {
1885
0
    RETVAL_COPY(retval);
1886
0
  }
1887
1888
0
clean:
1889
0
  zend_string_release(EX(func)->common.function_name);
1890
0
  zend_free_trampoline(EX(func));
1891
0
  EX(func) = NULL;
1892
0
}
1893
1894
static ZEND_FUNCTION(zend_parent_hook_set_trampoline)
1895
1
{
1896
1
  zend_object *obj = Z_PTR_P(ZEND_THIS);
1897
1
  zend_string *prop_name = EX(func)->internal_function.reserved[0];
1898
1899
1
  zval *value;
1900
1901
3
  ZEND_PARSE_PARAMETERS_START(1, 1)
1902
4
    Z_PARAM_ZVAL(value)
1903
4
  ZEND_PARSE_PARAMETERS_END_EX(goto clean);
1904
1905
1
  RETVAL_COPY(obj->handlers->write_property(obj, prop_name, value, NULL));
1906
1907
1
clean:
1908
1
  zend_string_release(EX(func)->common.function_name);
1909
1
  zend_free_trampoline(EX(func));
1910
1
  EX(func) = NULL;
1911
1
}
1912
1913
ZEND_API zend_function *zend_get_property_hook_trampoline(
1914
  const zend_property_info *prop_info,
1915
  zend_property_hook_kind kind, zend_string *prop_name)
1916
1
{
1917
1
  zend_function *func;
1918
1
  if (EXPECTED(EG(trampoline).common.function_name == NULL)) {
1919
1
    func = &EG(trampoline);
1920
1
  } else {
1921
0
    func = (zend_function *)(uintptr_t)ecalloc(1, sizeof(zend_internal_function));
1922
0
  }
1923
1
  func->type = ZEND_INTERNAL_FUNCTION;
1924
  /* This trampoline does not use the call_trampoline_op, so it won't reuse the call frame,
1925
   * which means we don't even need to reserve a temporary for observers. */
1926
1
  func->common.T = 0;
1927
1
  func->common.arg_flags[0] = 0;
1928
1
  func->common.arg_flags[1] = 0;
1929
1
  func->common.arg_flags[2] = 0;
1930
1
  func->common.fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE;
1931
1
  func->common.fn_flags2 = 0;
1932
1
  func->common.function_name = zend_string_concat3(
1933
1
    "$", 1, ZSTR_VAL(prop_name), ZSTR_LEN(prop_name),
1934
1
    kind == ZEND_PROPERTY_HOOK_GET ? "::get" : "::set", 5);
1935
  /* set to 0 to avoid arg_info[] allocation, because all values are passed by value anyway */
1936
1
  uint32_t args = kind == ZEND_PROPERTY_HOOK_GET ? 0 : 1;
1937
1
  func->common.num_args = args;
1938
1
  func->common.required_num_args = args;
1939
1
  func->common.scope = prop_info->ce;
1940
1
  func->common.prototype = NULL;
1941
1
  func->common.prop_info = prop_info;
1942
1
  func->common.arg_info = zend_property_hook_arginfo;
1943
1
  func->internal_function.handler = kind == ZEND_PROPERTY_HOOK_GET
1944
1
    ? ZEND_FN(zend_parent_hook_get_trampoline)
1945
1
    : ZEND_FN(zend_parent_hook_set_trampoline);
1946
1
  func->internal_function.module = NULL;
1947
1948
1
  func->internal_function.reserved[0] = prop_name;
1949
1
  func->internal_function.reserved[1] = NULL;
1950
1951
1
  return func;
1952
1
}
1953
1954
ZEND_API ZEND_COLD zend_never_inline void zend_bad_method_call(const zend_function *fbc, const zend_string *method_name, const zend_class_entry *scope) /* {{{ */
1955
0
{
1956
0
  zend_throw_error(NULL, "Call to %s method %s::%s() from %s%s",
1957
0
    zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(method_name),
1958
0
    scope ? "scope " : "global scope",
1959
0
    scope ? ZSTR_VAL(scope->name) : ""
1960
0
  );
1961
0
}
1962
/* }}} */
1963
1964
ZEND_API ZEND_COLD zend_never_inline void zend_abstract_method_call(const zend_function *fbc) /* {{{ */
1965
1
{
1966
1
  zend_throw_error(NULL, "Cannot call abstract method %s::%s()",
1967
1
    ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
1968
1
}
1969
/* }}} */
1970
1971
ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *method_name, const zval *key) /* {{{ */
1972
241
{
1973
241
  zend_object *zobj = *obj_ptr;
1974
241
  zend_function *fbc;
1975
241
  zend_string *lc_method_name;
1976
241
  ALLOCA_FLAG(use_heap);
1977
1978
241
  if (EXPECTED(key != NULL)) {
1979
222
    lc_method_name = Z_STR_P(key);
1980
#ifdef ZEND_ALLOCA_MAX_SIZE
1981
    use_heap = 0;
1982
#endif
1983
222
  } else {
1984
19
    ZSTR_ALLOCA_ALLOC(lc_method_name, ZSTR_LEN(method_name), use_heap);
1985
19
    zend_str_tolower_copy(ZSTR_VAL(lc_method_name), ZSTR_VAL(method_name), ZSTR_LEN(method_name));
1986
19
  }
1987
1988
241
  fbc = zend_hash_find_ptr(&zobj->ce->function_table, lc_method_name);
1989
241
  if (UNEXPECTED(fbc == NULL)) {
1990
27
    if (UNEXPECTED(!key)) {
1991
15
      ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
1992
15
    }
1993
27
    if (zobj->ce->__call) {
1994
12
      return zend_get_call_trampoline_func(zobj->ce->__call, method_name);
1995
15
    } else {
1996
15
      return NULL;
1997
15
    }
1998
27
  }
1999
2000
  /* Check access level */
2001
214
  if (fbc->op_array.fn_flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
2002
0
    const zend_class_entry *scope = zend_get_executed_scope();
2003
2004
0
    if (fbc->common.scope != scope) {
2005
0
      if (fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
2006
0
        zend_function *updated_fbc = zend_get_parent_private_method(scope, zobj->ce, lc_method_name);
2007
2008
0
        if (EXPECTED(updated_fbc != NULL)) {
2009
0
          fbc = updated_fbc;
2010
0
          goto exit;
2011
0
        } else if (fbc->op_array.fn_flags & ZEND_ACC_PUBLIC) {
2012
0
          goto exit;
2013
0
        }
2014
0
      }
2015
0
      if (UNEXPECTED(fbc->op_array.fn_flags & ZEND_ACC_PRIVATE)
2016
0
       || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
2017
0
        if (zobj->ce->__call) {
2018
0
          fbc = zend_get_call_trampoline_func(zobj->ce->__call, method_name);
2019
0
        } else {
2020
0
          zend_bad_method_call(fbc, method_name, scope);
2021
0
          fbc = NULL;
2022
0
        }
2023
0
      }
2024
0
    }
2025
0
  }
2026
2027
214
exit:
2028
214
  if (fbc && UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
2029
0
    zend_abstract_method_call(fbc);
2030
0
    fbc = NULL;
2031
0
  }
2032
214
  if (UNEXPECTED(!key)) {
2033
4
    ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
2034
4
  }
2035
214
  return fbc;
2036
214
}
2037
/* }}} */
2038
2039
static zend_always_inline zend_function *get_static_method_fallback(
2040
    const zend_class_entry *ce, zend_string *function_name)
2041
11
{
2042
11
  zend_object *object;
2043
11
  if (ce->__call &&
2044
0
    (object = zend_get_this_object(EG(current_execute_data))) != NULL &&
2045
0
    instanceof_function(object->ce, ce)) {
2046
    /* Call the top-level defined __call().
2047
     * see: tests/classes/__call_004.phpt  */
2048
2049
0
    ZEND_ASSERT(object->ce->__call);
2050
0
    return zend_get_call_trampoline_func(object->ce->__call, function_name);
2051
11
  } else if (ce->__callstatic) {
2052
1
    return zend_get_call_trampoline_func(ce->__callstatic, function_name);
2053
10
  } else {
2054
10
    return NULL;
2055
10
  }
2056
11
}
2057
2058
ZEND_API zend_function *zend_std_get_static_method(const zend_class_entry *ce, zend_string *function_name, const zval *key) /* {{{ */
2059
72
{
2060
72
  zend_function *fbc;
2061
72
  if (EXPECTED(key != NULL)) {
2062
66
    fbc = zend_hash_find_ptr(&ce->function_table, Z_STR_P(key));
2063
66
  } else {
2064
6
    fbc = zend_hash_find_ptr_lc(&ce->function_table, function_name);
2065
6
  }
2066
2067
72
  if (EXPECTED(fbc)) {
2068
61
    if (!(fbc->common.fn_flags & ZEND_ACC_PUBLIC)) {
2069
0
      const zend_class_entry *scope = zend_get_executed_scope();
2070
0
      ZEND_ASSERT(!(fbc->common.fn_flags & ZEND_ACC_PUBLIC));
2071
0
      if (!zend_check_method_accessible(fbc, scope)) {
2072
0
        zend_function *fallback_fbc = get_static_method_fallback(ce, function_name);
2073
0
        if (!fallback_fbc) {
2074
0
          zend_bad_method_call(fbc, function_name, scope);
2075
0
        }
2076
0
        fbc = fallback_fbc;
2077
0
      }
2078
0
    }
2079
61
  } else {
2080
11
    fbc = get_static_method_fallback(ce, function_name);
2081
11
  }
2082
2083
72
  if (EXPECTED(fbc)) {
2084
62
    if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
2085
0
      zend_abstract_method_call(fbc);
2086
0
      goto fail;
2087
62
    } else if (UNEXPECTED(fbc->common.scope->ce_flags & ZEND_ACC_TRAIT)) {
2088
0
      zend_error(E_DEPRECATED,
2089
0
        "Calling static trait method %s::%s is deprecated, "
2090
0
        "it should only be called on a class using the trait",
2091
0
        ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2092
0
      if (EG(exception)) {
2093
0
        goto fail;
2094
0
      }
2095
0
    }
2096
62
  }
2097
2098
72
  return fbc;
2099
2100
0
 fail:
2101
0
  if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
2102
0
    zend_string_release_ex(fbc->common.function_name, 0);
2103
0
    zend_free_trampoline(fbc);
2104
0
  }
2105
2106
0
  return NULL;
2107
72
}
2108
/* }}} */
2109
2110
ZEND_API void zend_class_init_statics(zend_class_entry *class_type) /* {{{ */
2111
38
{
2112
38
  zval *p;
2113
2114
38
  if (class_type->default_static_members_count && !CE_STATIC_MEMBERS(class_type)) {
2115
38
    if (class_type->parent) {
2116
0
      zend_class_init_statics(class_type->parent);
2117
0
    }
2118
2119
38
    ZEND_MAP_PTR_SET(class_type->static_members_table, emalloc(sizeof(zval) * class_type->default_static_members_count));
2120
78
    for (uint32_t i = 0; i < class_type->default_static_members_count; i++) {
2121
40
      p = &class_type->default_static_members_table[i];
2122
40
      if (Z_TYPE_P(p) == IS_INDIRECT) {
2123
0
        zval *q = &CE_STATIC_MEMBERS(class_type->parent)[i];
2124
0
        ZVAL_DEINDIRECT(q);
2125
0
        ZVAL_INDIRECT(&CE_STATIC_MEMBERS(class_type)[i], q);
2126
40
      } else {
2127
40
        ZVAL_COPY_OR_DUP(&CE_STATIC_MEMBERS(class_type)[i], p);
2128
40
      }
2129
40
    }
2130
38
  }
2131
38
} /* }}} */
2132
2133
ZEND_API zval *zend_std_get_static_property_with_info(zend_class_entry *ce, zend_string *property_name, int type, zend_property_info **property_info_ptr) /* {{{ */
2134
63
{
2135
63
  zval *ret;
2136
63
  zend_property_info *property_info = zend_hash_find_ptr(&ce->properties_info, property_name);
2137
63
  *property_info_ptr = property_info;
2138
2139
63
  if (UNEXPECTED(property_info == NULL)) {
2140
6
    goto undeclared_property;
2141
6
  }
2142
2143
57
  if (!(property_info->flags & ZEND_ACC_PUBLIC)) {
2144
0
    const zend_class_entry *scope = get_fake_or_executed_scope();
2145
0
    if (property_info->ce != scope) {
2146
0
      if (UNEXPECTED(property_info->flags & ZEND_ACC_PRIVATE)
2147
0
       || UNEXPECTED(!is_protected_compatible_scope(property_info->prototype->ce, scope))) {
2148
0
        if (type != BP_VAR_IS) {
2149
0
          zend_bad_property_access(property_info, ce, property_name);
2150
0
        }
2151
0
        return NULL;
2152
0
      }
2153
0
    }
2154
0
  }
2155
2156
57
  if (UNEXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0)) {
2157
6
undeclared_property:
2158
6
    if (type != BP_VAR_IS) {
2159
6
      zend_throw_error(NULL, "Access to undeclared static property %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
2160
6
    }
2161
6
    return NULL;
2162
0
  }
2163
2164
57
  if (UNEXPECTED(!(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
2165
0
    if (UNEXPECTED(zend_update_class_constants(ce) != SUCCESS)) {
2166
0
      return NULL;
2167
0
    }
2168
0
  }
2169
2170
  /* Ensure static properties are initialized. */
2171
57
  if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
2172
38
    zend_class_init_statics(ce);
2173
38
  }
2174
2175
57
  ret = CE_STATIC_MEMBERS(ce) + property_info->offset;
2176
57
  ZVAL_DEINDIRECT(ret);
2177
2178
57
  if (UNEXPECTED((type == BP_VAR_R || type == BP_VAR_RW)
2179
57
        && Z_TYPE_P(ret) == IS_UNDEF && ZEND_TYPE_IS_SET(property_info->type))) {
2180
3
    zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
2181
3
      ZSTR_VAL(property_info->ce->name), ZSTR_VAL(property_name));
2182
3
    return NULL;
2183
3
  }
2184
2185
54
  if (UNEXPECTED(ce->ce_flags & ZEND_ACC_TRAIT)) {
2186
0
    zend_error(E_DEPRECATED,
2187
0
      "Accessing static trait property %s::$%s is deprecated, "
2188
0
      "it should only be accessed on a class using the trait",
2189
0
      ZSTR_VAL(property_info->ce->name), ZSTR_VAL(property_name));
2190
0
  }
2191
2192
54
  return ret;
2193
57
}
2194
/* }}} */
2195
2196
ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, int type) /* {{{ */
2197
0
{
2198
0
  zend_property_info *prop_info;
2199
0
  return zend_std_get_static_property_with_info(ce, property_name, type, &prop_info);
2200
0
}
2201
2202
ZEND_API ZEND_COLD void zend_std_unset_static_property(const zend_class_entry *ce, const zend_string *property_name) /* {{{ */
2203
0
{
2204
0
  zend_throw_error(NULL, "Attempt to unset static property %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
2205
0
}
2206
/* }}} */
2207
2208
static ZEND_COLD zend_never_inline void zend_bad_constructor_call(const zend_function *constructor, const zend_class_entry *scope) /* {{{ */
2209
0
{
2210
0
  if (scope) {
2211
0
    zend_throw_error(NULL, "Call to %s %s::__construct() from scope %s",
2212
0
      zend_visibility_string(constructor->common.fn_flags),
2213
0
      ZSTR_VAL(constructor->common.scope->name),
2214
0
      ZSTR_VAL(scope->name)
2215
0
    );
2216
0
  } else {
2217
0
    zend_throw_error(NULL, "Call to %s %s::__construct() from global scope",
2218
0
      zend_visibility_string(constructor->common.fn_flags),
2219
0
      ZSTR_VAL(constructor->common.scope->name)
2220
0
    );
2221
0
  }
2222
0
}
2223
/* }}} */
2224
2225
ZEND_API zend_function *zend_std_get_constructor(zend_object *zobj) /* {{{ */
2226
6.75k
{
2227
6.75k
  zend_function *constructor = zobj->ce->constructor;
2228
2229
6.75k
  if (constructor) {
2230
5.46k
    if (UNEXPECTED(!(constructor->common.fn_flags & ZEND_ACC_PUBLIC))) {
2231
0
      const zend_class_entry *scope = get_fake_or_executed_scope();
2232
0
      ZEND_ASSERT(!(constructor->common.fn_flags & ZEND_ACC_PUBLIC));
2233
0
      if (!zend_check_method_accessible(constructor, scope)) {
2234
0
        zend_bad_constructor_call(constructor, scope);
2235
0
        zend_object_store_ctor_failed(zobj);
2236
0
        constructor = NULL;
2237
0
      }
2238
0
    }
2239
5.46k
  }
2240
2241
6.75k
  return constructor;
2242
6.75k
}
2243
/* }}} */
2244
2245
ZEND_API int zend_std_compare_objects(zval *o1, zval *o2) /* {{{ */
2246
20
{
2247
20
  zend_object *zobj1, *zobj2;
2248
2249
20
  if (zend_objects_check_stack_limit()) {
2250
0
    zend_throw_error(NULL, "Maximum call stack size reached during object comparison");
2251
0
    return ZEND_UNCOMPARABLE;
2252
0
  }
2253
2254
20
  if (Z_TYPE_P(o1) != Z_TYPE_P(o2)) {
2255
    /* Object and non-object */
2256
19
    zval *object;
2257
19
    zval *value;
2258
19
    zval casted;
2259
19
    bool object_lhs;
2260
19
    if (Z_TYPE_P(o1) == IS_OBJECT) {
2261
14
      object = o1;
2262
14
      value = o2;
2263
14
      object_lhs = true;
2264
14
    } else {
2265
5
      object = o2;
2266
5
      value = o1;
2267
5
      object_lhs = false;
2268
5
    }
2269
19
    ZEND_ASSERT(Z_TYPE_P(value) != IS_OBJECT);
2270
19
    uint8_t target_type = Z_TYPE_P(value);
2271
    /* Should be handled in zend_compare(). */
2272
19
    ZEND_ASSERT(target_type != IS_FALSE && target_type != IS_TRUE);
2273
19
    if (Z_OBJ_HT_P(object)->cast_object(Z_OBJ_P(object), &casted, target_type) == FAILURE) {
2274
      // TODO: Less crazy.
2275
19
      if (target_type == IS_LONG || target_type == IS_DOUBLE) {
2276
4
        zend_error(E_NOTICE, "Object of class %s could not be converted to %s",
2277
4
               ZSTR_VAL(Z_OBJCE_P(object)->name), zend_get_type_by_const(target_type));
2278
4
        if (target_type == IS_LONG) {
2279
2
          ZVAL_LONG(&casted, 1);
2280
2
        } else {
2281
2
          ZVAL_DOUBLE(&casted, 1.0);
2282
2
        }
2283
15
      } else {
2284
15
        return object_lhs ? 1 : -1;
2285
15
      }
2286
19
    }
2287
4
    int ret = object_lhs ? zend_compare(&casted, value) : zend_compare(value, &casted);
2288
4
    zval_ptr_dtor(&casted);
2289
4
    return ret;
2290
19
  }
2291
2292
1
  zobj1 = Z_OBJ_P(o1);
2293
1
  zobj2 = Z_OBJ_P(o2);
2294
2295
1
  if (zobj1 == zobj2) {
2296
0
    return 0; /* the same object */
2297
0
  }
2298
1
  if (zobj1->ce != zobj2->ce) {
2299
0
    return ZEND_UNCOMPARABLE; /* different classes */
2300
0
  }
2301
1
  if (!zobj1->properties && !zobj2->properties
2302
1
      && !zend_object_is_lazy(zobj1) && !zend_object_is_lazy(zobj2)) {
2303
1
    zend_property_info *info;
2304
1
    int i;
2305
2306
1
    if (!zobj1->ce->default_properties_count) {
2307
1
      return 0;
2308
1
    }
2309
2310
    /* It's enough to protect only one of the objects.
2311
     * The second one may be referenced from the first and this may cause
2312
     * false recursion detection.
2313
     */
2314
    /* use bitwise OR to make only one conditional jump */
2315
0
    if (UNEXPECTED(Z_IS_RECURSIVE_P(o1))) {
2316
0
      zend_throw_error(NULL, "Nesting level too deep - recursive dependency?");
2317
0
      return ZEND_UNCOMPARABLE;
2318
0
    }
2319
0
    Z_PROTECT_RECURSION_P(o1);
2320
2321
0
    GC_ADDREF(zobj1);
2322
0
    GC_ADDREF(zobj2);
2323
0
    int ret;
2324
2325
0
    for (i = 0; i < zobj1->ce->default_properties_count; i++) {
2326
0
      zval *p1, *p2;
2327
2328
0
      info = zobj1->ce->properties_info_table[i];
2329
2330
0
      if (!info) {
2331
0
        continue;
2332
0
      }
2333
2334
0
      p1 = OBJ_PROP(zobj1, info->offset);
2335
0
      p2 = OBJ_PROP(zobj2, info->offset);
2336
2337
0
      if (Z_TYPE_P(p1) != IS_UNDEF) {
2338
0
        if (Z_TYPE_P(p2) != IS_UNDEF) {
2339
0
          ret = zend_compare(p1, p2);
2340
0
          if (ret != 0) {
2341
0
            Z_UNPROTECT_RECURSION_P(o1);
2342
0
            goto done;
2343
0
          }
2344
0
        } else {
2345
0
          Z_UNPROTECT_RECURSION_P(o1);
2346
0
          ret = 1;
2347
0
          goto done;
2348
0
        }
2349
0
      } else {
2350
0
        if (Z_TYPE_P(p2) != IS_UNDEF) {
2351
0
          Z_UNPROTECT_RECURSION_P(o1);
2352
0
          ret = 1;
2353
0
          goto done;
2354
0
        }
2355
0
      }
2356
0
    }
2357
2358
0
    Z_UNPROTECT_RECURSION_P(o1);
2359
0
    ret = 0;
2360
2361
0
done:
2362
0
    OBJ_RELEASE(zobj1);
2363
0
    OBJ_RELEASE(zobj2);
2364
2365
0
    return ret;
2366
0
  } else {
2367
0
    GC_ADDREF(zobj1);
2368
0
    GC_ADDREF(zobj2);
2369
2370
0
    int ret = zend_compare_symbol_tables(
2371
0
        zend_std_get_properties_ex(zobj1),
2372
0
        zend_std_get_properties_ex(zobj2));
2373
2374
0
    OBJ_RELEASE(zobj1);
2375
0
    OBJ_RELEASE(zobj2);
2376
2377
0
    return ret;
2378
0
  }
2379
1
}
2380
/* }}} */
2381
2382
ZEND_API int zend_objects_not_comparable(zval *o1, zval *o2)
2383
3
{
2384
3
  return ZEND_UNCOMPARABLE;
2385
3
}
2386
2387
// todo: make zend_std_has_property return bool as well
2388
ZEND_API int zend_std_has_property(zend_object *zobj, zend_string *name, int has_set_exists, void **cache_slot) /* {{{ */
2389
5
{
2390
5
  bool result;
2391
5
  zval *value = NULL;
2392
5
  uintptr_t property_offset;
2393
5
  const zend_property_info *prop_info = NULL;
2394
2395
5
  property_offset = zend_get_property_offset(zobj->ce, name, 1, cache_slot, &prop_info);
2396
2397
5
  if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
2398
1
try_again:
2399
1
    value = OBJ_PROP(zobj, property_offset);
2400
1
    if (Z_TYPE_P(value) != IS_UNDEF) {
2401
1
      goto found;
2402
1
    }
2403
0
    if (UNEXPECTED(Z_PROP_FLAG_P(value) & IS_PROP_UNINIT)) {
2404
      /* Skip __isset() for uninitialized typed properties */
2405
0
      goto lazy_init;
2406
0
    }
2407
4
  } else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
2408
3
    if (EXPECTED(zobj->properties != NULL)) {
2409
0
      if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
2410
0
        uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
2411
2412
0
        if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
2413
0
          Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
2414
2415
0
          if (EXPECTED(p->key == name) ||
2416
0
                (EXPECTED(p->h == ZSTR_H(name)) &&
2417
0
                 EXPECTED(p->key != NULL) &&
2418
0
                 EXPECTED(zend_string_equal_content(p->key, name)))) {
2419
0
            value = &p->val;
2420
0
            goto found;
2421
0
          }
2422
0
        }
2423
0
        CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
2424
0
      }
2425
0
      value = zend_hash_find(zobj->properties, name);
2426
0
      if (value) {
2427
0
        if (cache_slot) {
2428
0
          uintptr_t idx = (char*)value - (char*)zobj->properties->arData;
2429
0
          CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
2430
0
        }
2431
1
found:
2432
1
        if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY) {
2433
0
          result = zend_is_true(value);
2434
1
        } else if (has_set_exists < ZEND_PROPERTY_NOT_EMPTY) {
2435
0
          ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_ISSET);
2436
0
          ZVAL_DEREF(value);
2437
0
          result = (Z_TYPE_P(value) != IS_NULL);
2438
1
        } else {
2439
1
          ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_EXISTS);
2440
1
          result = true;
2441
1
        }
2442
1
        goto exit;
2443
1
      }
2444
0
    }
2445
3
  } else if (IS_HOOKED_PROPERTY_OFFSET(property_offset)) {
2446
0
    zend_function *get = prop_info->hooks[ZEND_PROPERTY_HOOK_GET];
2447
2448
0
    if (has_set_exists == ZEND_PROPERTY_EXISTS) {
2449
0
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
2450
0
        return true;
2451
0
      }
2452
0
      property_offset = prop_info->offset;
2453
0
      goto try_again;
2454
0
    }
2455
2456
0
    if (!get) {
2457
0
      if (prop_info->flags & ZEND_ACC_VIRTUAL) {
2458
0
        zend_throw_error(NULL, "Cannot read from set-only virtual property %s::$%s",
2459
0
          ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
2460
0
        return 0;
2461
0
      } else {
2462
0
        property_offset = prop_info->offset;
2463
0
        goto try_again;
2464
0
      }
2465
0
    }
2466
2467
0
    zval rv;
2468
0
    if (!zend_call_get_hook(prop_info, name, get, zobj, &rv)) {
2469
0
      if (EG(exception)) {
2470
0
        return 0;
2471
0
      }
2472
0
      property_offset = prop_info->offset;
2473
0
      goto try_again;
2474
0
    }
2475
2476
0
    if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY) {
2477
0
      result = zend_is_true(&rv);
2478
0
    } else {
2479
0
      ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_ISSET);
2480
0
      result = Z_TYPE(rv) != IS_NULL
2481
0
        && (Z_TYPE(rv) != IS_REFERENCE || Z_TYPE_P(Z_REFVAL(rv)) != IS_NULL);
2482
0
    }
2483
0
    zval_ptr_dtor(&rv);
2484
0
    return result;
2485
1
  } else if (UNEXPECTED(EG(exception))) {
2486
0
    result = false;
2487
0
    goto exit;
2488
0
  }
2489
2490
  /* For initialized lazy proxies: if the real instance's __isset guard
2491
   * is already set, we are inside a recursive call from the real
2492
   * instance's __isset. Forward directly to avoid double invocation. */
2493
4
  {
2494
4
    zend_object *instance = zend_lazy_proxy_get_guarded_instance(zobj, name, IN_ISSET);
2495
4
    if (instance) {
2496
0
      return zend_std_has_property(instance, name, has_set_exists, cache_slot);
2497
0
    }
2498
4
  }
2499
2500
4
  if (!zobj->ce->__isset) {
2501
4
    goto lazy_init;
2502
4
  }
2503
2504
0
  result = false;
2505
0
  if (has_set_exists != ZEND_PROPERTY_EXISTS) {
2506
0
    uint32_t *guard = zend_get_property_guard(zobj, name);
2507
2508
0
    if (!((*guard) & IN_ISSET)) {
2509
0
      zval rv;
2510
2511
      /* have issetter - try with it! */
2512
0
      GC_ADDREF(zobj);
2513
0
      (*guard) |= IN_ISSET; /* prevent circular getting */
2514
0
      zend_std_call_issetter(zobj, name, &rv);
2515
0
      result = zend_is_true(&rv);
2516
0
      zval_ptr_dtor(&rv);
2517
0
      if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY && result) {
2518
        /* GH-12695, see above. */
2519
0
        zval *prop = NULL;
2520
0
        if (IS_VALID_PROPERTY_OFFSET(property_offset)) {
2521
0
          prop = OBJ_PROP(zobj, property_offset);
2522
0
          if (Z_TYPE_P(prop) == IS_UNDEF) {
2523
0
            prop = NULL;
2524
0
          }
2525
0
        } else if (IS_DYNAMIC_PROPERTY_OFFSET(property_offset)
2526
0
            && zobj->properties != NULL) {
2527
0
          prop = zend_hash_find(zobj->properties, name);
2528
0
        }
2529
0
        if (prop) {
2530
0
          result = i_zend_is_true(prop);
2531
0
        } else if (EXPECTED(!EG(exception)) && zobj->ce->__get && !((*guard) & IN_GET)) {
2532
0
          (*guard) |= IN_GET;
2533
0
          zend_std_call_getter(zobj, name, &rv);
2534
0
          (*guard) &= ~IN_GET;
2535
0
          result = i_zend_is_true(&rv);
2536
0
          zval_ptr_dtor(&rv);
2537
0
        } else {
2538
0
          result = false;
2539
0
        }
2540
0
      }
2541
0
      (*guard) &= ~IN_ISSET;
2542
0
      OBJ_RELEASE(zobj);
2543
0
    } else {
2544
0
      goto lazy_init;
2545
0
    }
2546
0
  }
2547
2548
5
exit:
2549
5
  return result;
2550
2551
4
lazy_init:
2552
4
  if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
2553
0
    if (!value || (Z_PROP_FLAG_P(value) & IS_PROP_LAZY)) {
2554
0
      zobj = zend_lazy_object_init(zobj);
2555
0
      if (!zobj) {
2556
0
        result = false;
2557
0
        goto exit;
2558
0
      }
2559
2560
0
      if (UNEXPECTED(zobj->ce->__isset)) {
2561
0
        uint32_t *guard = zend_get_property_guard(zobj, name);
2562
0
        if (!((*guard) & IN_ISSET)) {
2563
0
          (*guard) |= IN_ISSET;
2564
0
          result = zend_std_has_property(zobj, name, has_set_exists, cache_slot);
2565
0
          (*guard) &= ~IN_ISSET;
2566
0
          return result;
2567
0
        }
2568
0
      }
2569
2570
0
      return zend_std_has_property(zobj, name, has_set_exists, cache_slot);
2571
0
    }
2572
0
  }
2573
2574
4
  result = false;
2575
4
  goto exit;
2576
4
}
2577
/* }}} */
2578
2579
ZEND_API zend_string *zend_std_get_class_name(const zend_object *zobj) /* {{{ */
2580
182
{
2581
182
  return zend_string_copy(zobj->ce->name);
2582
182
}
2583
/* }}} */
2584
2585
ZEND_API zend_result zend_std_cast_object_tostring(zend_object *readobj, zval *writeobj, int type) /* {{{ */
2586
1.09k
{
2587
1.09k
  switch (type) {
2588
559
    case IS_STRING: {
2589
559
      const zend_class_entry *ce = readobj->ce;
2590
559
      if (ce->__tostring) {
2591
32
        zval retval;
2592
32
        GC_ADDREF(readobj);
2593
32
        zend_call_known_instance_method_with_0_params(ce->__tostring, readobj, &retval);
2594
32
        zend_object_release(readobj);
2595
32
        if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {
2596
28
is_string:
2597
28
          ZVAL_COPY_VALUE(writeobj, &retval);
2598
28
          return SUCCESS;
2599
28
        } else if (Z_ISREF(retval)) {
2600
0
          zend_unwrap_reference(&retval);
2601
0
          goto is_string;
2602
0
        }
2603
4
        zval_ptr_dtor(&retval);
2604
4
        if (!EG(exception)) {
2605
0
          zend_throw_error(NULL, "Method %s::__toString() must return a string value", ZSTR_VAL(ce->name));
2606
0
        }
2607
4
      }
2608
531
      return FAILURE;
2609
559
    }
2610
0
    case _IS_BOOL:
2611
0
      ZVAL_TRUE(writeobj);
2612
0
      return SUCCESS;
2613
531
    default:
2614
531
      return FAILURE;
2615
1.09k
  }
2616
1.09k
}
2617
/* }}} */
2618
2619
ZEND_API zend_result zend_std_get_closure(zend_object *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zend_object **obj_ptr, bool check_only) /* {{{ */
2620
2
{
2621
2
  zend_class_entry *ce = obj->ce;
2622
2
  zend_function *func = zend_hash_find_ex_ptr(
2623
2
    &ce->function_table, ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE), /* known_hash */ true);
2624
2625
2
  if (func == NULL) {
2626
2
    return FAILURE;
2627
2
  }
2628
0
  *fptr_ptr = func;
2629
0
  *ce_ptr = ce;
2630
0
  *obj_ptr = obj;
2631
2632
0
  return SUCCESS;
2633
2
}
2634
/* }}} */
2635
2636
148
ZEND_API HashTable *zend_std_get_properties_for(zend_object *obj, zend_prop_purpose purpose) {
2637
148
  HashTable *ht;
2638
148
  switch (purpose) {
2639
135
    case ZEND_PROP_PURPOSE_DEBUG:
2640
135
      if (obj->handlers->get_debug_info) {
2641
135
        int is_temp;
2642
135
        ht = obj->handlers->get_debug_info(obj, &is_temp);
2643
135
        if (ht && !is_temp) {
2644
101
          GC_TRY_ADDREF(ht);
2645
101
        }
2646
135
        return ht;
2647
135
      }
2648
0
      ZEND_FALLTHROUGH;
2649
1
    case ZEND_PROP_PURPOSE_JSON:
2650
5
    case ZEND_PROP_PURPOSE_GET_OBJECT_VARS:
2651
11
    case ZEND_PROP_PURPOSE_VAR_EXPORT:
2652
11
      if (obj->ce->num_hooked_props) {
2653
1
        return zend_hooked_object_build_properties(obj);
2654
1
      }
2655
10
      ht = obj->handlers->get_properties(obj);
2656
10
      if (ht) {
2657
10
        GC_TRY_ADDREF(ht);
2658
10
      }
2659
10
      return ht;
2660
1
    case ZEND_PROP_PURPOSE_ARRAY_CAST:
2661
1
      ht = zend_get_properties_no_lazy_init(obj);
2662
1
      if (ht) {
2663
1
        GC_TRY_ADDREF(ht);
2664
1
      }
2665
1
      return ht;
2666
1
    case ZEND_PROP_PURPOSE_SERIALIZE: {
2667
1
      if (zend_object_is_lazy(obj)
2668
0
          && !zend_lazy_object_initialize_on_serialize(obj)) {
2669
0
        ht = zend_get_properties_no_lazy_init(obj);
2670
1
      } else {
2671
1
        ht = obj->handlers->get_properties(obj);
2672
1
      }
2673
1
      if (ht) {
2674
1
        GC_TRY_ADDREF(ht);
2675
1
      }
2676
1
      return ht;
2677
11
    }
2678
0
    default:
2679
0
      ZEND_UNREACHABLE();
2680
0
      return NULL;
2681
148
  }
2682
148
}
2683
2684
160
ZEND_API HashTable *zend_get_properties_for(zval *obj, zend_prop_purpose purpose) {
2685
160
  zend_object *zobj = Z_OBJ_P(obj);
2686
2687
160
  if (zobj->handlers->get_properties_for) {
2688
12
    return zobj->handlers->get_properties_for(zobj, purpose);
2689
12
  }
2690
2691
148
  return zend_std_get_properties_for(zobj, purpose);
2692
160
}
2693
2694
ZEND_API const zend_object_handlers std_object_handlers = {
2695
  0,                    /* offset */
2696
2697
  zend_object_std_dtor,         /* free_obj */
2698
  zend_objects_destroy_object,      /* dtor_obj */
2699
  zend_objects_clone_obj,         /* clone_obj */
2700
  zend_objects_clone_obj_with,      /* clone_obj_with */
2701
2702
  zend_std_read_property,         /* read_property */
2703
  zend_std_write_property,        /* write_property */
2704
  zend_std_read_dimension,        /* read_dimension */
2705
  zend_std_write_dimension,       /* write_dimension */
2706
  zend_std_get_property_ptr_ptr,      /* get_property_ptr_ptr */
2707
  zend_std_has_property,          /* has_property */
2708
  zend_std_unset_property,        /* unset_property */
2709
  zend_std_has_dimension,         /* has_dimension */
2710
  zend_std_unset_dimension,       /* unset_dimension */
2711
  zend_std_get_properties,        /* get_properties */
2712
  zend_std_get_method,          /* get_method */
2713
  zend_std_get_constructor,       /* get_constructor */
2714
  zend_std_get_class_name,        /* get_class_name */
2715
  zend_std_cast_object_tostring,      /* cast_object */
2716
  NULL,                 /* count_elements */
2717
  zend_std_get_debug_info,        /* get_debug_info */
2718
  zend_std_get_closure,         /* get_closure */
2719
  zend_std_get_gc,            /* get_gc */
2720
  NULL,                 /* do_operation */
2721
  zend_std_compare_objects,       /* compare */
2722
  NULL,                 /* get_properties_for */
2723
};
2724
2725
16
void zend_object_handlers_startup(void) {
2726
16
  zend_call_trampoline_arginfo[0].name = ZSTR_KNOWN(ZEND_STR_ARGUMENTS);
2727
  zend_call_trampoline_arginfo[0].type = (zend_type)ZEND_TYPE_INIT_CODE(IS_MIXED, false, _ZEND_ARG_INFO_FLAGS(false, 1, 0));
2728
16
  zend_property_hook_arginfo[0].name = ZSTR_KNOWN(ZEND_STR_VALUE);
2729
16
}