1/*
2   +----------------------------------------------------------------------+
3   | Zend Engine                                                          |
4   +----------------------------------------------------------------------+
5   | Copyright (c) 1998-2014 Zend Technologies Ltd. (http://www.zend.com) |
6   +----------------------------------------------------------------------+
7   | This source file is subject to version 2.00 of the Zend license,     |
8   | that is bundled with this package in the file LICENSE, and is        |
9   | available through the world-wide-web at the following url:           |
10   | http://www.zend.com/license/2_00.txt.                                |
11   | If you did not receive a copy of the Zend license and are unable to  |
12   | obtain it through the world-wide-web, please send a note to          |
13   | license@zend.com so we can mail you a copy immediately.              |
14   +----------------------------------------------------------------------+
15   | Authors: Andi Gutmans <andi@zend.com>                                |
16   |          Zeev Suraski <zeev@zend.com>                                |
17   +----------------------------------------------------------------------+
18*/
19
20/* $Id$ */
21
22#define ZEND_INTENSIVE_DEBUGGING 0
23
24#include <stdio.h>
25#include <signal.h>
26
27#include "zend.h"
28#include "zend_compile.h"
29#include "zend_execute.h"
30#include "zend_API.h"
31#include "zend_ptr_stack.h"
32#include "zend_constants.h"
33#include "zend_extensions.h"
34#include "zend_ini.h"
35#include "zend_exceptions.h"
36#include "zend_interfaces.h"
37#include "zend_closures.h"
38#include "zend_generators.h"
39#include "zend_vm.h"
40#include "zend_dtrace.h"
41
42/* Virtual current working directory support */
43#include "zend_virtual_cwd.h"
44
45#define _CONST_CODE  0
46#define _TMP_CODE    1
47#define _VAR_CODE    2
48#define _UNUSED_CODE 3
49#define _CV_CODE     4
50
51typedef int (*incdec_t)(zval *);
52
53#define get_zval_ptr(op_type, node, ex, should_free, type) _get_zval_ptr(op_type, node, ex, should_free, type TSRMLS_CC)
54#define get_zval_ptr_deref(op_type, node, ex, should_free, type) _get_zval_ptr_deref(op_type, node, ex, should_free, type TSRMLS_CC)
55#define get_zval_ptr_ptr(op_type, node, ex, should_free, type) _get_zval_ptr_ptr(op_type, node, ex, should_free, type TSRMLS_CC)
56#define get_zval_ptr_ptr_undef(op_type, node, ex, should_free, type) _get_zval_ptr_ptr(op_type, node, ex, should_free, type TSRMLS_CC)
57#define get_obj_zval_ptr(op_type, node, ex, should_free, type) _get_obj_zval_ptr(op_type, node, ex, should_free, type TSRMLS_CC)
58#define get_obj_zval_ptr_ptr(op_type, node, ex, should_free, type) _get_obj_zval_ptr_ptr(op_type, node, ex, should_free, type TSRMLS_CC)
59
60/* Prototypes */
61static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
62static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
63static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
64
65#define RETURN_VALUE_USED(opline) (!((opline)->result_type & EXT_TYPE_UNUSED))
66
67#define TEMP_VAR_STACK_LIMIT 2000
68
69static zend_always_inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free)
70{
71    should_free->var = NULL;
72    if (Z_REFCOUNTED_P(z) && !Z_DELREF_P(z)) {
73        Z_SET_REFCOUNT_P(z, 1);
74        should_free->var = z;
75        /* should_free->is_var = 1; */
76    }
77}
78
79static ZEND_FUNCTION(pass)
80{
81}
82
83static const zend_internal_function zend_pass_function = {
84    ZEND_INTERNAL_FUNCTION, /* type              */
85    NULL,                   /* name              */
86    NULL,                   /* scope             */
87    0,                      /* fn_flags          */
88    NULL,                   /* prototype         */
89    0,                      /* num_args          */
90    0,                      /* required_num_args */
91    NULL,                   /* arg_info          */
92    ZEND_FN(pass),          /* handler           */
93    NULL                    /* module            */
94};
95
96#undef zval_ptr_dtor
97#define zval_ptr_dtor(zv) i_zval_ptr_dtor(zv ZEND_FILE_LINE_CC TSRMLS_CC)
98#define zval_ptr_dtor_nogc(zv) i_zval_ptr_dtor_nogc(zv ZEND_FILE_LINE_CC TSRMLS_CC)
99
100#define PZVAL_UNLOCK(z, f) zend_pzval_unlock_func(z, f)
101#define PZVAL_LOCK(z) if (Z_REFCOUNTED_P(z)) Z_ADDREF_P((z))
102#define SELECTIVE_PZVAL_LOCK(pzv, opline)   if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(pzv); }
103
104#define EXTRACT_ZVAL_PTR(zv) do {                       \
105        zval *__zv = (zv);                              \
106        if (Z_TYPE_P(__zv) == IS_INDIRECT) {            \
107            ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));        \
108        }                                               \
109    } while (0)
110
111#define FREE_OP(should_free) \
112    if (should_free.var) { \
113        if ((zend_uintptr_t)should_free.var & 1L) { \
114            zval_dtor((zval*)((zend_uintptr_t)should_free.var & ~1L)); \
115        } else { \
116            zval_ptr_dtor_nogc(should_free.var); \
117        } \
118    }
119
120#define FREE_OP_IF_VAR(should_free) \
121    if (should_free.var != NULL && (((zend_uintptr_t)should_free.var & 1L) == 0)) { \
122        zval_ptr_dtor_nogc(should_free.var); \
123    }
124
125#define FREE_OP_VAR_PTR(should_free) \
126    if (should_free.var) { \
127        zval_ptr_dtor_nogc(should_free.var); \
128    }
129
130#define TMP_FREE(z) (zval*)(((zend_uintptr_t)(z)) | 1L)
131
132#define IS_TMP_FREE(should_free) ((zend_uintptr_t)should_free.var & 1L)
133
134/* End of zend_execute_locks.h */
135
136#define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
137
138#define CTOR_CALL_BIT    0x1
139#define CTOR_USED_BIT    0x2
140
141#define IS_CTOR_CALL(ce) (((zend_uintptr_t)(ce)) & CTOR_CALL_BIT)
142#define IS_CTOR_USED(ce) (((zend_uintptr_t)(ce)) & CTOR_USED_BIT)
143
144#define ENCODE_CTOR(ce, used) \
145    ((zend_class_entry*)(((zend_uintptr_t)(ce)) | CTOR_CALL_BIT | ((used) ? CTOR_USED_BIT : 0)))
146#define DECODE_CTOR(ce) \
147    ((zend_class_entry*)(((zend_uintptr_t)(ce)) & ~(CTOR_CALL_BIT|CTOR_USED_BIT)))
148
149#undef EX
150#define EX(element) execute_data->element
151
152ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, zend_uint var)
153{
154    return EX_VAR(var);
155}
156
157static zend_always_inline zval *_get_zval_ptr_tmp(zend_uint var, const zend_execute_data *execute_data, zend_free_op *should_free TSRMLS_DC)
158{
159    zval *ret = EX_VAR(var);
160    should_free->var = ret;
161
162    ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
163
164    return ret;
165}
166
167static zend_always_inline zval *_get_zval_ptr_var(zend_uint var, const zend_execute_data *execute_data, zend_free_op *should_free TSRMLS_DC)
168{
169    zval *ret = EX_VAR(var);
170
171    should_free->var = ret;
172    return ret;
173}
174
175static zend_always_inline zval *_get_zval_ptr_var_deref(zend_uint var, const zend_execute_data *execute_data, zend_free_op *should_free TSRMLS_DC)
176{
177    zval *ret = EX_VAR(var);
178
179    should_free->var = ret;
180    ZVAL_DEREF(ret);
181    return ret;
182}
183
184static zend_never_inline zval *_get_zval_cv_lookup(zval *ptr, zend_uint var, int type, const zend_execute_data *execute_data TSRMLS_DC)
185{
186    zend_string *cv;
187
188    switch (type) {
189        case BP_VAR_R:
190        case BP_VAR_UNSET:
191            cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
192            zend_error(E_NOTICE, "Undefined variable: %s", cv->val);
193            /* break missing intentionally */
194        case BP_VAR_IS:
195            ptr = &EG(uninitialized_zval);
196            break;
197        case BP_VAR_RW:
198            cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
199            zend_error(E_NOTICE, "Undefined variable: %s", cv->val);
200            /* break missing intentionally */
201        case BP_VAR_W:
202            ZVAL_NULL(ptr);
203            break;
204    }
205    return ptr;
206}
207
208static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_R(zval *ptr, zend_uint var, const zend_execute_data *execute_data TSRMLS_DC)
209{
210    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
211
212    zend_error(E_NOTICE, "Undefined variable: %s", cv->val);
213    return &EG(uninitialized_zval);
214}
215
216static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_UNSET(zval *ptr, zend_uint var, const zend_execute_data *execute_data TSRMLS_DC)
217{
218    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
219
220    zend_error(E_NOTICE, "Undefined variable: %s", cv->val);
221    return &EG(uninitialized_zval);
222}
223
224static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_IS(zval *ptr, zend_uint var, const zend_execute_data *execute_data TSRMLS_DC)
225{
226    return &EG(uninitialized_zval);
227}
228
229static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_RW(zval *ptr, zend_uint var, const zend_execute_data *execute_data TSRMLS_DC)
230{
231    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
232
233    ZVAL_NULL(ptr);
234    zend_error(E_NOTICE, "Undefined variable: %s", cv->val);
235    return ptr;
236}
237
238static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_W(zval *ptr, zend_uint var, const zend_execute_data *execute_data TSRMLS_DC)
239{
240    ZVAL_NULL(ptr);
241    return ptr;
242}
243
244static zend_always_inline zval *_get_zval_ptr_cv(const zend_execute_data *execute_data, zend_uint var, int type TSRMLS_DC)
245{
246    zval *ret = EX_VAR(var);
247
248    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
249        return _get_zval_cv_lookup(ret, var, type, execute_data TSRMLS_CC);
250    }
251    return ret;
252}
253
254static zend_always_inline zval *_get_zval_ptr_cv_deref(const zend_execute_data *execute_data, zend_uint var, int type TSRMLS_DC)
255{
256    zval *ret = EX_VAR(var);
257
258    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
259        return _get_zval_cv_lookup(ret, var, type, execute_data TSRMLS_CC);
260    }
261    ZVAL_DEREF(ret);
262    return ret;
263}
264
265static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
266{
267    zval *ret = EX_VAR(var);
268
269    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
270        return _get_zval_cv_lookup_BP_VAR_R(ret, var, execute_data TSRMLS_CC);
271    }
272    return ret;
273}
274
275static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
276{
277    zval *ret = EX_VAR(var);
278
279    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
280        return _get_zval_cv_lookup_BP_VAR_R(ret, var, execute_data TSRMLS_CC);
281    }
282    ZVAL_DEREF(ret);
283    return ret;
284}
285
286static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_UNSET(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
287{
288    zval *ret = EX_VAR(var);
289
290    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
291        return _get_zval_cv_lookup_BP_VAR_UNSET(ret, var, execute_data TSRMLS_CC);
292    }
293    return ret;
294}
295
296static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_UNSET(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
297{
298    zval *ret = EX_VAR(var);
299
300    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
301        return _get_zval_cv_lookup_BP_VAR_UNSET(ret, var, execute_data TSRMLS_CC);
302    }
303    ZVAL_DEREF(ret);
304    return ret;
305}
306
307static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
308{
309    zval *ret = EX_VAR(var);
310
311    if (Z_TYPE_P(ret) == IS_UNDEF) {
312        return _get_zval_cv_lookup_BP_VAR_IS(ret, var, execute_data TSRMLS_CC);
313    }
314    return ret;
315}
316
317static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_IS(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
318{
319    zval *ret = EX_VAR(var);
320
321    if (Z_TYPE_P(ret) == IS_UNDEF) {
322        return _get_zval_cv_lookup_BP_VAR_IS(ret, var, execute_data TSRMLS_CC);
323    }
324    ZVAL_DEREF(ret);
325    return ret;
326}
327
328static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
329{
330    zval *ret = EX_VAR(var);
331
332    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
333        return _get_zval_cv_lookup_BP_VAR_RW(ret, var, execute_data TSRMLS_CC);
334    }
335    return ret;
336}
337
338static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_RW(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
339{
340    zval *ret = EX_VAR(var);
341
342    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
343        return _get_zval_cv_lookup_BP_VAR_RW(ret, var, execute_data TSRMLS_CC);
344    }
345    ZVAL_DEREF(ret);
346    return ret;
347}
348
349static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
350{
351    zval *ret = EX_VAR(var);
352
353    if (Z_TYPE_P(ret) == IS_UNDEF) {
354        return _get_zval_cv_lookup_BP_VAR_W(ret, var, execute_data TSRMLS_CC);
355    }
356    return ret;
357}
358
359static zend_always_inline zval *_get_zval_ptr_cv_undef_BP_VAR_W(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
360{
361    return EX_VAR(var);
362}
363
364static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_W(const zend_execute_data *execute_data, zend_uint var TSRMLS_DC)
365{
366    zval *ret = EX_VAR(var);
367
368    if (Z_TYPE_P(ret) == IS_UNDEF) {
369        return _get_zval_cv_lookup_BP_VAR_W(ret, var, execute_data TSRMLS_CC);
370    }
371    ZVAL_DEREF(ret);
372    return ret;
373}
374
375static inline zval *_get_zval_ptr(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC)
376{
377    zval *ret;
378
379    switch (op_type) {
380        case IS_CONST:
381            should_free->var = NULL;
382            return node->zv;
383            break;
384        case IS_TMP_VAR:
385            ret = EX_VAR(node->var);
386            should_free->var = TMP_FREE(ret);
387            return ret;
388            break;
389        case IS_VAR:
390            return _get_zval_ptr_var(node->var, execute_data, should_free TSRMLS_CC);
391            break;
392        case IS_UNUSED:
393            should_free->var = NULL;
394            return NULL;
395            break;
396        case IS_CV:
397        default:
398            should_free->var = NULL;
399            return _get_zval_ptr_cv(execute_data, node->var, type TSRMLS_CC);
400            break;
401    }
402    return NULL;
403}
404
405static inline zval *_get_zval_ptr_deref(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC)
406{
407    zval *ret;
408
409    switch (op_type) {
410        case IS_CONST:
411            should_free->var = NULL;
412            return node->zv;
413            break;
414        case IS_TMP_VAR:
415            ret = EX_VAR(node->var);
416            should_free->var = TMP_FREE(ret);
417            return ret;
418            break;
419        case IS_VAR:
420            return _get_zval_ptr_var_deref(node->var, execute_data, should_free TSRMLS_CC);
421            break;
422        case IS_UNUSED:
423            should_free->var = NULL;
424            return NULL;
425            break;
426        case IS_CV:
427        default:
428            should_free->var = NULL;
429            return _get_zval_ptr_cv_deref(execute_data, node->var, type TSRMLS_CC);
430            break;
431    }
432    return NULL;
433}
434
435static zend_always_inline zval *_get_zval_ptr_ptr_var(zend_uint var, const zend_execute_data *execute_data, zend_free_op *should_free TSRMLS_DC)
436{
437    zval *ret = EX_VAR(var);
438
439    if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
440        should_free->var = NULL;
441        return Z_INDIRECT_P(ret);
442    } else if (!Z_REFCOUNTED_P(ret)) {
443        should_free->var = ret; //???
444        return ret;
445    } else {
446        PZVAL_UNLOCK(ret, should_free);
447        return ret;
448    }
449}
450
451static inline zval *_get_zval_ptr_ptr(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC)
452{
453    if (op_type == IS_CV) {
454        should_free->var = NULL;
455        return _get_zval_ptr_cv(execute_data, node->var, type TSRMLS_CC);
456    } else /* if (op_type == IS_VAR) */ {
457        ZEND_ASSERT(op_type == IS_VAR);
458        return _get_zval_ptr_ptr_var(node->var, execute_data, should_free TSRMLS_CC);
459    }
460}
461
462static zend_always_inline zval *_get_obj_zval_ptr_unused(TSRMLS_D)
463{
464    if (EXPECTED(Z_OBJ(EG(This)) != NULL)) {
465        return &EG(This);
466    } else {
467        zend_error_noreturn(E_ERROR, "Using $this when not in object context");
468        return NULL;
469    }
470}
471
472static inline zval *_get_obj_zval_ptr(int op_type, znode_op *op, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC)
473{
474    if (op_type == IS_UNUSED) {
475        if (EXPECTED(Z_OBJ(EG(This)) != NULL)) {
476            should_free->var = NULL;
477            return &EG(This);
478        } else {
479            zend_error_noreturn(E_ERROR, "Using $this when not in object context");
480        }
481    }
482    return get_zval_ptr(op_type, op, execute_data, should_free, type);
483}
484
485static inline zval *_get_obj_zval_ptr_ptr(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC)
486{
487    if (op_type == IS_UNUSED) {
488        if (EXPECTED(Z_OBJ(EG(This)) != NULL)) {
489            should_free->var = NULL;
490            return &EG(This);
491        } else {
492            zend_error_noreturn(E_ERROR, "Using $this when not in object context");
493        }
494    }
495    return get_zval_ptr_ptr(op_type, node, execute_data, should_free, type);
496}
497
498static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr TSRMLS_DC)
499{
500    if (EXPECTED(variable_ptr != value_ptr)) {
501        ZVAL_MAKE_REF(value_ptr);
502        Z_ADDREF_P(value_ptr);
503        zval_ptr_dtor(variable_ptr);
504        ZVAL_REF(variable_ptr, Z_REF_P(value_ptr));
505    } else {
506        ZVAL_MAKE_REF(variable_ptr);
507    }
508}
509
510/* this should modify object only if it's empty */
511static inline zval* make_real_object(zval *object_ptr TSRMLS_DC)
512{
513    zval *object = object_ptr;
514
515    ZVAL_DEREF(object);
516    if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
517        if (Z_TYPE_P(object) == IS_NULL
518            || Z_TYPE_P(object) == IS_FALSE
519            || (Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0)) {
520            zval_ptr_dtor_nogc(object);
521            object_init(object);
522            zend_error(E_WARNING, "Creating default object from empty value");
523        }
524    }
525    return object;
526}
527
528ZEND_API char * zend_verify_arg_class_kind(const zend_arg_info *cur_arg_info, ulong fetch_type, char **class_name, zend_class_entry **pce TSRMLS_DC)
529{
530    zend_string *key;
531    ALLOCA_FLAG(use_heap);
532
533    STR_ALLOCA_INIT(key, cur_arg_info->class_name, cur_arg_info->class_name_len, use_heap);
534    *pce = zend_fetch_class(key, (fetch_type | ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD) TSRMLS_CC);
535    STR_ALLOCA_FREE(key, use_heap);
536
537    *class_name = (*pce) ? (*pce)->name->val : (char*)cur_arg_info->class_name;
538    if (*pce && (*pce)->ce_flags & ZEND_ACC_INTERFACE) {
539        return "implement interface ";
540    } else {
541        return "be an instance of ";
542    }
543}
544
545ZEND_API void zend_verify_arg_error(int error_type, const zend_function *zf, zend_uint arg_num, const char *need_msg, const char *need_kind, const char *given_msg, const char *given_kind, zval *arg TSRMLS_DC)
546{
547    zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
548    const char *fname = zf->common.function_name->val;
549    const char *fsep;
550    const char *fclass;
551    zval old_arg;
552
553    if (zf->common.scope) {
554        fsep =  "::";
555        fclass = zf->common.scope->name->val;
556    } else {
557        fsep =  "";
558        fclass = "";
559    }
560
561    if (arg && zf->common.type == ZEND_USER_FUNCTION) {
562        ZVAL_COPY_VALUE(&old_arg, arg);
563        ZVAL_UNDEF(arg);
564    }
565
566    if (zf->common.type == ZEND_USER_FUNCTION && ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
567        zend_error(error_type, "Argument %d passed to %s%s%s() must %s%s, %s%s given, called in %s on line %d and defined", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind, ptr->func->op_array.filename->val, ptr->opline->lineno);
568    } else {
569        zend_error(error_type, "Argument %d passed to %s%s%s() must %s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind);
570    }
571
572    if (arg && zf->common.type == ZEND_USER_FUNCTION) {
573        ZVAL_COPY_VALUE(arg, &old_arg);
574    }
575}
576
577static void zend_verify_arg_type(zend_function *zf, zend_uint arg_num, zval *arg, ulong fetch_type TSRMLS_DC)
578{
579    zend_arg_info *cur_arg_info;
580    char *need_msg;
581    zend_class_entry *ce;
582
583    if (UNEXPECTED(!zf->common.arg_info)) {
584        return;
585    }
586
587    if (EXPECTED(arg_num <= zf->common.num_args)) {
588        cur_arg_info = &zf->common.arg_info[arg_num-1];
589    } else if (zf->common.fn_flags & ZEND_ACC_VARIADIC) {
590        cur_arg_info = &zf->common.arg_info[zf->common.num_args-1];
591    } else {
592        return;
593    }
594
595    if (cur_arg_info->class_name) {
596        char *class_name;
597
598        ZVAL_DEREF(arg);
599        if (Z_TYPE_P(arg) == IS_OBJECT) {
600            need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
601            if (!ce || !instanceof_function(Z_OBJCE_P(arg), ce TSRMLS_CC)) {
602                zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, need_msg, class_name, "instance of ", Z_OBJCE_P(arg)->name->val, arg TSRMLS_CC);
603            }
604        } else if (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null) {
605            need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
606            zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, need_msg, class_name, zend_zval_type_name(arg), "", arg TSRMLS_CC);
607        }
608    } else if (cur_arg_info->type_hint) {
609        if (cur_arg_info->type_hint == IS_ARRAY) {
610            ZVAL_DEREF(arg);
611            if (Z_TYPE_P(arg) != IS_ARRAY && (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null)) {
612                zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, "be of the type array", "", zend_zval_type_name(arg), "", arg TSRMLS_CC);
613            }
614        } else if (cur_arg_info->type_hint == IS_CALLABLE) {
615            if (!zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL TSRMLS_CC) && (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null)) {
616                zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, "be callable", "", zend_zval_type_name(arg), "", arg TSRMLS_CC);
617            }
618#if ZEND_DEBUG
619        } else {
620            zend_error(E_ERROR, "Unknown typehint");
621#endif
622        }
623    }
624}
625
626static inline int zend_verify_missing_arg_type(zend_function *zf, zend_uint arg_num, ulong fetch_type TSRMLS_DC)
627{
628    zend_arg_info *cur_arg_info;
629    char *need_msg;
630    zend_class_entry *ce;
631
632    if (UNEXPECTED(!zf->common.arg_info)) {
633        return 1;
634    }
635
636    if (EXPECTED(arg_num <= zf->common.num_args)) {
637        cur_arg_info = &zf->common.arg_info[arg_num-1];
638    } else if (zf->common.fn_flags & ZEND_ACC_VARIADIC) {
639        cur_arg_info = &zf->common.arg_info[zf->common.num_args-1];
640    } else {
641        return 1;
642    }
643
644    if (cur_arg_info->class_name) {
645        char *class_name;
646
647        need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
648        zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, need_msg, class_name, "none", "", NULL TSRMLS_CC);
649    } else if (cur_arg_info->type_hint) {
650        if (cur_arg_info->type_hint == IS_ARRAY) {
651            zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, "be of the type array", "", "none", "", NULL TSRMLS_CC);
652        } else if (cur_arg_info->type_hint == IS_CALLABLE) {
653            zend_verify_arg_error(E_RECOVERABLE_ERROR, zf, arg_num, "be callable", "", "none", "", NULL TSRMLS_CC);
654#if ZEND_DEBUG
655        } else {
656            zend_error(E_ERROR, "Unknown typehint");
657#endif
658        }
659    }
660    return 0;
661}
662
663static void zend_verify_missing_arg(zend_execute_data *execute_data, zend_uint arg_num TSRMLS_DC)
664{
665    if (EXPECTED(!(EX(func)->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS)) ||
666        zend_verify_missing_arg_type(EX(func), arg_num, EX(opline)->extended_value TSRMLS_CC)) {
667        const char *class_name = EX(func)->common.scope ? EX(func)->common.scope->name->val : "";
668        const char *space = EX(func)->common.scope ? "::" : "";
669        const char *func_name = EX(func)->common.function_name ? EX(func)->common.function_name->val : "main";
670        zend_execute_data *ptr = EX(prev_execute_data);
671
672        if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
673            zend_error(E_WARNING, "Missing argument %u for %s%s%s(), called in %s on line %d and defined", arg_num, class_name, space, func_name, ptr->func->op_array.filename->val, ptr->opline->lineno);
674        } else {
675            zend_error(E_WARNING, "Missing argument %u for %s%s%s()", arg_num, class_name, space, func_name);
676        }
677    }
678}
679
680static inline void zend_assign_to_object(zval *retval, zval *object_ptr, zval *property_name, int value_type, znode_op *value_op, const zend_execute_data *execute_data, int opcode, void **cache_slot TSRMLS_DC)
681{
682    zend_free_op free_value;
683    zval *value = get_zval_ptr(value_type, value_op, execute_data, &free_value, BP_VAR_R);
684    zval tmp;
685    zval *object = object_ptr;
686
687    ZVAL_DEREF(object);
688    if (Z_TYPE_P(object) != IS_OBJECT) {
689        if (object == &EG(error_zval)) {
690            if (retval) {
691                ZVAL_NULL(retval);
692            }
693            FREE_OP(free_value);
694            return;
695        }
696        if (Z_TYPE_P(object) == IS_NULL ||
697            Z_TYPE_P(object) == IS_FALSE ||
698            (Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0)) {
699            zend_object *obj;
700
701            zval_ptr_dtor(object);
702            object_init(object);
703            Z_ADDREF_P(object);
704            obj = Z_OBJ_P(object);
705            zend_error(E_WARNING, "Creating default object from empty value");
706            if (GC_REFCOUNT(obj) == 1) {
707                /* the enclosing container was deleted, obj is unreferenced */
708                if (retval) {
709                    ZVAL_NULL(retval);
710                }
711                FREE_OP(free_value);
712                OBJ_RELEASE(obj);
713                return;
714            }
715            Z_DELREF_P(object);
716        } else {
717            zend_error(E_WARNING, "Attempt to assign property of non-object");
718            if (retval) {
719                ZVAL_NULL(retval);
720            }
721            FREE_OP(free_value);
722            return;
723        }
724    }
725
726    /* separate our value if necessary */
727    if (value_type == IS_TMP_VAR) {
728        ZVAL_COPY_VALUE(&tmp, value);
729        value = &tmp;
730    } else if (value_type == IS_CONST) {
731        if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
732            ZVAL_COPY_VALUE(&tmp, value);
733            zval_copy_ctor_func(&tmp);
734            value = &tmp;
735        }
736    } else if (Z_REFCOUNTED_P(value)) {
737        Z_ADDREF_P(value);
738    }
739
740    if (opcode == ZEND_ASSIGN_OBJ) {
741        if (!Z_OBJ_HT_P(object)->write_property) {
742            zend_error(E_WARNING, "Attempt to assign property of non-object");
743            if (retval) {
744                ZVAL_NULL(retval);
745            }
746            if (value_type == IS_CONST) {
747                zval_ptr_dtor(value);
748            }
749            FREE_OP(free_value);
750            return;
751        }
752        Z_OBJ_HT_P(object)->write_property(object, property_name, value, cache_slot TSRMLS_CC);
753    } else {
754        /* Note:  property_name in this case is really the array index! */
755        if (!Z_OBJ_HT_P(object)->write_dimension) {
756            zend_error_noreturn(E_ERROR, "Cannot use object as array");
757        }
758        Z_OBJ_HT_P(object)->write_dimension(object, property_name, value TSRMLS_CC);
759    }
760
761    if (retval && !EG(exception)) {
762        ZVAL_COPY(retval, value);
763    }
764    zval_ptr_dtor(value);
765    FREE_OP_IF_VAR(free_value);
766}
767
768static void zend_assign_to_string_offset(zval *str_offset, zval *value, int value_type, zval *result TSRMLS_DC)
769{
770    zval *str = Z_STR_OFFSET_STR_P(str_offset);
771    zend_uint offset = Z_STR_OFFSET_IDX_P(str_offset);
772    zend_string *old_str;
773
774    if ((int)offset < 0) {
775        zend_error(E_WARNING, "Illegal string offset:  %d", offset);
776        STR_RELEASE(Z_STR_P(str));
777        if (result) {
778            ZVAL_NULL(result);
779        }
780        return;
781    }
782
783    old_str = Z_STR_P(str);
784    if (offset >= Z_STRLEN_P(str)) {
785        int old_len = Z_STRLEN_P(str);
786        Z_STR_P(str) = STR_REALLOC(Z_STR_P(str), offset + 1, 0);
787        Z_TYPE_INFO_P(str) = IS_STRING_EX;
788        memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
789        Z_STRVAL_P(str)[offset+1] = 0;
790    } else if (IS_INTERNED(Z_STR_P(str))) {
791        Z_STR_P(str) = STR_INIT(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
792        Z_TYPE_INFO_P(str) = IS_STRING_EX;
793    }
794
795    if (Z_TYPE_P(value) != IS_STRING) {
796        zend_string *tmp = zval_get_string(value);
797
798        Z_STRVAL_P(str)[offset] = tmp->val[0];
799        STR_RELEASE(tmp);
800    } else {
801        Z_STRVAL_P(str)[offset] = Z_STRVAL_P(value)[0];
802        if (value_type == IS_TMP_VAR) {
803            /* we can safely free final_value here
804             * because separation is done only
805             * in case value_type == IS_VAR */
806            zval_dtor(value);
807        }
808    }
809    /*
810     * the value of an assignment to a string offset is undefined
811    T(result->u.var).var = &T->str_offset.str;
812    */
813
814    STR_RELEASE(old_str);
815    if (result) {
816        zend_uchar c = (zend_uchar)Z_STRVAL_P(str)[offset];
817
818        if (CG(one_char_string)[c]) {
819            ZVAL_INT_STR(result, CG(one_char_string)[c]);
820        } else {
821            ZVAL_NEW_STR(result, STR_INIT(Z_STRVAL_P(str) + offset, 1, 0));
822        }
823    }
824}
825
826static inline zval* zend_assign_tmp_to_variable(zval *variable_ptr, zval *value TSRMLS_DC)
827{
828    ZVAL_DEREF(variable_ptr);
829
830    if (UNEXPECTED(Z_REFCOUNTED_P(variable_ptr))) {
831        zend_refcounted *garbage;
832
833        if (Z_TYPE_P(variable_ptr) == IS_OBJECT &&
834            UNEXPECTED(Z_OBJ_HANDLER_P(variable_ptr, set) != NULL)) {
835            Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr, value TSRMLS_CC);
836            return variable_ptr;
837        }
838
839        garbage = Z_COUNTED_P(variable_ptr);
840        if (UNEXPECTED(GC_REFCOUNT(garbage) > 1)) {
841            /* we need to split */
842            GC_REFCOUNT(garbage)--;
843            /* optimized version of GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr) */
844            if ((Z_COLLECTABLE_P(variable_ptr)) &&
845                UNEXPECTED(!GC_INFO(garbage))) {
846                gc_possible_root(garbage TSRMLS_CC);
847            }
848        } else {
849            ZVAL_COPY_VALUE(variable_ptr, value);
850            _zval_dtor_func(garbage ZEND_FILE_LINE_CC);
851            return variable_ptr;
852        }
853    }
854
855    ZVAL_COPY_VALUE(variable_ptr, value);
856
857    return variable_ptr;
858}
859
860static inline zval* zend_assign_const_to_variable(zval *variable_ptr, zval *value TSRMLS_DC)
861{
862    ZVAL_DEREF(variable_ptr);
863
864    if (UNEXPECTED(Z_REFCOUNTED_P(variable_ptr))) {
865        zend_refcounted *garbage;
866
867        if (Z_TYPE_P(variable_ptr) == IS_OBJECT &&
868            UNEXPECTED(Z_OBJ_HANDLER_P(variable_ptr, set) != NULL)) {
869            Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr, value TSRMLS_CC);
870            return variable_ptr;
871        }
872
873        garbage = Z_COUNTED_P(variable_ptr);
874        if (UNEXPECTED(GC_REFCOUNT(garbage) > 1)) {
875            /* we need to split */
876            GC_REFCOUNT(garbage)--;
877            /* optimized version of GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr) */
878            if (Z_COLLECTABLE_P(variable_ptr) &&
879                UNEXPECTED(!GC_INFO(garbage))) {
880                gc_possible_root(garbage TSRMLS_CC);
881            }
882        } else {
883            ZVAL_COPY_VALUE(variable_ptr, value);
884            /* IS_CONST can't be IS_OBJECT, IS_RESOURCE or IS_REFERENCE */
885            if (UNEXPECTED(Z_OPT_COPYABLE_P(variable_ptr))) {
886                zval_copy_ctor_func(variable_ptr);
887            }
888            _zval_dtor_func(garbage ZEND_FILE_LINE_CC);
889            return variable_ptr;
890        }
891    }
892
893    ZVAL_COPY_VALUE(variable_ptr, value);
894    /* IS_CONST can't be IS_OBJECT, IS_RESOURCE or IS_REFERENCE */
895    if (UNEXPECTED(Z_OPT_COPYABLE_P(variable_ptr))) {
896        zval_copy_ctor_func(variable_ptr);
897    }
898
899    return variable_ptr;
900}
901
902static inline zval* zend_assign_to_variable(zval *variable_ptr, zval *value TSRMLS_DC)
903{
904    zend_refcounted *garbage;
905
906    if (EXPECTED(!Z_REFCOUNTED_P(variable_ptr))) {
907        goto assign_simple;
908    } else if (UNEXPECTED(variable_ptr == value)) {
909        return variable_ptr;
910    }
911    if (Z_ISREF_P(variable_ptr)) {
912        variable_ptr = Z_REFVAL_P(variable_ptr);
913        if (EXPECTED(!Z_REFCOUNTED_P(variable_ptr))) {
914            goto assign_simple;
915        } else if (UNEXPECTED(variable_ptr == value)) {
916            return variable_ptr;
917        }
918    }
919
920    if (Z_TYPE_P(variable_ptr) == IS_OBJECT &&
921        UNEXPECTED(Z_OBJ_HANDLER_P(variable_ptr, set) != NULL)) {
922        Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr, value TSRMLS_CC);
923    } else {
924        if (Z_REFCOUNT_P(variable_ptr)==1) {
925            garbage = Z_COUNTED_P(variable_ptr);
926            if (UNEXPECTED(Z_REFCOUNTED_P(value))) {
927                if (EXPECTED(!Z_ISREF_P(value))) {
928                    Z_ADDREF_P(value);
929                } else {
930                    if (Z_REFCOUNT_P(value) == 1) {
931                        ZVAL_UNREF(value);
932                    } else {
933                        value = Z_REFVAL_P(value);
934                    }
935                    if (Z_REFCOUNTED_P(value)) {
936                        if (UNEXPECTED(variable_ptr == value)) {
937                            return variable_ptr;
938                        }
939                        Z_ADDREF_P(value);
940                    }
941                }
942            }
943            ZVAL_COPY_VALUE(variable_ptr, value);
944            _zval_dtor_func(garbage ZEND_FILE_LINE_CC);
945        } else { /* we need to split */
946            Z_DELREF_P(variable_ptr);
947            GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr);
948assign_simple:
949            if (UNEXPECTED(Z_REFCOUNTED_P(value))) {
950                if (EXPECTED(!Z_ISREF_P(value))) {
951                    Z_ADDREF_P(value);
952                } else {
953                    if (Z_REFCOUNT_P(value) == 1) {
954                        ZVAL_UNREF(value);
955                    } else {
956                        value = Z_REFVAL_P(value);
957                    }
958                    if (Z_REFCOUNTED_P(value)) {
959                        Z_ADDREF_P(value);
960                    }
961                }
962            }
963            ZVAL_COPY_VALUE(variable_ptr, value);
964        }
965    }
966    return variable_ptr;
967}
968
969/* Utility Functions for Extensions */
970static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
971{
972    if (extension->statement_handler) {
973        extension->statement_handler(op_array);
974    }
975}
976
977
978static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
979{
980    if (extension->fcall_begin_handler) {
981        extension->fcall_begin_handler(op_array);
982    }
983}
984
985
986static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
987{
988    if (extension->fcall_end_handler) {
989        extension->fcall_end_handler(op_array);
990    }
991}
992
993
994static zend_always_inline HashTable *zend_get_target_symbol_table(zend_execute_data *execute_data, int fetch_type TSRMLS_DC)
995{
996    HashTable *ht;
997
998    if (EXPECTED(fetch_type == ZEND_FETCH_GLOBAL_LOCK) ||
999        EXPECTED(fetch_type == ZEND_FETCH_GLOBAL)) {
1000        ht = &EG(symbol_table).ht;
1001    } else if (EXPECTED(fetch_type == ZEND_FETCH_STATIC)) {
1002        ZEND_ASSERT(EX(func)->op_array.static_variables != NULL);
1003        ht = EX(func)->op_array.static_variables;
1004    } else {
1005        ZEND_ASSERT(fetch_type == ZEND_FETCH_LOCAL);
1006        if (!EX(symbol_table)) {
1007            zend_rebuild_symbol_table(TSRMLS_C);
1008        }
1009        ht = &EX(symbol_table)->ht;
1010    }
1011    return ht;
1012}
1013
1014static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type TSRMLS_DC)
1015{
1016    zval *retval;
1017    zend_string *offset_key;
1018    ulong hval;
1019
1020    if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1021        hval = Z_LVAL_P(dim);
1022num_index:
1023        retval = zend_hash_index_find(ht, hval);
1024        if (retval == NULL) {
1025            switch (type) {
1026                case BP_VAR_R:
1027                    zend_error(E_NOTICE,"Undefined offset: %ld", hval);
1028                    /* break missing intentionally */
1029                case BP_VAR_UNSET:
1030                case BP_VAR_IS:
1031                    retval = &EG(uninitialized_zval);
1032                    break;
1033                case BP_VAR_RW:
1034                    zend_error(E_NOTICE,"Undefined offset: %ld", hval);
1035                    /* break missing intentionally */
1036                case BP_VAR_W:
1037                    retval = zend_hash_index_add_new(ht, hval, &EG(uninitialized_zval));
1038                    break;
1039            }
1040        }
1041    } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
1042        offset_key = Z_STR_P(dim);
1043        if (dim_type != IS_CONST) {
1044            if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
1045                goto num_index;
1046            }
1047        }
1048str_index:
1049        retval = zend_hash_find(ht, offset_key);
1050        if (retval) {
1051            /* support for $GLOBALS[...] */
1052            if (UNEXPECTED(Z_TYPE_P(retval) == IS_INDIRECT)) {
1053                retval = Z_INDIRECT_P(retval);
1054                if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1055                    switch (type) {
1056                        case BP_VAR_R:
1057                            zend_error(E_NOTICE, "Undefined index: %s", offset_key->val);
1058                            /* break missing intentionally */
1059                        case BP_VAR_UNSET:
1060                        case BP_VAR_IS:
1061                            retval = &EG(uninitialized_zval);
1062                            break;
1063                        case BP_VAR_RW:
1064                            zend_error(E_NOTICE,"Undefined index: %s", offset_key->val);
1065                            /* break missing intentionally */
1066                        case BP_VAR_W:
1067                            ZVAL_NULL(retval);
1068                            break;
1069                    }
1070                }
1071            }
1072        } else {
1073            switch (type) {
1074                case BP_VAR_R:
1075                    zend_error(E_NOTICE, "Undefined index: %s", offset_key->val);
1076                    /* break missing intentionally */
1077                case BP_VAR_UNSET:
1078                case BP_VAR_IS:
1079                    retval = &EG(uninitialized_zval);
1080                    break;
1081                case BP_VAR_RW:
1082                    zend_error(E_NOTICE,"Undefined index: %s", offset_key->val);
1083                    /* break missing intentionally */
1084                case BP_VAR_W:
1085                    retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
1086                    break;
1087            }
1088        }
1089    } else {
1090        switch (Z_TYPE_P(dim)) {
1091            case IS_NULL:
1092                offset_key = STR_EMPTY_ALLOC();
1093                goto str_index;
1094            case IS_DOUBLE:
1095                hval = zend_dval_to_lval(Z_DVAL_P(dim));
1096                goto num_index;
1097            case IS_RESOURCE:
1098                zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
1099                hval = Z_RES_HANDLE_P(dim);
1100                goto num_index;
1101            case IS_FALSE:
1102                hval = 0;
1103                goto num_index;
1104            case IS_TRUE:
1105                hval = 1;
1106                goto num_index;
1107            default:
1108                zend_error(E_WARNING, "Illegal offset type");
1109                retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
1110                    &EG(error_zval) : &EG(uninitialized_zval);
1111        }
1112    }
1113    return retval;
1114}
1115
1116static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container_ptr, zval *dim, int dim_type, int type, int is_ref TSRMLS_DC)
1117{
1118    zval *retval;
1119    zval *container = container_ptr;
1120
1121    ZVAL_DEREF(container);
1122    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1123        SEPARATE_ARRAY(container);
1124fetch_from_array:
1125        if (dim == NULL) {
1126            retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
1127            if (retval == NULL) {
1128                zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
1129                retval = &EG(error_zval);
1130            }
1131        } else {
1132            retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type TSRMLS_CC);
1133        }
1134        if (is_ref) {
1135            ZVAL_MAKE_REF(retval);
1136            Z_ADDREF_P(retval);
1137            ZVAL_REF(result, Z_REF_P(retval));
1138        } else {
1139            ZVAL_INDIRECT(result, retval);
1140        }
1141    } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
1142        long offset;
1143
1144        if (type != BP_VAR_UNSET && UNEXPECTED(Z_STRLEN_P(container) == 0)) {
1145            zval_dtor(container);
1146convert_to_array:
1147            ZVAL_NEW_ARR(container);
1148            zend_hash_init(Z_ARRVAL_P(container), 8, NULL, ZVAL_PTR_DTOR, 0);
1149            goto fetch_from_array;
1150        }
1151        if (dim == NULL) {
1152            zend_error_noreturn(E_ERROR, "[] operator not supported for strings");
1153        }
1154
1155        if (type != BP_VAR_UNSET) {
1156            SEPARATE_STRING(container);
1157        }
1158
1159        if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1160            switch(Z_TYPE_P(dim)) {
1161                case IS_STRING:
1162                    if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
1163                        break;
1164                    }
1165                    if (type != BP_VAR_UNSET) {
1166                        zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
1167                    }
1168                    break;
1169                case IS_DOUBLE:
1170                case IS_NULL:
1171                case IS_FALSE:
1172                case IS_TRUE:
1173                    zend_error(E_NOTICE, "String offset cast occurred");
1174                    break;
1175                default:
1176                    zend_error(E_WARNING, "Illegal offset type");
1177                    break;
1178            }
1179
1180            offset = zval_get_long(dim);
1181        } else {
1182            offset = Z_LVAL_P(dim);
1183        }
1184
1185        if (!IS_INTERNED(Z_STR_P(container))) STR_ADDREF(Z_STR_P(container));
1186        ZVAL_STR_OFFSET(result, container, offset);
1187    } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1188        if (!Z_OBJ_HT_P(container)->read_dimension) {
1189            zend_error_noreturn(E_ERROR, "Cannot use object as array");
1190        } else {
1191            retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result TSRMLS_CC);
1192
1193            if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
1194                zend_class_entry *ce = Z_OBJCE_P(container);
1195
1196                ZVAL_NULL(result);
1197                zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name->val);
1198            } else if (retval && Z_TYPE_P(retval) != IS_UNDEF) {
1199                if (!Z_ISREF_P(retval)) {
1200                    if (Z_REFCOUNTED_P(retval) &&
1201                        Z_REFCOUNT_P(retval) > 1) {
1202                        if (Z_TYPE_P(retval) != IS_OBJECT) {
1203                            Z_DELREF_P(retval);
1204                            ZVAL_DUP(result, retval);
1205                            retval = result;
1206                        } else {
1207                            ZVAL_COPY(result, retval);
1208                            retval = result;
1209                        }
1210                    }
1211                    if (Z_TYPE_P(retval) != IS_OBJECT) {
1212                        zend_class_entry *ce = Z_OBJCE_P(container);
1213                        zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name->val);
1214                    }
1215                }
1216                if (result != retval) {
1217                    if (is_ref) {
1218                        ZVAL_MAKE_REF(retval);
1219                        Z_ADDREF_P(retval);
1220                        ZVAL_REF(result, Z_REF_P(retval));
1221                    } else {
1222                        ZVAL_INDIRECT(result, retval);
1223                    }
1224                }
1225            } else {
1226                ZVAL_INDIRECT(result, &EG(error_zval));
1227            }
1228        }
1229    } else if (EXPECTED(Z_TYPE_P(container) == IS_NULL)) {
1230        if (container == &EG(error_zval)) {
1231            ZVAL_INDIRECT(result, &EG(error_zval));
1232        } else if (type != BP_VAR_UNSET) {
1233            goto convert_to_array;
1234        } else {
1235            /* for read-mode only */
1236            ZVAL_NULL(result);
1237        }
1238    } else {
1239        if (type != BP_VAR_UNSET &&
1240            Z_TYPE_P(container) == IS_FALSE) {
1241            goto convert_to_array;
1242        }
1243        if (type == BP_VAR_UNSET) {
1244            zend_error(E_WARNING, "Cannot unset offset in a non-array variable");
1245            ZVAL_NULL(result);
1246        } else {
1247            zend_error(E_WARNING, "Cannot use a scalar value as an array");
1248            ZVAL_INDIRECT(result, &EG(error_zval));
1249        }
1250    }
1251}
1252
1253static zend_never_inline void zend_fetch_dimension_address_W(zval *result, zval *container_ptr, zval *dim, int dim_type TSRMLS_DC)
1254{
1255    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W, 0 TSRMLS_CC);
1256}
1257
1258static zend_never_inline void zend_fetch_dimension_address_W_ref(zval *result, zval *container_ptr, zval *dim, int dim_type TSRMLS_DC)
1259{
1260    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W, 1 TSRMLS_CC);
1261}
1262
1263static zend_never_inline void zend_fetch_dimension_address_RW(zval *result, zval *container_ptr, zval *dim, int dim_type TSRMLS_DC)
1264{
1265    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW, 0 TSRMLS_CC);
1266}
1267
1268static zend_never_inline void zend_fetch_dimension_address_UNSET(zval *result, zval *container_ptr, zval *dim, int dim_type TSRMLS_DC)
1269{
1270    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET, 0 TSRMLS_CC);
1271}
1272
1273static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type TSRMLS_DC)
1274{
1275    zval *retval;
1276
1277    ZVAL_DEREF(container);
1278    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1279        retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type TSRMLS_CC);
1280        ZVAL_COPY(result, retval);
1281    } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
1282        long offset;
1283
1284        if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1285            switch(Z_TYPE_P(dim)) {
1286                /* case IS_LONG: */
1287                case IS_STRING:
1288                    if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
1289                        break;
1290                    }
1291                    if (type != BP_VAR_IS) {
1292                        zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
1293                    }
1294                    break;
1295                case IS_DOUBLE:
1296                case IS_NULL:
1297                case IS_FALSE:
1298                case IS_TRUE:
1299                    if (type != BP_VAR_IS) {
1300                        zend_error(E_NOTICE, "String offset cast occurred");
1301                    }
1302                    break;
1303                default:
1304                    zend_error(E_WARNING, "Illegal offset type");
1305                    break;
1306            }
1307
1308            offset = zval_get_long(dim);
1309        } else {
1310            offset = Z_LVAL_P(dim);
1311        }
1312
1313        if (UNEXPECTED(offset < 0) || UNEXPECTED(Z_STRLEN_P(container) <= offset)) {
1314            if (type != BP_VAR_IS) {
1315                zend_error(E_NOTICE, "Uninitialized string offset: %ld", offset);
1316            }
1317            ZVAL_EMPTY_STRING(result);
1318        } else {
1319            zend_uchar c = (zend_uchar)Z_STRVAL_P(container)[offset];
1320
1321            if (CG(one_char_string)[c]) {
1322                ZVAL_INT_STR(result, CG(one_char_string)[c]);
1323            } else {
1324                ZVAL_NEW_STR(result, STR_INIT(Z_STRVAL_P(container) + offset, 1, 0));
1325            }
1326        }
1327    } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1328        if (!Z_OBJ_HT_P(container)->read_dimension) {
1329            zend_error_noreturn(E_ERROR, "Cannot use object as array");
1330        } else {
1331            retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result TSRMLS_CC);
1332
1333            if (result) {
1334                if (retval) {
1335                    if (result != retval) {
1336                        ZVAL_COPY(result, retval);
1337                    }
1338                } else {
1339                    ZVAL_NULL(result);
1340                }
1341            }
1342        }
1343    } else {
1344        ZVAL_NULL(result);
1345    }
1346}
1347
1348static zend_never_inline void zend_fetch_dimension_address_read_R(zval *result, zval *container, zval *dim, int dim_type TSRMLS_DC)
1349{
1350    zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R TSRMLS_CC);
1351}
1352
1353static zend_never_inline void zend_fetch_dimension_address_read_IS(zval *result, zval *container, zval *dim, int dim_type TSRMLS_DC)
1354{
1355    zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS TSRMLS_CC);
1356}
1357
1358ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *dim TSRMLS_DC)
1359{
1360    zend_fetch_dimension_address_read_R(result, container, dim, IS_TMP_VAR TSRMLS_CC);
1361}
1362
1363static void zend_fetch_property_address(zval *result, zval *container_ptr, zval *prop_ptr, void **cache_slot, int type, int is_ref TSRMLS_DC)
1364{
1365    zval *container = container_ptr;
1366
1367    ZVAL_DEREF(container);
1368    if (Z_TYPE_P(container) != IS_OBJECT) {
1369        if (container == &EG(error_zval)) {
1370            ZVAL_INDIRECT(result, &EG(error_zval));
1371            return;
1372        }
1373
1374        /* this should modify object only if it's empty */
1375        if (type != BP_VAR_UNSET &&
1376            ((Z_TYPE_P(container) == IS_NULL ||
1377              Z_TYPE_P(container) == IS_FALSE ||
1378              (Z_TYPE_P(container) == IS_STRING && Z_STRLEN_P(container)==0)))) {
1379            zval_ptr_dtor_nogc(container);
1380            object_init(container);
1381        } else {
1382            zend_error(E_WARNING, "Attempt to modify property of non-object");
1383            ZVAL_INDIRECT(result, &EG(error_zval));
1384            return;
1385        }
1386    }
1387
1388    if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) {
1389        zval *ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr, type, cache_slot TSRMLS_CC);
1390        if (NULL == ptr) {
1391            if (Z_OBJ_HT_P(container)->read_property &&
1392                (ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type, cache_slot, result TSRMLS_CC)) != NULL) {
1393                if (ptr != result) {
1394                    if (is_ref && ptr != &EG(uninitialized_zval)) {
1395                        ZVAL_MAKE_REF(ptr);
1396                        Z_ADDREF_P(ptr);
1397                        ZVAL_REF(result, Z_REF_P(ptr));
1398                    } else {
1399                        ZVAL_INDIRECT(result, ptr);
1400                    }
1401                }
1402            } else {
1403                zend_error_noreturn(E_ERROR, "Cannot access undefined property for object with overloaded property access");
1404            }
1405        } else {
1406            if (is_ref) {
1407                ZVAL_MAKE_REF(ptr);
1408                Z_ADDREF_P(ptr);
1409                ZVAL_REF(result, Z_REF_P(ptr));
1410            } else {
1411                ZVAL_INDIRECT(result, ptr);
1412            }
1413        }
1414    } else if (Z_OBJ_HT_P(container)->read_property) {
1415        zval *ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type, cache_slot, result TSRMLS_CC);
1416        if (ptr != result) {
1417            if (is_ref && ptr != &EG(uninitialized_zval)) {
1418                ZVAL_MAKE_REF(ptr);
1419                Z_ADDREF_P(ptr);
1420                ZVAL_REF(result, Z_REF_P(ptr));
1421            } else {
1422                ZVAL_INDIRECT(result, ptr);
1423            }
1424        }
1425    } else {
1426        zend_error(E_WARNING, "This object doesn't support property references");
1427        ZVAL_INDIRECT(result, &EG(error_zval));
1428    }
1429}
1430
1431static inline zend_brk_cont_element* zend_brk_cont(int nest_levels, int array_offset, const zend_op_array *op_array, const zend_execute_data *execute_data TSRMLS_DC)
1432{
1433    int original_nest_levels = nest_levels;
1434    zend_brk_cont_element *jmp_to;
1435
1436    do {
1437        if (array_offset==-1) {
1438            zend_error_noreturn(E_ERROR, "Cannot break/continue %d level%s", original_nest_levels, (original_nest_levels == 1) ? "" : "s");
1439        }
1440        jmp_to = &op_array->brk_cont_array[array_offset];
1441        if (nest_levels>1) {
1442            zend_op *brk_opline = &op_array->opcodes[jmp_to->brk];
1443
1444            if (brk_opline->opcode == ZEND_SWITCH_FREE) {
1445                if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1446                    zval_ptr_dtor(EX_VAR(brk_opline->op1.var));
1447                }
1448            } else if (brk_opline->opcode == ZEND_FREE) {
1449                if (!(brk_opline->extended_value & EXT_TYPE_FREE_ON_RETURN)) {
1450                    zval_dtor(EX_VAR(brk_opline->op1.var));
1451                }
1452            }
1453        }
1454        array_offset = jmp_to->parent;
1455    } while (--nest_levels > 0);
1456    return jmp_to;
1457}
1458
1459#if ZEND_INTENSIVE_DEBUGGING
1460
1461#define CHECK_SYMBOL_TABLES()                                                   \
1462    zend_hash_apply(&EG(symbol_table), zend_check_symbol TSRMLS_CC);            \
1463    if (&EG(symbol_table)!=EX(symbol_table)) {                          \
1464        zend_hash_apply(EX(symbol_table), zend_check_symbol TSRMLS_CC); \
1465    }
1466
1467static int zend_check_symbol(zval *pz TSRMLS_DC)
1468{
1469    if (Z_TYPE_P(pz) == IS_INDIRECT) {
1470        pz = Z_INDIRECT_P(pz);
1471    }
1472    if (Z_TYPE_P(pz) > 10) {
1473        fprintf(stderr, "Warning!  %x has invalid type!\n", *pz);
1474/* See http://support.microsoft.com/kb/190351 */
1475#ifdef PHP_WIN32
1476        fflush(stderr);
1477#endif
1478    } else if (Z_TYPE_P(pz) == IS_ARRAY) {
1479        zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol TSRMLS_CC);
1480    } else if (Z_TYPE_P(pz) == IS_OBJECT) {
1481        /* OBJ-TBI - doesn't support new object model! */
1482        zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol TSRMLS_CC);
1483    }
1484
1485    return 0;
1486}
1487
1488
1489#else
1490#define CHECK_SYMBOL_TABLES()
1491#endif
1492
1493ZEND_API opcode_handler_t *zend_opcode_handlers;
1494
1495ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value TSRMLS_DC)
1496{
1497    execute_data->func->internal_function.handler(execute_data->num_args, return_value TSRMLS_CC);
1498}
1499
1500void zend_clean_and_cache_symbol_table(zend_array *symbol_table TSRMLS_DC) /* {{{ */
1501{
1502    if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
1503        zend_hash_destroy(&symbol_table->ht);
1504        FREE_HASHTABLE(symbol_table);
1505    } else {
1506        /* clean before putting into the cache, since clean
1507           could call dtors, which could use cached hash */
1508        zend_hash_clean(&symbol_table->ht);
1509        *(++EG(symtable_cache_ptr)) = symbol_table;
1510    }
1511}
1512/* }}} */
1513
1514static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data TSRMLS_DC) /* {{{ */
1515{
1516    if (EXPECTED(EX(func)->op_array.last_var > 0)) {
1517        zval *cv = EX_VAR_NUM(0);
1518        zval *end = cv + EX(func)->op_array.last_var;
1519        do {
1520            zval_ptr_dtor(cv);
1521            cv++;
1522        } while (cv != end);
1523    }
1524}
1525/* }}} */
1526
1527void zend_free_compiled_variables(zend_execute_data *execute_data TSRMLS_DC) /* {{{ */
1528{
1529    i_free_compiled_variables(execute_data TSRMLS_CC);
1530}
1531/* }}} */
1532
1533/*
1534 * Stack Frame Layout (the whole stack frame is allocated at once)
1535 * ==================
1536 *
1537 *                             +========================================+
1538 * EG(current_execute_data) -> | zend_execute_data                      |
1539 *                             +----------------------------------------+
1540 *     EX_CV_NUM(0) ---------> | VAR[0] = ARG[1]                        |
1541 *                             | ...                                    |
1542 *                             | VAR[op_array->num_args-1] = ARG[N]     |
1543 *                             | ...                                    |
1544 *                             | VAR[op_array->last_var-1]              |
1545 *                             | VAR[op_array->last_var] = TMP[0]       |
1546 *                             | ...                                    |
1547 *                             | VAR[op_array->last_var+op_array->T-1]  |
1548 *                             | ARG[N+1] (extra_args)                  |
1549 *                             | ...                                    |
1550 *                             +----------------------------------------+
1551 */
1552
1553static zend_always_inline void i_init_func_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value, vm_frame_kind frame_kind TSRMLS_DC) /* {{{ */
1554{
1555    zend_uint first_extra_arg;
1556    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
1557    ZEND_ASSERT(EX(object) == Z_OBJ(EG(This)));
1558
1559    EX(return_value) = return_value;
1560    EX(frame_kind) = frame_kind;
1561    ZVAL_UNDEF(&EX(old_error_reporting));
1562    EX(delayed_exception) = NULL;
1563    EX(call) = NULL;
1564
1565    EX(opline) = op_array->opcodes;
1566    if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
1567        /* Skip useless ZEND_RECV opcodes */
1568        EX(opline) += MIN(EX(num_args), op_array->required_num_args);
1569    }
1570    EX(scope) = EG(scope);
1571
1572    first_extra_arg = op_array->num_args;
1573
1574    if (UNEXPECTED((op_array->fn_flags & ZEND_ACC_VARIADIC) != 0)) {
1575        first_extra_arg--;
1576    }
1577    if (UNEXPECTED(EX(num_args) > first_extra_arg)) {
1578        /* move extra args into separate array after all CV and TMP vars */
1579        zval *extra_args = EX_VAR_NUM(op_array->last_var + op_array->T);
1580
1581        memmove(extra_args, EX_VAR_NUM(first_extra_arg), sizeof(zval) * (EX(num_args) - first_extra_arg));
1582    }
1583
1584    do {
1585        /* Initialize CV variables (skip arguments) */
1586        int num_args = MIN(op_array->num_args, EX(num_args));
1587
1588        if (EXPECTED(num_args < op_array->last_var)) {
1589            zval *var = EX_VAR_NUM(num_args);
1590            zval *end = EX_VAR_NUM(op_array->last_var);
1591
1592            do {
1593                ZVAL_UNDEF(var);
1594                var++;
1595            } while (var != end);
1596        }
1597    } while (0);
1598
1599    if (op_array->this_var != -1 && EX(object)) {
1600        ZVAL_OBJ(EX_VAR(op_array->this_var), EX(object));
1601        GC_REFCOUNT(EX(object))++;
1602    }
1603
1604    if (!op_array->run_time_cache && op_array->last_cache_slot) {
1605        if (op_array->function_name) {
1606            op_array->run_time_cache = zend_arena_calloc(&CG(arena), op_array->last_cache_slot, sizeof(void*));
1607        } else {
1608            op_array->run_time_cache = ecalloc(op_array->last_cache_slot, sizeof(void*));
1609        }
1610    }
1611    EX(run_time_cache) = op_array->run_time_cache;
1612
1613    EG(current_execute_data) = execute_data;
1614}
1615/* }}} */
1616
1617static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value, vm_frame_kind frame_kind TSRMLS_DC) /* {{{ */
1618{
1619    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
1620    ZEND_ASSERT(EX(object) == Z_OBJ(EG(This)));
1621
1622    EX(return_value) = return_value;
1623    EX(frame_kind) = frame_kind;
1624    ZVAL_UNDEF(&EX(old_error_reporting));
1625    EX(delayed_exception) = NULL;
1626    EX(call) = NULL;
1627
1628    EX(opline) = UNEXPECTED((op_array->fn_flags & ZEND_ACC_INTERACTIVE) != 0) && EG(start_op) ? EG(start_op) : op_array->opcodes;
1629    EX(scope) = EG(scope);
1630
1631    zend_attach_symbol_table(execute_data);
1632
1633    if (!op_array->run_time_cache && op_array->last_cache_slot) {
1634        if (op_array->function_name) {
1635            op_array->run_time_cache = zend_arena_calloc(&CG(arena), op_array->last_cache_slot, sizeof(void*));
1636        } else {
1637            op_array->run_time_cache = ecalloc(op_array->last_cache_slot, sizeof(void*));
1638        }
1639    }
1640    EX(run_time_cache) = op_array->run_time_cache;
1641
1642    EG(current_execute_data) = execute_data;
1643}
1644/* }}} */
1645
1646static zend_always_inline void i_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value, vm_frame_kind frame_kind TSRMLS_DC) /* {{{ */
1647{
1648    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
1649    ZEND_ASSERT(EX(object) == Z_OBJ(EG(This)));
1650
1651    EX(return_value) = return_value;
1652    EX(frame_kind) = frame_kind;
1653    ZVAL_UNDEF(&EX(old_error_reporting));
1654    EX(delayed_exception) = NULL;
1655    EX(call) = NULL;
1656
1657    EX(opline) = UNEXPECTED((op_array->fn_flags & ZEND_ACC_INTERACTIVE) != 0) && EG(start_op) ? EG(start_op) : op_array->opcodes;
1658    EX(scope) = EG(scope);
1659
1660    if (UNEXPECTED(EX(symbol_table) != NULL)) {
1661        zend_attach_symbol_table(execute_data);
1662    } else {
1663        zend_uint first_extra_arg = op_array->num_args;
1664
1665        if (UNEXPECTED((op_array->fn_flags & ZEND_ACC_VARIADIC) != 0)) {
1666            first_extra_arg--;
1667        }
1668        if (UNEXPECTED(EX(num_args) > first_extra_arg)) {
1669            /* move extra args into separate array after all CV and TMP vars */
1670            zval *extra_args = EX_VAR_NUM(op_array->last_var + op_array->T);
1671
1672            memmove(extra_args, EX_VAR_NUM(first_extra_arg), sizeof(zval) * (EX(num_args) - first_extra_arg));
1673        }
1674
1675        do {
1676            /* Initialize CV variables (skip arguments) */
1677            int num_args = MIN(op_array->num_args, EX(num_args));
1678
1679            if (EXPECTED(num_args < op_array->last_var)) {
1680                zval *var = EX_VAR_NUM(num_args);
1681                zval *end = EX_VAR_NUM(op_array->last_var);
1682
1683                do {
1684                    ZVAL_UNDEF(var);
1685                    var++;
1686                } while (var != end);
1687            }
1688        } while (0);
1689
1690        if (op_array->this_var != -1 && EX(object)) {
1691            ZVAL_OBJ(EX_VAR(op_array->this_var), EX(object));
1692            GC_REFCOUNT(EX(object))++;
1693        }
1694    }
1695
1696    if (!op_array->run_time_cache && op_array->last_cache_slot) {
1697        if (op_array->function_name) {
1698            op_array->run_time_cache = zend_arena_calloc(&CG(arena), op_array->last_cache_slot, sizeof(void*));
1699        } else {
1700            op_array->run_time_cache = ecalloc(op_array->last_cache_slot, sizeof(void*));
1701        }
1702    }
1703    EX(run_time_cache) = op_array->run_time_cache;
1704
1705    EG(current_execute_data) = execute_data;
1706}
1707/* }}} */
1708
1709ZEND_API zend_execute_data *zend_create_generator_execute_data(zend_execute_data *call, zend_op_array *op_array, zval *return_value TSRMLS_DC) /* {{{ */
1710{
1711    /*
1712     * Normally the execute_data is allocated on the VM stack (because it does
1713     * not actually do any allocation and thus is faster). For generators
1714     * though this behavior would be suboptimal, because the (rather large)
1715     * structure would have to be copied back and forth every time execution is
1716     * suspended or resumed. That's why for generators the execution context
1717     * is allocated using a separate VM stack, thus allowing to save and
1718     * restore it simply by replacing a pointer.
1719     */
1720    zend_execute_data *execute_data;
1721    zend_uint num_args = call->num_args;
1722
1723    EG(argument_stack) = zend_vm_stack_new_page(
1724        MAX(ZEND_VM_STACK_PAGE_SIZE,
1725            ZEND_CALL_FRAME_SLOT + MAX(op_array->last_var + op_array->T, num_args)));
1726    EG(argument_stack)->prev = NULL;
1727
1728    execute_data = zend_vm_stack_push_call_frame(
1729        (zend_function*)op_array,
1730        num_args,
1731        call->flags,
1732        call->called_scope,
1733        call->object,
1734        NULL TSRMLS_CC);
1735    EX(num_args) = num_args;
1736
1737    /* copy arguments */
1738    if (num_args > 0) {
1739        zval *arg_src = ZEND_CALL_ARG(call, 1);
1740        zval *arg_dst = ZEND_CALL_ARG(execute_data, 1);
1741        int i;
1742
1743        for (i = 0; i < num_args; i++) {
1744            ZVAL_COPY_VALUE(arg_dst + i, arg_src + i);
1745        }
1746    }
1747
1748    EX(symbol_table) = NULL;
1749
1750    i_init_func_execute_data(execute_data, op_array, return_value, VM_FRAME_TOP_FUNCTION TSRMLS_CC);
1751
1752    return execute_data;
1753}
1754/* }}} */
1755
1756ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value, vm_frame_kind frame_kind TSRMLS_DC) /* {{{ */
1757{
1758    EX(prev_execute_data) = EG(current_execute_data);
1759    i_init_execute_data(execute_data, op_array, return_value, frame_kind TSRMLS_CC);
1760}
1761/* }}} */
1762
1763static zend_always_inline zend_bool zend_is_by_ref_func_arg_fetch(zend_op *opline, zend_execute_data *call TSRMLS_DC) /* {{{ */
1764{
1765    zend_uint arg_num = opline->extended_value & ZEND_FETCH_ARG_MASK;
1766    return ARG_SHOULD_BE_SENT_BY_REF(call->func, arg_num);
1767}
1768/* }}} */
1769
1770static zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, zend_uint passed_args, zend_uint additional_args TSRMLS_DC) /* {{{ */
1771{
1772    zend_execute_data *new_call;
1773    int used_stack = (EG(argument_stack)->top - (zval*)call) + additional_args;
1774
1775    /* copy call frame into new stack segment */
1776    zend_vm_stack_extend(used_stack TSRMLS_CC);
1777    new_call = (zend_execute_data*)EG(argument_stack)->top;
1778    EG(argument_stack)->top += used_stack;
1779    *new_call = *call;
1780    if (passed_args) {
1781        zval *src = ZEND_CALL_ARG(call, 1);
1782        zval *dst = ZEND_CALL_ARG(new_call, 1);
1783        do {
1784            ZVAL_COPY_VALUE(dst, src);
1785            passed_args--;
1786            src++;
1787            dst++;
1788        } while (passed_args);
1789    }
1790
1791    /* delete old call_frame from previous stack segment */
1792    EG(argument_stack)->prev->top = (zval*)call;
1793
1794    /* delete previous stack segment if it becames empty */
1795    if (UNEXPECTED(EG(argument_stack)->prev->top == ZEND_VM_STACK_ELEMETS(EG(argument_stack)->prev))) {
1796        zend_vm_stack r = EG(argument_stack)->prev;
1797
1798        EG(argument_stack)->prev = r->prev;
1799        efree(r);
1800    }
1801
1802    return new_call;
1803}
1804/* }}} */
1805
1806static zend_always_inline void zend_vm_stack_extend_call_frame(zend_execute_data **call, zend_uint passed_args, zend_uint additional_args TSRMLS_DC) /* {{{ */
1807{
1808    if (EXPECTED(EG(argument_stack)->end - EG(argument_stack)->top > additional_args)) {
1809        EG(argument_stack)->top += additional_args;
1810    } else {
1811        *call = zend_vm_stack_copy_call_frame(*call, passed_args, additional_args TSRMLS_CC);
1812    }
1813}
1814/* }}} */
1815
1816#define ZEND_VM_NEXT_OPCODE() \
1817    CHECK_SYMBOL_TABLES() \
1818    ZEND_VM_INC_OPCODE(); \
1819    ZEND_VM_CONTINUE()
1820
1821#define ZEND_VM_SET_OPCODE(new_op) \
1822    CHECK_SYMBOL_TABLES() \
1823    OPLINE = new_op
1824
1825#define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
1826    CHECK_SYMBOL_TABLES() \
1827    OPLINE = ((zend_op*)(((char*)opline)+(offset)))
1828
1829#define ZEND_VM_JMP(new_op) \
1830    if (EXPECTED(!EG(exception))) { \
1831        ZEND_VM_SET_OPCODE(new_op); \
1832    } else { \
1833        LOAD_OPLINE(); \
1834    } \
1835    ZEND_VM_CONTINUE()
1836
1837#define ZEND_VM_INC_OPCODE() \
1838    OPLINE++
1839
1840#ifdef __GNUC__
1841# define ZEND_VM_GUARD(name) __asm__("#" #name)
1842#else
1843# define ZEND_VM_GUARD(name)
1844#endif
1845
1846#include "zend_vm_execute.h"
1847
1848ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
1849{
1850    if (opcode != ZEND_USER_OPCODE) {
1851        if (handler == NULL) {
1852            /* restore the original handler */
1853            zend_user_opcodes[opcode] = opcode;
1854        } else {
1855            zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
1856        }
1857        zend_user_opcode_handlers[opcode] = handler;
1858        return SUCCESS;
1859    }
1860    return FAILURE;
1861}
1862
1863ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
1864{
1865    return zend_user_opcode_handlers[opcode];
1866}
1867
1868ZEND_API zval *zend_get_zval_ptr(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type TSRMLS_DC) {
1869    return get_zval_ptr(op_type, node, execute_data, should_free, type);
1870}
1871
1872/*
1873 * Local variables:
1874 * tab-width: 4
1875 * c-basic-offset: 4
1876 * indent-tabs-mode: t
1877 * End:
1878 */
1879