1/*
2   +----------------------------------------------------------------------+
3   | Zend Engine                                                          |
4   +----------------------------------------------------------------------+
5   | Copyright (c) 1998-2015 Zend Technologies Ltd. (http://www.zend.com) |
6   +----------------------------------------------------------------------+
7   | This source file is subject to version 2.00 of the Zend license,     |
8   | that is bundled with this package in the file LICENSE, and is        |
9   | available through the world-wide-web at the following url:           |
10   | http://www.zend.com/license/2_00.txt.                                |
11   | If you did not receive a copy of the Zend license and are unable to  |
12   | obtain it through the world-wide-web, please send a note to          |
13   | license@zend.com so we can mail you a copy immediately.              |
14   +----------------------------------------------------------------------+
15   | Authors: Andi Gutmans <andi@zend.com>                                |
16   |          Zeev Suraski <zeev@zend.com>                                |
17   +----------------------------------------------------------------------+
18*/
19
20/* $Id$ */
21
22#define ZEND_INTENSIVE_DEBUGGING 0
23
24#include <stdio.h>
25#include <signal.h>
26
27#include "zend.h"
28#include "zend_compile.h"
29#include "zend_execute.h"
30#include "zend_API.h"
31#include "zend_ptr_stack.h"
32#include "zend_constants.h"
33#include "zend_extensions.h"
34#include "zend_ini.h"
35#include "zend_exceptions.h"
36#include "zend_interfaces.h"
37#include "zend_closures.h"
38#include "zend_generators.h"
39#include "zend_vm.h"
40#include "zend_dtrace.h"
41#include "zend_inheritance.h"
42
43/* Virtual current working directory support */
44#include "zend_virtual_cwd.h"
45
46#define _CONST_CODE  0
47#define _TMP_CODE    1
48#define _VAR_CODE    2
49#define _UNUSED_CODE 3
50#define _CV_CODE     4
51
52typedef int (ZEND_FASTCALL *incdec_t)(zval *);
53
54#define get_zval_ptr(op_type, node, ex, should_free, type) _get_zval_ptr(op_type, node, ex, should_free, type)
55#define get_zval_ptr_deref(op_type, node, ex, should_free, type) _get_zval_ptr_deref(op_type, node, ex, should_free, type)
56#define get_zval_ptr_undef(op_type, node, ex, should_free, type) _get_zval_ptr_undef(op_type, node, ex, should_free, type)
57#define get_zval_ptr_ptr(op_type, node, ex, should_free, type) _get_zval_ptr_ptr(op_type, node, ex, should_free, type)
58#define get_zval_ptr_ptr_undef(op_type, node, ex, should_free, type) _get_zval_ptr_ptr(op_type, node, ex, should_free, type)
59#define get_obj_zval_ptr(op_type, node, ex, should_free, type) _get_obj_zval_ptr(op_type, node, ex, should_free, type)
60#define get_obj_zval_ptr_undef(op_type, node, ex, should_free, type) _get_obj_zval_ptr_undef(op_type, node, ex, should_free, type)
61#define get_obj_zval_ptr_ptr(op_type, node, ex, should_free, type) _get_obj_zval_ptr_ptr(op_type, node, ex, should_free, type)
62
63/* Prototypes */
64static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array);
65static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array);
66static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array);
67
68#define RETURN_VALUE_USED(opline) (!((opline)->result_type & EXT_TYPE_UNUSED))
69
70static ZEND_FUNCTION(pass)
71{
72}
73
74static const zend_internal_function zend_pass_function = {
75    ZEND_INTERNAL_FUNCTION, /* type              */
76    {0, 0, 0},              /* arg_flags         */
77    0,                      /* fn_flags          */
78    NULL,                   /* name              */
79    NULL,                   /* scope             */
80    NULL,                   /* prototype         */
81    0,                      /* num_args          */
82    0,                      /* required_num_args */
83    NULL,                   /* arg_info          */
84    ZEND_FN(pass),          /* handler           */
85    NULL                    /* module            */
86};
87
88#undef zval_ptr_dtor
89#define zval_ptr_dtor(zv) i_zval_ptr_dtor(zv ZEND_FILE_LINE_CC)
90
91#define PZVAL_LOCK(z) if (Z_REFCOUNTED_P(z)) Z_ADDREF_P((z))
92#define SELECTIVE_PZVAL_LOCK(pzv, opline)   if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(pzv); }
93
94#define READY_TO_DESTROY(zv) \
95    (zv && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1)
96
97#define EXTRACT_ZVAL_PTR(zv) do {                       \
98        zval *__zv = (zv);                              \
99        if (Z_TYPE_P(__zv) == IS_INDIRECT) {            \
100            ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));        \
101        }                                               \
102    } while (0)
103
104#define FREE_OP(should_free) \
105    if (should_free) { \
106        zval_ptr_dtor_nogc(should_free); \
107    }
108
109#define FREE_UNFETCHED_OP(type, var) \
110    if ((type) & (IS_TMP_VAR|IS_VAR)) { \
111        zval_ptr_dtor_nogc(EX_VAR(var)); \
112    }
113
114#define FREE_OP_VAR_PTR(should_free) \
115    if (should_free) { \
116        zval_ptr_dtor_nogc(should_free); \
117    }
118
119/* End of zend_execute_locks.h */
120
121#define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
122
123#define CTOR_CALL_BIT    0x1
124#define CTOR_USED_BIT    0x2
125
126#define IS_CTOR_CALL(ce) (((zend_uintptr_t)(ce)) & CTOR_CALL_BIT)
127#define IS_CTOR_USED(ce) (((zend_uintptr_t)(ce)) & CTOR_USED_BIT)
128
129#define ENCODE_CTOR(ce, used) \
130    ((zend_class_entry*)(((zend_uintptr_t)(ce)) | CTOR_CALL_BIT | ((used) ? CTOR_USED_BIT : 0)))
131#define DECODE_CTOR(ce) \
132    ((zend_class_entry*)(((zend_uintptr_t)(ce)) & ~(CTOR_CALL_BIT|CTOR_USED_BIT)))
133
134#define ZEND_VM_MAIN_STACK_PAGE_SLOTS (16 * 1024) /* should be a power of 2 */
135#define ZEND_VM_GENERATOR_STACK_PAGE_SLOTS (256)
136
137#define ZEND_VM_STACK_PAGE_SLOTS(gen) ((gen) ? ZEND_VM_GENERATOR_STACK_PAGE_SLOTS : ZEND_VM_MAIN_STACK_PAGE_SLOTS)
138
139#define ZEND_VM_STACK_PAGE_SIZE(gen)  (ZEND_VM_STACK_PAGE_SLOTS(gen) * sizeof(zval))
140
141#define ZEND_VM_STACK_FREE_PAGE_SIZE(gen) \
142    ((ZEND_VM_STACK_PAGE_SLOTS(gen) - ZEND_VM_STACK_HEADER_SLOTS) * sizeof(zval))
143
144#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(gen, size) \
145    (((size) + (ZEND_VM_STACK_FREE_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1))
146
147static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
148    zend_vm_stack page = (zend_vm_stack)emalloc(size);
149
150    page->top = ZEND_VM_STACK_ELEMETS(page);
151    page->end = (zval*)((char*)page + size);
152    page->prev = prev;
153    return page;
154}
155
156ZEND_API void zend_vm_stack_init(void)
157{
158    EG(vm_stack) = zend_vm_stack_new_page(ZEND_VM_STACK_PAGE_SIZE(0 /* main stack */), NULL);
159    EG(vm_stack)->top++;
160    EG(vm_stack_top) = EG(vm_stack)->top;
161    EG(vm_stack_end) = EG(vm_stack)->end;
162}
163
164ZEND_API void zend_vm_stack_destroy(void)
165{
166    zend_vm_stack stack = EG(vm_stack);
167
168    while (stack != NULL) {
169        zend_vm_stack p = stack->prev;
170        efree(stack);
171        stack = p;
172    }
173}
174
175ZEND_API void* zend_vm_stack_extend(size_t size)
176{
177    zend_vm_stack stack;
178    void *ptr;
179
180    stack = EG(vm_stack);
181    stack->top = EG(vm_stack_top);
182    EG(vm_stack) = stack = zend_vm_stack_new_page(
183        EXPECTED(size < ZEND_VM_STACK_FREE_PAGE_SIZE(0)) ?
184            ZEND_VM_STACK_PAGE_SIZE(0) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(0, size),
185        stack);
186    ptr = stack->top;
187    EG(vm_stack_top) = (void*)(((char*)ptr) + size);
188    EG(vm_stack_end) = stack->end;
189    return ptr;
190}
191
192ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, uint32_t var)
193{
194    return EX_VAR(var);
195}
196
197static zend_always_inline zval *_get_zval_ptr_tmp(uint32_t var, const zend_execute_data *execute_data, zend_free_op *should_free)
198{
199    zval *ret = EX_VAR(var);
200    *should_free = ret;
201
202    ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
203
204    return ret;
205}
206
207static zend_always_inline zval *_get_zval_ptr_var(uint32_t var, const zend_execute_data *execute_data, zend_free_op *should_free)
208{
209    zval *ret = EX_VAR(var);
210
211    *should_free = ret;
212    return ret;
213}
214
215static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var, const zend_execute_data *execute_data, zend_free_op *should_free)
216{
217    zval *ret = EX_VAR(var);
218
219    *should_free = ret;
220    ZVAL_DEREF(ret);
221    return ret;
222}
223
224static zend_never_inline zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type, const zend_execute_data *execute_data)
225{
226    zend_string *cv;
227
228    switch (type) {
229        case BP_VAR_R:
230        case BP_VAR_UNSET:
231            cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
232            zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
233            /* break missing intentionally */
234        case BP_VAR_IS:
235            ptr = &EG(uninitialized_zval);
236            break;
237        case BP_VAR_RW:
238            cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
239            zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
240            /* break missing intentionally */
241        case BP_VAR_W:
242            ZVAL_NULL(ptr);
243            break;
244    }
245    return ptr;
246}
247
248static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_R(zval *ptr, uint32_t var, const zend_execute_data *execute_data)
249{
250    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
251
252    zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
253    return &EG(uninitialized_zval);
254}
255
256static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_UNSET(zval *ptr, uint32_t var, const zend_execute_data *execute_data)
257{
258    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
259
260    zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
261    return &EG(uninitialized_zval);
262}
263
264static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_RW(zval *ptr, uint32_t var, const zend_execute_data *execute_data)
265{
266    zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
267
268    ZVAL_NULL(ptr);
269    zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
270    return ptr;
271}
272
273static zend_always_inline zval *_get_zval_cv_lookup_BP_VAR_W(zval *ptr, uint32_t var, const zend_execute_data *execute_data)
274{
275    ZVAL_NULL(ptr);
276    return ptr;
277}
278
279static zend_always_inline zval *_get_zval_ptr_cv(const zend_execute_data *execute_data, uint32_t var, int type)
280{
281    zval *ret = EX_VAR(var);
282
283    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
284        return _get_zval_cv_lookup(ret, var, type, execute_data);
285    }
286    return ret;
287}
288
289static zend_always_inline zval *_get_zval_ptr_cv_undef(const zend_execute_data *execute_data, uint32_t var)
290{
291    return EX_VAR(var);
292}
293
294static zend_always_inline zval *_get_zval_ptr_cv_deref(const zend_execute_data *execute_data, uint32_t var, int type)
295{
296    zval *ret = EX_VAR(var);
297
298    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
299        return _get_zval_cv_lookup(ret, var, type, execute_data);
300    }
301    ZVAL_DEREF(ret);
302    return ret;
303}
304
305static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(const zend_execute_data *execute_data, uint32_t var)
306{
307    zval *ret = EX_VAR(var);
308
309    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
310        return _get_zval_cv_lookup_BP_VAR_R(ret, var, execute_data);
311    }
312    return ret;
313}
314
315static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(const zend_execute_data *execute_data, uint32_t var)
316{
317    zval *ret = EX_VAR(var);
318
319    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
320        return _get_zval_cv_lookup_BP_VAR_R(ret, var, execute_data);
321    }
322    ZVAL_DEREF(ret);
323    return ret;
324}
325
326static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_UNSET(const zend_execute_data *execute_data, uint32_t var)
327{
328    zval *ret = EX_VAR(var);
329
330    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
331        return _get_zval_cv_lookup_BP_VAR_UNSET(ret, var, execute_data);
332    }
333    return ret;
334}
335
336static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_UNSET(const zend_execute_data *execute_data, uint32_t var)
337{
338    zval *ret = EX_VAR(var);
339
340    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
341        return _get_zval_cv_lookup_BP_VAR_UNSET(ret, var, execute_data);
342    }
343    ZVAL_DEREF(ret);
344    return ret;
345}
346
347static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(const zend_execute_data *execute_data, uint32_t var)
348{
349    zval *ret = EX_VAR(var);
350
351    return ret;
352}
353
354static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_IS(const zend_execute_data *execute_data, uint32_t var)
355{
356    zval *ret = EX_VAR(var);
357
358    ZVAL_DEREF(ret);
359    return ret;
360}
361
362static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(const zend_execute_data *execute_data, uint32_t var)
363{
364    zval *ret = EX_VAR(var);
365
366    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
367        return _get_zval_cv_lookup_BP_VAR_RW(ret, var, execute_data);
368    }
369    return ret;
370}
371
372static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_RW(const zend_execute_data *execute_data, uint32_t var)
373{
374    zval *ret = EX_VAR(var);
375
376    if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
377        return _get_zval_cv_lookup_BP_VAR_RW(ret, var, execute_data);
378    }
379    ZVAL_DEREF(ret);
380    return ret;
381}
382
383static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(const zend_execute_data *execute_data, uint32_t var)
384{
385    zval *ret = EX_VAR(var);
386
387    if (Z_TYPE_P(ret) == IS_UNDEF) {
388        return _get_zval_cv_lookup_BP_VAR_W(ret, var, execute_data);
389    }
390    return ret;
391}
392
393static zend_always_inline zval *_get_zval_ptr_cv_undef_BP_VAR_W(const zend_execute_data *execute_data, uint32_t var)
394{
395    return EX_VAR(var);
396}
397
398static zend_always_inline zval *_get_zval_ptr_cv_undef_BP_VAR_RW(const zend_execute_data *execute_data, uint32_t var)
399{
400    return EX_VAR(var);
401}
402
403static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_W(const zend_execute_data *execute_data, uint32_t var)
404{
405    zval *ret = EX_VAR(var);
406
407    if (Z_TYPE_P(ret) == IS_UNDEF) {
408        return _get_zval_cv_lookup_BP_VAR_W(ret, var, execute_data);
409    }
410    ZVAL_DEREF(ret);
411    return ret;
412}
413
414static zend_always_inline zval *_get_zval_ptr(int op_type, znode_op node, const zend_execute_data *execute_data, zend_free_op *should_free, int type)
415{
416    if (op_type & (IS_TMP_VAR|IS_VAR)) {
417        if (op_type == IS_TMP_VAR) {
418            return _get_zval_ptr_tmp(node.var, execute_data, should_free);
419        } else {
420            ZEND_ASSERT(op_type == IS_VAR);
421            return _get_zval_ptr_var(node.var, execute_data, should_free);
422        }
423    } else {
424        *should_free = NULL;
425        if (op_type == IS_CONST) {
426            return EX_CONSTANT(node);
427        } else if (op_type == IS_CV) {
428            return _get_zval_ptr_cv(execute_data, node.var, type);
429        } else {
430            return NULL;
431        }
432    }
433}
434
435static zend_always_inline zval *_get_zval_ptr_deref(int op_type, znode_op node, const zend_execute_data *execute_data, zend_free_op *should_free, int type)
436{
437    if (op_type & (IS_TMP_VAR|IS_VAR)) {
438        if (op_type == IS_TMP_VAR) {
439            return _get_zval_ptr_tmp(node.var, execute_data, should_free);
440        } else {
441            ZEND_ASSERT(op_type == IS_VAR);
442            return _get_zval_ptr_var_deref(node.var, execute_data, should_free);
443        }
444    } else {
445        *should_free = NULL;
446        if (op_type == IS_CONST) {
447            return EX_CONSTANT(node);
448        } else if (op_type == IS_CV) {
449            return _get_zval_ptr_cv_deref(execute_data, node.var, type);
450        } else {
451            return NULL;
452        }
453    }
454}
455
456static zend_always_inline zval *_get_zval_ptr_undef(int op_type, znode_op node, const zend_execute_data *execute_data, zend_free_op *should_free, int type)
457{
458    if (op_type & (IS_TMP_VAR|IS_VAR)) {
459        if (op_type == IS_TMP_VAR) {
460            return _get_zval_ptr_tmp(node.var, execute_data, should_free);
461        } else {
462            ZEND_ASSERT(op_type == IS_VAR);
463            return _get_zval_ptr_var(node.var, execute_data, should_free);
464        }
465    } else {
466        *should_free = NULL;
467        if (op_type == IS_CONST) {
468            return EX_CONSTANT(node);
469        } else if (op_type == IS_CV) {
470            return _get_zval_ptr_cv_undef(execute_data, node.var);
471        } else {
472            return NULL;
473        }
474    }
475}
476
477static zend_always_inline zval *_get_zval_ptr_ptr_var(uint32_t var, const zend_execute_data *execute_data, zend_free_op *should_free)
478{
479    zval *ret = EX_VAR(var);
480
481    if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
482        *should_free = NULL;
483        ret = Z_INDIRECT_P(ret);
484    } else if (!Z_REFCOUNTED_P(ret)) {
485        *should_free = ret; /* immutable array may be converted to regular */
486    } else if (Z_REFCOUNT_P(ret) == 1) {
487        *should_free = ret;
488    } else {
489        *should_free = NULL;
490        Z_DELREF_P(ret);
491    }
492    return ret;
493}
494
495static inline zval *_get_zval_ptr_ptr(int op_type, znode_op node, const zend_execute_data *execute_data, zend_free_op *should_free, int type)
496{
497    if (op_type == IS_CV) {
498        *should_free = NULL;
499        return _get_zval_ptr_cv(execute_data, node.var, type);
500    } else /* if (op_type == IS_VAR) */ {
501        ZEND_ASSERT(op_type == IS_VAR);
502        return _get_zval_ptr_ptr_var(node.var, execute_data, should_free);
503    }
504}
505
506static zend_always_inline zval *_get_obj_zval_ptr_unused(zend_execute_data *execute_data)
507{
508    return &EX(This);
509}
510
511static inline zval *_get_obj_zval_ptr(int op_type, znode_op op, zend_execute_data *execute_data, zend_free_op *should_free, int type)
512{
513    if (op_type == IS_UNUSED) {
514        *should_free = NULL;
515        return &EX(This);
516    }
517    return get_zval_ptr(op_type, op, execute_data, should_free, type);
518}
519
520static inline zval *_get_obj_zval_ptr_undef(int op_type, znode_op op, zend_execute_data *execute_data, zend_free_op *should_free, int type)
521{
522    if (op_type == IS_UNUSED) {
523        *should_free = NULL;
524        return &EX(This);
525    }
526    return get_zval_ptr_undef(op_type, op, execute_data, should_free, type);
527}
528
529static inline zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, zend_execute_data *execute_data, zend_free_op *should_free, int type)
530{
531    if (op_type == IS_UNUSED) {
532        *should_free = NULL;
533        return &EX(This);
534    }
535    return get_zval_ptr_ptr(op_type, node, execute_data, should_free, type);
536}
537
538static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
539{
540    zend_reference *ref;
541
542    if (EXPECTED(!Z_ISREF_P(value_ptr))) {
543        ZVAL_NEW_REF(value_ptr, value_ptr);
544    } else if (UNEXPECTED(variable_ptr == value_ptr)) {
545        return;
546    }
547
548    ref = Z_REF_P(value_ptr);
549    GC_REFCOUNT(ref)++;
550    zval_ptr_dtor(variable_ptr);
551    ZVAL_REF(variable_ptr, ref);
552}
553
554/* this should modify object only if it's empty */
555static inline int make_real_object(zval *object)
556{
557    if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
558        if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) {
559            /* nothing to destroy */
560        } else if (EXPECTED((Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0))) {
561            zval_ptr_dtor_nogc(object);
562        } else {
563            return 0;
564        }
565        object_init(object);
566        zend_error(E_WARNING, "Creating default object from empty value");
567    }
568    return 1;
569}
570
571ZEND_API char * zend_verify_internal_arg_class_kind(const zend_internal_arg_info *cur_arg_info, char **class_name, zend_class_entry **pce)
572{
573    zend_string *key;
574    ALLOCA_FLAG(use_heap);
575
576    ZSTR_ALLOCA_INIT(key, cur_arg_info->class_name, strlen(cur_arg_info->class_name), use_heap);
577    *pce = zend_fetch_class(key, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
578    ZSTR_ALLOCA_FREE(key, use_heap);
579
580    *class_name = (*pce) ? ZSTR_VAL((*pce)->name) : (char*)cur_arg_info->class_name;
581    if (*pce && (*pce)->ce_flags & ZEND_ACC_INTERFACE) {
582        return "implement interface ";
583    } else {
584        return "be an instance of ";
585    }
586}
587
588static zend_always_inline zend_class_entry* zend_verify_arg_class_kind(const zend_arg_info *cur_arg_info)
589{
590    return zend_fetch_class(cur_arg_info->class_name, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
591}
592
593ZEND_API void zend_verify_arg_error(const zend_function *zf, uint32_t arg_num, const char *need_msg, const char *need_kind, const char *given_msg, const char *given_kind, zval *arg)
594{
595    zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
596    const char *fname = ZSTR_VAL(zf->common.function_name);
597    const char *fsep;
598    const char *fclass;
599
600    if (zf->common.scope) {
601        fsep =  "::";
602        fclass = ZSTR_VAL(zf->common.scope->name);
603    } else {
604        fsep =  "";
605        fclass = "";
606    }
607
608    if (zf->common.type == ZEND_USER_FUNCTION) {
609        if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
610            zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given, called in %s on line %d",
611                    arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind,
612                    ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno);
613        } else {
614            zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind);
615        }
616    } else {
617        zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind);
618    }
619}
620
621static int is_null_constant(zval *default_value)
622{
623    if (Z_CONSTANT_P(default_value)) {
624        zval constant;
625
626        ZVAL_COPY_VALUE(&constant, default_value);
627        if (UNEXPECTED(zval_update_constant_ex(&constant, 0, NULL) != SUCCESS)) {
628            return 0;
629        }
630        if (Z_TYPE(constant) == IS_NULL) {
631            return 1;
632        }
633        zval_dtor(&constant);
634    }
635    return 0;
636}
637
638static zend_bool zend_verify_weak_scalar_type_hint(zend_uchar type_hint, zval *arg)
639{
640    switch (type_hint) {
641        case _IS_BOOL: {
642            zend_bool dest;
643
644            if (!zend_parse_arg_bool_weak(arg, &dest)) {
645                return 0;
646            }
647            zval_ptr_dtor(arg);
648            ZVAL_BOOL(arg, dest);
649            return 1;
650        }
651        case IS_LONG: {
652            zend_long dest;
653
654            if (!zend_parse_arg_long_weak(arg, &dest)) {
655                return 0;
656            }
657            zval_ptr_dtor(arg);
658            ZVAL_LONG(arg, dest);
659            return 1;
660        }
661        case IS_DOUBLE: {
662            double dest;
663
664            if (!zend_parse_arg_double_weak(arg, &dest)) {
665                return 0;
666            }
667            zval_ptr_dtor(arg);
668            ZVAL_DOUBLE(arg, dest);
669            return 1;
670        }
671        case IS_STRING: {
672            zend_string *dest;
673
674            /* on success "arg" is converted to IS_STRING */
675            if (!zend_parse_arg_str_weak(arg, &dest)) {
676                return 0;
677            }
678            return 1;
679        }
680        default:
681            return 0;
682    }
683}
684
685static zend_bool zend_verify_scalar_type_hint(zend_uchar type_hint, zval *arg, zend_bool strict)
686{
687    if (UNEXPECTED(strict)) {
688        /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
689        if (type_hint != IS_DOUBLE || Z_TYPE_P(arg) != IS_LONG) {
690            return 0;
691        }
692    } else if (UNEXPECTED(Z_TYPE_P(arg) == IS_NULL)) {
693        /* NULL may be accepted only by nullable hints (this is already checked) */
694        return 0;
695    }
696    return zend_verify_weak_scalar_type_hint(type_hint, arg);
697}
698
699static void zend_verify_internal_arg_type(zend_function *zf, uint32_t arg_num, zval *arg)
700{
701    zend_internal_arg_info *cur_arg_info;
702    char *need_msg, *class_name;
703    zend_class_entry *ce;
704
705    if (EXPECTED(arg_num <= zf->internal_function.num_args)) {
706        cur_arg_info = &zf->internal_function.arg_info[arg_num-1];
707    } else if (zf->internal_function.fn_flags & ZEND_ACC_VARIADIC) {
708        cur_arg_info = &zf->internal_function.arg_info[zf->internal_function.num_args];
709    } else {
710        return;
711    }
712
713    if (cur_arg_info->type_hint) {
714        ZVAL_DEREF(arg);
715        if (EXPECTED(cur_arg_info->type_hint == Z_TYPE_P(arg))) {
716            if (cur_arg_info->class_name) {
717                need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info*)cur_arg_info, &class_name, &ce);
718                if (!ce || !instanceof_function(Z_OBJCE_P(arg), ce)) {
719                    zend_verify_arg_error(zf, arg_num, need_msg, class_name, "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name), arg);
720                }
721            }
722        } else if (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null) {
723            if (cur_arg_info->class_name) {
724                need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info*)cur_arg_info, &class_name, &ce);
725                zend_verify_arg_error(zf, arg_num, need_msg, class_name, zend_zval_type_name(arg), "", arg);
726            } else if (cur_arg_info->type_hint == IS_CALLABLE) {
727                if (!zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL)) {
728                    zend_verify_arg_error(zf, arg_num, "be callable", "", zend_zval_type_name(arg), "", arg);
729                }
730            } else if (cur_arg_info->type_hint == _IS_BOOL &&
731                       EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
732                /* pass */
733            } else if (UNEXPECTED(!zend_verify_scalar_type_hint(cur_arg_info->type_hint, arg, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
734                zend_verify_arg_error(zf, arg_num, "be of the type ", zend_get_type_by_const(cur_arg_info->type_hint), zend_zval_type_name(arg), "", arg);
735            }
736        }
737    }
738}
739
740static zend_always_inline int zend_verify_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot)
741{
742    zend_arg_info *cur_arg_info;
743    char *need_msg;
744    zend_class_entry *ce;
745
746    if (EXPECTED(arg_num <= zf->common.num_args)) {
747        cur_arg_info = &zf->common.arg_info[arg_num-1];
748    } else if (UNEXPECTED(zf->common.fn_flags & ZEND_ACC_VARIADIC)) {
749        cur_arg_info = &zf->common.arg_info[zf->common.num_args];
750    } else {
751        return 1;
752    }
753
754    if (cur_arg_info->type_hint) {
755        ZVAL_DEREF(arg);
756        if (EXPECTED(cur_arg_info->type_hint == Z_TYPE_P(arg))) {
757            if (cur_arg_info->class_name) {
758                if (EXPECTED(*cache_slot)) {
759                    ce = (zend_class_entry*)*cache_slot;
760                } else {
761                    ce = zend_verify_arg_class_kind(cur_arg_info);
762                    if (UNEXPECTED(!ce)) {
763                        zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name), arg);
764                        return 0;
765                    }
766                    *cache_slot = (void*)ce;
767                }
768                if (UNEXPECTED(!instanceof_function(Z_OBJCE_P(arg), ce))) {
769                    need_msg =
770                        (ce->ce_flags & ZEND_ACC_INTERFACE) ?
771                        "implement interface " : "be an instance of ";
772                    zend_verify_arg_error(zf, arg_num, need_msg, ZSTR_VAL(ce->name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name), arg);
773                    return 0;
774                }
775            }
776        } else if (Z_TYPE_P(arg) != IS_NULL || !(cur_arg_info->allow_null || (default_value && is_null_constant(default_value)))) {
777            if (cur_arg_info->class_name) {
778                if (EXPECTED(*cache_slot)) {
779                    ce = (zend_class_entry*)*cache_slot;
780                } else {
781                    ce = zend_verify_arg_class_kind(cur_arg_info);
782                    if (UNEXPECTED(!ce)) {
783                        if (Z_TYPE_P(arg) == IS_OBJECT) {
784                            zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name), arg);
785                        } else {
786                            zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "", zend_zval_type_name(arg), arg);
787                        }
788                        return 0;
789                    }
790                    *cache_slot = (void*)ce;
791                }
792                need_msg =
793                    (ce->ce_flags & ZEND_ACC_INTERFACE) ?
794                    "implement interface " : "be an instance of ";
795                zend_verify_arg_error(zf, arg_num, need_msg, ZSTR_VAL(ce->name), zend_zval_type_name(arg), "", arg);
796                return 0;
797            } else if (cur_arg_info->type_hint == IS_CALLABLE) {
798                if (!zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL)) {
799                    zend_verify_arg_error(zf, arg_num, "be callable", "", zend_zval_type_name(arg), "", arg);
800                    return 0;
801                }
802            } else if (cur_arg_info->type_hint == _IS_BOOL &&
803                       EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
804                /* pass */
805            } else if (UNEXPECTED(!zend_verify_scalar_type_hint(cur_arg_info->type_hint, arg, ZEND_ARG_USES_STRICT_TYPES()))) {
806                zend_verify_arg_error(zf, arg_num, "be of the type ", zend_get_type_by_const(cur_arg_info->type_hint), zend_zval_type_name(arg), "", arg);
807                return 0;
808            }
809        }
810    }
811    return 1;
812}
813
814static zend_always_inline int zend_verify_missing_arg_type(zend_function *zf, uint32_t arg_num, void **cache_slot)
815{
816    zend_arg_info *cur_arg_info;
817    char *need_msg;
818    zend_class_entry *ce;
819
820    if (EXPECTED(arg_num <= zf->common.num_args)) {
821        cur_arg_info = &zf->common.arg_info[arg_num-1];
822    } else if (UNEXPECTED(zf->common.fn_flags & ZEND_ACC_VARIADIC)) {
823        cur_arg_info = &zf->common.arg_info[zf->common.num_args];
824    } else {
825        return 1;
826    }
827
828    if (cur_arg_info->type_hint) {
829        if (cur_arg_info->class_name) {
830            if (EXPECTED(*cache_slot)) {
831                ce = (zend_class_entry*)*cache_slot;
832            } else {
833                ce = zend_verify_arg_class_kind(cur_arg_info);
834                if (UNEXPECTED(!ce)) {
835                    zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "none", "", NULL);
836                    return 0;
837                }
838                *cache_slot = (void*)ce;
839            }
840            need_msg =
841                (ce->ce_flags & ZEND_ACC_INTERFACE) ?
842                "implement interface " : "be an instance of ";
843            zend_verify_arg_error(zf, arg_num, need_msg, ZSTR_VAL(ce->name), "none", "", NULL);
844        } else if (cur_arg_info->type_hint == IS_CALLABLE) {
845            zend_verify_arg_error(zf, arg_num, "be callable", "", "none", "", NULL);
846        } else {
847            zend_verify_arg_error(zf, arg_num, "be of the type ", zend_get_type_by_const(cur_arg_info->type_hint), "none", "", NULL);
848        }
849        return 0;
850    }
851    return 1;
852}
853
854static zend_always_inline int zend_verify_missing_arg(zend_execute_data *execute_data, uint32_t arg_num, void **cache_slot)
855{
856    if (EXPECTED(!(EX(func)->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS)) ||
857        zend_verify_missing_arg_type(EX(func), arg_num, cache_slot)) {
858        const char *class_name = EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "";
859        const char *space = EX(func)->common.scope ? "::" : "";
860        const char *func_name = EX(func)->common.function_name ? ZSTR_VAL(EX(func)->common.function_name) : "main";
861        zend_execute_data *ptr = EX(prev_execute_data);
862
863        if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
864            zend_error(E_WARNING, "Missing argument %u for %s%s%s(), called in %s on line %d and defined", arg_num, class_name, space, func_name, ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno);
865        } else {
866            zend_error(E_WARNING, "Missing argument %u for %s%s%s()", arg_num, class_name, space, func_name);
867        }
868        return 1;
869    }
870    return 0;
871}
872
873ZEND_API void zend_verify_return_error(const zend_function *zf, const char *need_msg, const char *need_kind, const char *returned_msg, const char *returned_kind)
874{
875    const char *fname = ZSTR_VAL(zf->common.function_name);
876    const char *fsep;
877    const char *fclass;
878
879    if (zf->common.scope) {
880        fsep =  "::";
881        fclass = ZSTR_VAL(zf->common.scope->name);
882    } else {
883        fsep =  "";
884        fclass = "";
885    }
886
887    if (zf->common.type == ZEND_USER_FUNCTION) {
888        zend_type_error("Return value of %s%s%s() must %s%s, %s%s returned in %s on line %d",
889            fclass, fsep, fname, need_msg, need_kind, returned_msg, returned_kind,
890            ZSTR_VAL(zf->op_array.filename), EG(current_execute_data)->opline->lineno);
891    } else {
892        zend_type_error("Return value of %s%s%s() must %s%s, %s%s returned",
893            fclass, fsep, fname, need_msg, need_kind, returned_msg, returned_kind);
894    }
895}
896
897ZEND_API void zend_verify_internal_return_error(const zend_function *zf, const char *need_msg, const char *need_kind, const char *returned_msg, const char *returned_kind)
898{
899    const char *fname = ZSTR_VAL(zf->common.function_name);
900    const char *fsep;
901    const char *fclass;
902
903    if (zf->common.scope) {
904        fsep =  "::";
905        fclass = ZSTR_VAL(zf->common.scope->name);
906    } else {
907        fsep =  "";
908        fclass = "";
909    }
910
911    zend_error_noreturn(E_CORE_ERROR, "Return value of %s%s%s() must %s%s, %s%s returned",
912        fclass, fsep, fname, need_msg, need_kind, returned_msg, returned_kind);
913}
914
915#if ZEND_DEBUG
916static int zend_verify_internal_return_type(zend_function *zf, zval *ret)
917{
918    zend_arg_info *ret_info = zf->common.arg_info - 1;
919    char *need_msg, *class_name;
920    zend_class_entry *ce;
921
922
923    if (ret_info->type_hint) {
924        if (EXPECTED(ret_info->type_hint == Z_TYPE_P(ret))) {
925            if (ret_info->class_name) {
926                need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info *)ret_info, &class_name, &ce);
927                if (!ce || !instanceof_function(Z_OBJCE_P(ret), ce)) {
928                    zend_verify_internal_return_error(zf, need_msg, class_name, "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
929                    return 0;
930                }
931            }
932        } else if (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null) {
933            if (ret_info->class_name) {
934                need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info *)ret_info, &class_name, &ce);
935                zend_verify_internal_return_error(zf, need_msg, class_name, zend_zval_type_name(ret), "");
936            } else if (ret_info->type_hint == IS_CALLABLE) {
937                if (!zend_is_callable(ret, IS_CALLABLE_CHECK_SILENT, NULL) && (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null)) {
938                    zend_verify_internal_return_error(zf, "be callable", "", zend_zval_type_name(ret), "");
939                    return 0;
940                }
941            } else if (ret_info->type_hint == _IS_BOOL &&
942                       EXPECTED(Z_TYPE_P(ret) == IS_FALSE || Z_TYPE_P(ret) == IS_TRUE)) {
943                /* pass */
944            } else {
945                /* Use strict check to verify return value of internal function */
946                zend_verify_internal_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), zend_zval_type_name(ret), "");
947                return 0;
948            }
949        }
950    }
951    return 1;
952}
953#endif
954
955static zend_always_inline void zend_verify_return_type(zend_function *zf, zval *ret, void **cache_slot)
956{
957    zend_arg_info *ret_info = zf->common.arg_info - 1;
958    char *need_msg;
959    zend_class_entry *ce;
960
961    if (ret_info->type_hint) {
962        if (EXPECTED(ret_info->type_hint == Z_TYPE_P(ret))) {
963            if (ret_info->class_name) {
964                if (EXPECTED(*cache_slot)) {
965                    ce = (zend_class_entry*)*cache_slot;
966                } else {
967                    ce = zend_verify_arg_class_kind(ret_info);
968                    if (UNEXPECTED(!ce)) {
969                        zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
970                        return;
971                    }
972                    *cache_slot = (void*)ce;
973                }
974                if (UNEXPECTED(!instanceof_function(Z_OBJCE_P(ret), ce))) {
975                    need_msg =
976                        (ce->ce_flags & ZEND_ACC_INTERFACE) ?
977                        "implement interface " : "be an instance of ";
978                    zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
979                }
980            }
981        } else if (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null) {
982            if (ret_info->class_name) {
983                if (EXPECTED(*cache_slot)) {
984                    ce = (zend_class_entry*)*cache_slot;
985                } else {
986                    ce = zend_verify_arg_class_kind(ret_info);
987                    if (UNEXPECTED(!ce)) {
988                        zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), zend_zval_type_name(ret), "");
989                        return;
990                    }
991                    *cache_slot = (void*)ce;
992                }
993                need_msg =
994                    (ce->ce_flags & ZEND_ACC_INTERFACE) ?
995                    "implement interface " : "be an instance of ";
996                zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), zend_zval_type_name(ret), "");
997            } else if (ret_info->type_hint == IS_CALLABLE) {
998                if (!zend_is_callable(ret, IS_CALLABLE_CHECK_SILENT, NULL)) {
999                    zend_verify_return_error(zf, "be callable", "", zend_zval_type_name(ret), "");
1000                }
1001            } else if (ret_info->type_hint == _IS_BOOL &&
1002                       EXPECTED(Z_TYPE_P(ret) == IS_FALSE || Z_TYPE_P(ret) == IS_TRUE)) {
1003                /* pass */
1004            } else if (UNEXPECTED(!zend_verify_scalar_type_hint(ret_info->type_hint, ret, ZEND_RET_USES_STRICT_TYPES()))) {
1005                zend_verify_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), zend_zval_type_name(ret), "");
1006            }
1007        }
1008    }
1009}
1010
1011static zend_always_inline int zend_verify_missing_return_type(zend_function *zf, void **cache_slot)
1012{
1013    zend_arg_info *ret_info = zf->common.arg_info - 1;
1014    char *need_msg;
1015    zend_class_entry *ce;
1016
1017    if (ret_info->type_hint) {
1018        if (ret_info->class_name) {
1019            if (EXPECTED(*cache_slot)) {
1020                ce = (zend_class_entry*)*cache_slot;
1021            } else {
1022                ce = zend_verify_arg_class_kind(ret_info);
1023                if (UNEXPECTED(!ce)) {
1024                    zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), "none", "");
1025                    return 0;
1026                }
1027                *cache_slot = (void*)ce;
1028            }
1029            need_msg =
1030                (ce->ce_flags & ZEND_ACC_INTERFACE) ?
1031                "implement interface " : "be an instance of ";
1032            zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), "none", "");
1033            return 0;
1034        } else if (ret_info->type_hint == IS_CALLABLE) {
1035            zend_verify_return_error(zf, "be callable", "", "none", "");
1036        } else {
1037            zend_verify_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), "none", "");
1038        }
1039        return 0;
1040    }
1041    return 1;
1042}
1043
1044static zend_always_inline void zend_assign_to_object(zval *retval, zval *object, uint32_t object_op_type, zval *property_name, uint32_t property_op_type, int value_type, znode_op value_op, const zend_execute_data *execute_data, void **cache_slot)
1045{
1046    zend_free_op free_value;
1047    zval *value = get_zval_ptr(value_type, value_op, execute_data, &free_value, BP_VAR_R);
1048    zval tmp;
1049
1050    if (object_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) {
1051        do {
1052            if (object_op_type == IS_VAR && UNEXPECTED(object == &EG(error_zval))) {
1053                if (retval) {
1054                    ZVAL_NULL(retval);
1055                }
1056                FREE_OP(free_value);
1057                return;
1058            }
1059            if (Z_ISREF_P(object)) {
1060                object = Z_REFVAL_P(object);
1061                if (EXPECTED(Z_TYPE_P(object) == IS_OBJECT)) {
1062                    break;
1063                }
1064            }
1065            if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE ||
1066                (Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0))) {
1067                zend_object *obj;
1068
1069                zval_ptr_dtor(object);
1070                object_init(object);
1071                Z_ADDREF_P(object);
1072                obj = Z_OBJ_P(object);
1073                zend_error(E_WARNING, "Creating default object from empty value");
1074                if (GC_REFCOUNT(obj) == 1) {
1075                    /* the enclosing container was deleted, obj is unreferenced */
1076                    if (retval) {
1077                        ZVAL_NULL(retval);
1078                    }
1079                    FREE_OP(free_value);
1080                    OBJ_RELEASE(obj);
1081                    return;
1082                }
1083                Z_DELREF_P(object);
1084            } else {
1085                zend_error(E_WARNING, "Attempt to assign property of non-object");
1086                if (retval) {
1087                    ZVAL_NULL(retval);
1088                }
1089                FREE_OP(free_value);
1090                return;
1091            }
1092        } while (0);
1093    }
1094
1095    if (property_op_type == IS_CONST &&
1096        EXPECTED(Z_OBJCE_P(object) == CACHED_PTR_EX(cache_slot))) {
1097        uint32_t prop_offset = (uint32_t)(intptr_t)CACHED_PTR_EX(cache_slot + 1);
1098        zend_object *zobj = Z_OBJ_P(object);
1099        zval *property;
1100
1101        if (EXPECTED(prop_offset != (uint32_t)ZEND_DYNAMIC_PROPERTY_OFFSET)) {
1102            property = OBJ_PROP(zobj, prop_offset);
1103            if (Z_TYPE_P(property) != IS_UNDEF) {
1104fast_assign:
1105                value = zend_assign_to_variable(property, value, value_type);
1106                if (retval && EXPECTED(!EG(exception))) {
1107                    ZVAL_COPY(retval, value);
1108                }
1109                return;
1110            }
1111        } else {
1112            if (EXPECTED(zobj->properties != NULL)) {
1113                property = zend_hash_find(zobj->properties, Z_STR_P(property_name));
1114                if (property) {
1115                    goto fast_assign;
1116                }
1117            }
1118
1119            if (!zobj->ce->__set) {
1120
1121                if (EXPECTED(zobj->properties == NULL)) {
1122                    rebuild_object_properties(zobj);
1123                }
1124                /* separate our value if necessary */
1125                if (value_type == IS_CONST) {
1126                    if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
1127                        ZVAL_COPY_VALUE(&tmp, value);
1128                        zval_copy_ctor_func(&tmp);
1129                        value = &tmp;
1130                    }
1131                } else if (value_type != IS_TMP_VAR) {
1132                    if (Z_ISREF_P(value)) {
1133                        if (value_type == IS_VAR) {
1134                            zend_reference *ref = Z_REF_P(value);
1135                            if (--(GC_REFCOUNT(ref)) == 0) {
1136                                ZVAL_COPY_VALUE(&tmp, Z_REFVAL_P(value));
1137                                efree_size(ref, sizeof(zend_reference));
1138                                value = &tmp;
1139                            } else {
1140                                value = Z_REFVAL_P(value);
1141                                if (Z_REFCOUNTED_P(value)) {
1142                                    Z_ADDREF_P(value);
1143                                }
1144                            }
1145                        } else {
1146                            value = Z_REFVAL_P(value);
1147                            if (Z_REFCOUNTED_P(value)) {
1148                                Z_ADDREF_P(value);
1149                            }
1150                        }
1151                    } else if (value_type == IS_CV && Z_REFCOUNTED_P(value)) {
1152                        Z_ADDREF_P(value);
1153                    }
1154                }
1155                zend_hash_add_new(zobj->properties, Z_STR_P(property_name), value);
1156                if (retval) {
1157                    ZVAL_COPY(retval, value);
1158                }
1159                return;
1160            }
1161        }
1162    }
1163
1164    if (!Z_OBJ_HT_P(object)->write_property) {
1165        zend_error(E_WARNING, "Attempt to assign property of non-object");
1166        if (retval) {
1167            ZVAL_NULL(retval);
1168        }
1169        FREE_OP(free_value);
1170        return;
1171    }
1172
1173    /* separate our value if necessary */
1174    if (value_type == IS_CONST) {
1175        if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
1176            ZVAL_COPY_VALUE(&tmp, value);
1177            zval_copy_ctor_func(&tmp);
1178            value = &tmp;
1179        }
1180    } else if (value_type != IS_TMP_VAR) {
1181        ZVAL_DEREF(value);
1182    }
1183
1184    Z_OBJ_HT_P(object)->write_property(object, property_name, value, cache_slot);
1185
1186    if (retval && EXPECTED(!EG(exception))) {
1187        ZVAL_COPY(retval, value);
1188    }
1189    if (value_type == IS_CONST) {
1190        zval_ptr_dtor_nogc(value);
1191    } else {
1192        FREE_OP(free_value);
1193    }
1194}
1195
1196static zend_never_inline void zend_assign_to_object_dim(zval *retval, zval *object, zval *property_name, int value_type, znode_op value_op, const zend_execute_data *execute_data)
1197{
1198    zend_free_op free_value;
1199    zval *value = get_zval_ptr_deref(value_type, value_op, execute_data, &free_value, BP_VAR_R);
1200    zval tmp;
1201
1202    /* Note:  property_name in this case is really the array index! */
1203    if (!Z_OBJ_HT_P(object)->write_dimension) {
1204        zend_error(E_EXCEPTION | E_ERROR, "Cannot use object as array");
1205        FREE_OP(free_value);
1206        return;
1207    }
1208
1209    /* separate our value if necessary */
1210    if (value_type == IS_CONST) {
1211        if (UNEXPECTED(Z_OPT_COPYABLE_P(value))) {
1212            ZVAL_COPY_VALUE(&tmp, value);
1213            zval_copy_ctor_func(&tmp);
1214            value = &tmp;
1215        }
1216    }
1217
1218    Z_OBJ_HT_P(object)->write_dimension(object, property_name, value);
1219
1220    if (retval && EXPECTED(!EG(exception))) {
1221        ZVAL_COPY(retval, value);
1222    }
1223    if (value_type == IS_CONST) {
1224        zval_ptr_dtor_nogc(value);
1225    } else {
1226        FREE_OP(free_value);
1227    }
1228}
1229
1230static zend_never_inline void zend_binary_assign_op_obj_dim(zval *object, zval *property, zval *value, zval *retval, binary_op_type binary_op)
1231{
1232    zval *z;
1233    zval rv, res;
1234
1235    if (Z_OBJ_HT_P(object)->read_dimension &&
1236        (z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R, &rv)) != NULL) {
1237
1238        if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
1239            zval rv2;
1240            zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1241
1242            if (z == &rv) {
1243                zval_ptr_dtor(&rv);
1244            }
1245            ZVAL_COPY_VALUE(z, value);
1246        }
1247        binary_op(&res, Z_ISREF_P(z) ? Z_REFVAL_P(z) : z, value);
1248        Z_OBJ_HT_P(object)->write_dimension(object, property, &res);
1249        if (z == &rv) {
1250            zval_ptr_dtor(&rv);
1251        }
1252        if (retval) {
1253            ZVAL_COPY(retval, &res);
1254        }
1255        zval_ptr_dtor(&res);
1256    } else {
1257        zend_error(E_WARNING, "Attempt to assign property of non-object");
1258        if (retval) {
1259            ZVAL_NULL(retval);
1260        }
1261    }
1262}
1263
1264static void zend_assign_to_string_offset(zval *str, zend_long offset, zval *value, zval *result)
1265{
1266    zend_string *old_str;
1267
1268    if (offset < 0) {
1269        zend_error(E_WARNING, "Illegal string offset:  " ZEND_LONG_FMT, offset);
1270        zend_string_release(Z_STR_P(str));
1271        if (result) {
1272            ZVAL_NULL(result);
1273        }
1274        return;
1275    }
1276
1277    old_str = Z_STR_P(str);
1278    if ((size_t)offset >= Z_STRLEN_P(str)) {
1279        zend_long old_len = Z_STRLEN_P(str);
1280        Z_STR_P(str) = zend_string_extend(Z_STR_P(str), offset + 1, 0);
1281        Z_TYPE_INFO_P(str) = IS_STRING_EX;
1282        memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
1283        Z_STRVAL_P(str)[offset+1] = 0;
1284    } else if (!Z_REFCOUNTED_P(str)) {
1285        Z_STR_P(str) = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
1286        Z_TYPE_INFO_P(str) = IS_STRING_EX;
1287    }
1288
1289    if (Z_TYPE_P(value) != IS_STRING) {
1290        zend_string *tmp = zval_get_string(value);
1291
1292        Z_STRVAL_P(str)[offset] = ZSTR_VAL(tmp)[0];
1293        zend_string_release(tmp);
1294    } else {
1295        Z_STRVAL_P(str)[offset] = Z_STRVAL_P(value)[0];
1296    }
1297    /*
1298     * the value of an assignment to a string offset is undefined
1299    T(result->u.var).var = &T->str_offset.str;
1300    */
1301
1302    zend_string_release(old_str);
1303    if (result) {
1304        zend_uchar c = (zend_uchar)Z_STRVAL_P(str)[offset];
1305
1306        if (CG(one_char_string)[c]) {
1307            ZVAL_INTERNED_STR(result, CG(one_char_string)[c]);
1308        } else {
1309            ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(str) + offset, 1, 0));
1310        }
1311    }
1312}
1313
1314static zend_never_inline void zend_post_incdec_overloaded_property(zval *object, zval *property, void **cache_slot, int inc, zval *result)
1315{
1316    if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
1317        zval rv, obj;
1318        zval *z;
1319        zval z_copy;
1320
1321        ZVAL_OBJ(&obj, Z_OBJ_P(object));
1322        Z_ADDREF(obj);
1323        z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
1324        if (UNEXPECTED(EG(exception))) {
1325            OBJ_RELEASE(Z_OBJ(obj));
1326            return;
1327        }
1328
1329        if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
1330            zval rv2;
1331            zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1332            if (z == &rv) {
1333                zval_ptr_dtor(&rv);
1334            }
1335            ZVAL_COPY_VALUE(z, value);
1336        }
1337        ZVAL_COPY(result, z);
1338        ZVAL_DUP(&z_copy, z);
1339        if (inc) {
1340            increment_function(&z_copy);
1341        } else {
1342            decrement_function(&z_copy);
1343        }
1344        if (Z_REFCOUNTED_P(z)) Z_ADDREF_P(z);
1345        Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot);
1346        OBJ_RELEASE(Z_OBJ(obj));
1347        zval_ptr_dtor(&z_copy);
1348        zval_ptr_dtor(z);
1349    } else {
1350        zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
1351        ZVAL_NULL(result);
1352    }
1353}
1354
1355static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object, zval *property, void **cache_slot, int inc, zval *result)
1356{
1357    zval rv;
1358
1359    if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
1360        zval *z, obj;
1361
1362        ZVAL_OBJ(&obj, Z_OBJ_P(object));
1363        Z_ADDREF(obj);
1364        z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
1365        if (UNEXPECTED(EG(exception))) {
1366            OBJ_RELEASE(Z_OBJ(obj));
1367            return;
1368        }
1369
1370        if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
1371            zval rv2;
1372            zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1373
1374            if (z == &rv) {
1375                zval_ptr_dtor(&rv);
1376            }
1377            ZVAL_COPY_VALUE(z, value);
1378        }
1379        ZVAL_DEREF(z);
1380        SEPARATE_ZVAL_NOREF(z);
1381        if (inc) {
1382            increment_function(z);
1383        } else {
1384            decrement_function(z);
1385        }
1386        if (UNEXPECTED(result)) {
1387            ZVAL_COPY(result, z);
1388        }
1389        Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
1390        OBJ_RELEASE(Z_OBJ(obj));
1391        zval_ptr_dtor(z);
1392    } else {
1393        zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
1394        if (UNEXPECTED(result)) {
1395            ZVAL_NULL(result);
1396        }
1397    }
1398}
1399
1400static zend_never_inline void zend_assign_op_overloaded_property(zval *object, zval *property, void **cache_slot, zval *value, binary_op_type binary_op, zval *result)
1401{
1402    zval *z;
1403    zval rv, obj;
1404    zval *zptr;
1405
1406    ZVAL_OBJ(&obj, Z_OBJ_P(object));
1407    Z_ADDREF(obj);
1408    if (Z_OBJ_HT(obj)->read_property &&
1409        (z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv)) != NULL) {
1410        if (UNEXPECTED(EG(exception))) {
1411            OBJ_RELEASE(Z_OBJ(obj));
1412            return;
1413        }
1414        if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
1415            zval rv2;
1416            zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1417
1418            if (z == &rv) {
1419                zval_ptr_dtor(&rv);
1420            }
1421            ZVAL_COPY_VALUE(z, value);
1422        }
1423        zptr = z;
1424        ZVAL_DEREF(z);
1425        SEPARATE_ZVAL_NOREF(z);
1426        binary_op(z, z, value);
1427        Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
1428        if (UNEXPECTED(result)) {
1429            ZVAL_COPY(result, z);
1430        }
1431        zval_ptr_dtor(zptr);
1432    } else {
1433        zend_error(E_WARNING, "Attempt to assign property of non-object");
1434        if (UNEXPECTED(result)) {
1435            ZVAL_NULL(result);
1436        }
1437    }
1438    OBJ_RELEASE(Z_OBJ(obj));
1439}
1440
1441/* Utility Functions for Extensions */
1442static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array)
1443{
1444    if (extension->statement_handler) {
1445        extension->statement_handler(op_array);
1446    }
1447}
1448
1449
1450static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array)
1451{
1452    if (extension->fcall_begin_handler) {
1453        extension->fcall_begin_handler(op_array);
1454    }
1455}
1456
1457
1458static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array)
1459{
1460    if (extension->fcall_end_handler) {
1461        extension->fcall_end_handler(op_array);
1462    }
1463}
1464
1465
1466static zend_always_inline HashTable *zend_get_target_symbol_table(zend_execute_data *execute_data, int fetch_type)
1467{
1468    HashTable *ht;
1469
1470    if (EXPECTED(fetch_type == ZEND_FETCH_GLOBAL_LOCK) ||
1471        EXPECTED(fetch_type == ZEND_FETCH_GLOBAL)) {
1472        ht = &EG(symbol_table);
1473    } else if (EXPECTED(fetch_type == ZEND_FETCH_STATIC)) {
1474        ZEND_ASSERT(EX(func)->op_array.static_variables != NULL);
1475        ht = EX(func)->op_array.static_variables;
1476        if (GC_REFCOUNT(ht) > 1) {
1477            if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
1478                GC_REFCOUNT(ht)--;
1479            }
1480            EX(func)->op_array.static_variables = ht = zend_array_dup(ht);
1481        }
1482    } else {
1483        ZEND_ASSERT(fetch_type == ZEND_FETCH_LOCAL);
1484        if (!EX(symbol_table)) {
1485            zend_rebuild_symbol_table();
1486        }
1487        ht = EX(symbol_table);
1488    }
1489    return ht;
1490}
1491
1492static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type)
1493{
1494    zval *retval;
1495    zend_string *offset_key;
1496    zend_ulong hval;
1497
1498try_again:
1499    if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1500        hval = Z_LVAL_P(dim);
1501num_index:
1502        retval = zend_hash_index_find(ht, hval);
1503        if (retval == NULL) {
1504            switch (type) {
1505                case BP_VAR_R:
1506                    zend_error(E_NOTICE,"Undefined offset: " ZEND_LONG_FMT, hval);
1507                    /* break missing intentionally */
1508                case BP_VAR_UNSET:
1509                case BP_VAR_IS:
1510                    retval = &EG(uninitialized_zval);
1511                    break;
1512                case BP_VAR_RW:
1513                    zend_error(E_NOTICE,"Undefined offset: " ZEND_LONG_FMT, hval);
1514                    /* break missing intentionally */
1515                case BP_VAR_W:
1516                    retval = zend_hash_index_add_new(ht, hval, &EG(uninitialized_zval));
1517                    break;
1518            }
1519        }
1520    } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
1521        offset_key = Z_STR_P(dim);
1522        if (dim_type != IS_CONST) {
1523            if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
1524                goto num_index;
1525            }
1526        }
1527str_index:
1528        retval = zend_hash_find(ht, offset_key);
1529        if (retval) {
1530            /* support for $GLOBALS[...] */
1531            if (UNEXPECTED(Z_TYPE_P(retval) == IS_INDIRECT)) {
1532                retval = Z_INDIRECT_P(retval);
1533                if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
1534                    switch (type) {
1535                        case BP_VAR_R:
1536                            zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset_key));
1537                            /* break missing intentionally */
1538                        case BP_VAR_UNSET:
1539                        case BP_VAR_IS:
1540                            retval = &EG(uninitialized_zval);
1541                            break;
1542                        case BP_VAR_RW:
1543                            zend_error(E_NOTICE,"Undefined index: %s", ZSTR_VAL(offset_key));
1544                            /* break missing intentionally */
1545                        case BP_VAR_W:
1546                            ZVAL_NULL(retval);
1547                            break;
1548                    }
1549                }
1550            }
1551        } else {
1552            switch (type) {
1553                case BP_VAR_R:
1554                    zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset_key));
1555                    /* break missing intentionally */
1556                case BP_VAR_UNSET:
1557                case BP_VAR_IS:
1558                    retval = &EG(uninitialized_zval);
1559                    break;
1560                case BP_VAR_RW:
1561                    zend_error(E_NOTICE,"Undefined index: %s", ZSTR_VAL(offset_key));
1562                    /* break missing intentionally */
1563                case BP_VAR_W:
1564                    retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
1565                    break;
1566            }
1567        }
1568    } else {
1569        switch (Z_TYPE_P(dim)) {
1570            case IS_NULL:
1571                offset_key = ZSTR_EMPTY_ALLOC();
1572                goto str_index;
1573            case IS_DOUBLE:
1574                hval = zend_dval_to_lval(Z_DVAL_P(dim));
1575                goto num_index;
1576            case IS_RESOURCE:
1577                zend_error(E_NOTICE, "Resource ID#%pd used as offset, casting to integer (%pd)", Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
1578                hval = Z_RES_HANDLE_P(dim);
1579                goto num_index;
1580            case IS_FALSE:
1581                hval = 0;
1582                goto num_index;
1583            case IS_TRUE:
1584                hval = 1;
1585                goto num_index;
1586            case IS_REFERENCE:
1587                dim = Z_REFVAL_P(dim);
1588                goto try_again;
1589            default:
1590                zend_error(E_WARNING, "Illegal offset type");
1591                retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
1592                    &EG(error_zval) : &EG(uninitialized_zval);
1593        }
1594    }
1595    return retval;
1596}
1597
1598static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type)
1599{
1600    zend_long offset;
1601
1602try_again:
1603    if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1604        switch(Z_TYPE_P(dim)) {
1605            case IS_STRING:
1606                if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
1607                    break;
1608                }
1609                if (type != BP_VAR_UNSET) {
1610                    zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
1611                }
1612                break;
1613            case IS_DOUBLE:
1614            case IS_NULL:
1615            case IS_FALSE:
1616            case IS_TRUE:
1617                zend_error(E_NOTICE, "String offset cast occurred");
1618                break;
1619            case IS_REFERENCE:
1620                dim = Z_REFVAL_P(dim);
1621                goto try_again;
1622            default:
1623                zend_error(E_WARNING, "Illegal offset type");
1624                break;
1625        }
1626
1627        offset = zval_get_long(dim);
1628    } else {
1629        offset = Z_LVAL_P(dim);
1630    }
1631
1632    return offset;
1633}
1634
1635static zend_always_inline zend_long zend_fetch_string_offset(zval *container, zval *dim, int type)
1636{
1637    zend_long offset = zend_check_string_offset(dim, type);
1638
1639    if (Z_REFCOUNTED_P(container)) {
1640        if (Z_REFCOUNT_P(container) > 1) {
1641            Z_DELREF_P(container);
1642            zval_copy_ctor_func(container);
1643        }
1644        Z_ADDREF_P(container);
1645    }
1646    return offset;
1647}
1648
1649static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container, zval *dim, int dim_type, int type)
1650{
1651    zval *retval;
1652
1653    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1654try_array:
1655        SEPARATE_ARRAY(container);
1656fetch_from_array:
1657        if (dim == NULL) {
1658            retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
1659            if (UNEXPECTED(retval == NULL)) {
1660                zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
1661                retval = &EG(error_zval);
1662            }
1663        } else {
1664            retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type);
1665        }
1666        ZVAL_INDIRECT(result, retval);
1667        return;
1668    } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
1669        container = Z_REFVAL_P(container);
1670        if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1671            goto try_array;
1672        }
1673    }
1674    if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
1675        if (type != BP_VAR_UNSET && UNEXPECTED(Z_STRLEN_P(container) == 0)) {
1676            zval_ptr_dtor_nogc(container);
1677convert_to_array:
1678            ZVAL_NEW_ARR(container);
1679            zend_hash_init(Z_ARRVAL_P(container), 8, NULL, ZVAL_PTR_DTOR, 0);
1680            goto fetch_from_array;
1681        }
1682
1683        if (dim == NULL) {
1684            zend_error(E_EXCEPTION | E_ERROR, "[] operator not supported for strings");
1685            ZVAL_NULL(result);
1686        } else {
1687            zend_check_string_offset(dim, type);
1688            ZVAL_INDIRECT(result, NULL); /* wrong string offset */
1689        }
1690    } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1691        if (!Z_OBJ_HT_P(container)->read_dimension) {
1692            zend_error(E_EXCEPTION | E_ERROR, "Cannot use object as array");
1693            retval = &EG(error_zval);
1694        } else {
1695            retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result);
1696
1697            if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
1698                zend_class_entry *ce = Z_OBJCE_P(container);
1699
1700                ZVAL_NULL(result);
1701                zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
1702            } else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
1703                if (!Z_ISREF_P(retval)) {
1704                    if (Z_REFCOUNTED_P(retval) &&
1705                        Z_REFCOUNT_P(retval) > 1) {
1706                        if (Z_TYPE_P(retval) != IS_OBJECT) {
1707                            Z_DELREF_P(retval);
1708                            ZVAL_DUP(result, retval);
1709                            retval = result;
1710                        } else {
1711                            ZVAL_COPY(result, retval);
1712                            retval = result;
1713                        }
1714                    }
1715                    if (Z_TYPE_P(retval) != IS_OBJECT) {
1716                        zend_class_entry *ce = Z_OBJCE_P(container);
1717                        zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
1718                    }
1719                }
1720                if (result != retval) {
1721                    ZVAL_INDIRECT(result, retval);
1722                }
1723            } else {
1724                ZVAL_INDIRECT(result, &EG(error_zval));
1725            }
1726        }
1727    } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
1728        if (UNEXPECTED(container == &EG(error_zval))) {
1729            ZVAL_INDIRECT(result, &EG(error_zval));
1730        } else if (type != BP_VAR_UNSET) {
1731            goto convert_to_array;
1732        } else {
1733            /* for read-mode only */
1734            ZVAL_NULL(result);
1735        }
1736    } else {
1737        if (type == BP_VAR_UNSET) {
1738            zend_error(E_WARNING, "Cannot unset offset in a non-array variable");
1739            ZVAL_NULL(result);
1740        } else {
1741            zend_error(E_WARNING, "Cannot use a scalar value as an array");
1742            ZVAL_INDIRECT(result, &EG(error_zval));
1743        }
1744    }
1745}
1746
1747static zend_never_inline void zend_fetch_dimension_address_W(zval *result, zval *container_ptr, zval *dim, int dim_type)
1748{
1749    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W);
1750}
1751
1752static zend_never_inline void zend_fetch_dimension_address_RW(zval *result, zval *container_ptr, zval *dim, int dim_type)
1753{
1754    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW);
1755}
1756
1757static zend_never_inline void zend_fetch_dimension_address_UNSET(zval *result, zval *container_ptr, zval *dim, int dim_type)
1758{
1759    zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET);
1760}
1761
1762static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type)
1763{
1764    zval *retval;
1765
1766    if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1767try_array:
1768        retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type);
1769        ZVAL_COPY(result, retval);
1770        return;
1771    } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
1772        container = Z_REFVAL_P(container);
1773        if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
1774            goto try_array;
1775        }
1776    }
1777    if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
1778        zend_long offset;
1779
1780try_string_offset:
1781        if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1782            switch(Z_TYPE_P(dim)) {
1783                /* case IS_LONG: */
1784                case IS_STRING:
1785                    if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
1786                        break;
1787                    }
1788                    if (type == BP_VAR_IS) {
1789                        ZVAL_NULL(result);
1790                        return;
1791                    }
1792                    zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
1793                    break;
1794                case IS_DOUBLE:
1795                case IS_NULL:
1796                case IS_FALSE:
1797                case IS_TRUE:
1798                    if (type != BP_VAR_IS) {
1799                        zend_error(E_NOTICE, "String offset cast occurred");
1800                    }
1801                    break;
1802                case IS_REFERENCE:
1803                    dim = Z_REFVAL_P(dim);
1804                    goto try_string_offset;
1805                default:
1806                    zend_error(E_WARNING, "Illegal offset type");
1807                    break;
1808            }
1809
1810            offset = zval_get_long(dim);
1811        } else {
1812            offset = Z_LVAL_P(dim);
1813        }
1814
1815        if (UNEXPECTED(offset < 0) || UNEXPECTED(Z_STRLEN_P(container) <= (size_t)offset)) {
1816            if (type != BP_VAR_IS) {
1817                zend_error(E_NOTICE, "Uninitialized string offset: %pd", offset);
1818                ZVAL_EMPTY_STRING(result);
1819            } else {
1820                ZVAL_NULL(result);
1821            }
1822        } else {
1823            zend_uchar c = (zend_uchar)Z_STRVAL_P(container)[offset];
1824
1825            if (CG(one_char_string)[c]) {
1826                ZVAL_INTERNED_STR(result, CG(one_char_string)[c]);
1827            } else {
1828                ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(container) + offset, 1, 0));
1829            }
1830        }
1831    } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1832        if (!Z_OBJ_HT_P(container)->read_dimension) {
1833            zend_error(E_EXCEPTION | E_ERROR, "Cannot use object as array");
1834            ZVAL_NULL(result);
1835        } else {
1836            retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result);
1837
1838            ZEND_ASSERT(result != NULL);
1839            if (retval) {
1840                if (result != retval) {
1841                    ZVAL_COPY(result, retval);
1842                }
1843            } else {
1844                ZVAL_NULL(result);
1845            }
1846        }
1847    } else {
1848        ZVAL_NULL(result);
1849    }
1850}
1851
1852static zend_never_inline void zend_fetch_dimension_address_read_R(zval *result, zval *container, zval *dim, int dim_type)
1853{
1854    zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R);
1855}
1856
1857static zend_never_inline void zend_fetch_dimension_address_read_IS(zval *result, zval *container, zval *dim, int dim_type)
1858{
1859    zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS);
1860}
1861
1862ZEND_API void zend_fetch_dimension_by_zval(zval *result, zval *container, zval *dim)
1863{
1864    zend_fetch_dimension_address_read_R(result, container, dim, IS_TMP_VAR);
1865}
1866
1867static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type)
1868{
1869    if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
1870        do {
1871            if (container_op_type == IS_VAR && UNEXPECTED(container == &EG(error_zval))) {
1872                ZVAL_INDIRECT(result, &EG(error_zval));
1873                return;
1874            }
1875
1876            if (Z_ISREF_P(container)) {
1877                container = Z_REFVAL_P(container);
1878                if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1879                    break;
1880                }
1881            }
1882
1883            /* this should modify object only if it's empty */
1884            if (type != BP_VAR_UNSET &&
1885                EXPECTED(Z_TYPE_P(container) <= IS_FALSE ||
1886                  (Z_TYPE_P(container) == IS_STRING && Z_STRLEN_P(container)==0))) {
1887                zval_ptr_dtor_nogc(container);
1888                object_init(container);
1889            } else {
1890                zend_error(E_WARNING, "Attempt to modify property of non-object");
1891                ZVAL_INDIRECT(result, &EG(error_zval));
1892                return;
1893            }
1894        } while (0);
1895    }
1896    if (prop_op_type == IS_CONST &&
1897        EXPECTED(Z_OBJCE_P(container) == CACHED_PTR_EX(cache_slot))) {
1898        uint32_t prop_offset = (uint32_t)(intptr_t)CACHED_PTR_EX(cache_slot + 1);
1899        zend_object *zobj = Z_OBJ_P(container);
1900        zval *retval;
1901
1902        if (EXPECTED(prop_offset != (uint32_t)ZEND_DYNAMIC_PROPERTY_OFFSET)) {
1903            retval = OBJ_PROP(zobj, prop_offset);
1904            if (EXPECTED(Z_TYPE_P(retval) != IS_UNDEF)) {
1905                ZVAL_INDIRECT(result, retval);
1906                return;
1907            }
1908        } else if (EXPECTED(zobj->properties != NULL)) {
1909            retval = zend_hash_find(zobj->properties, Z_STR_P(prop_ptr));
1910            if (EXPECTED(retval)) {
1911                ZVAL_INDIRECT(result, retval);
1912                return;
1913            }
1914        }
1915    }
1916    if (EXPECTED(Z_OBJ_HT_P(container)->get_property_ptr_ptr)) {
1917        zval *ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr, type, cache_slot);
1918        if (NULL == ptr) {
1919            if (Z_OBJ_HT_P(container)->read_property &&
1920                (ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type, cache_slot, result)) != NULL) {
1921                if (ptr != result) {
1922                    ZVAL_INDIRECT(result, ptr);
1923                }
1924            } else {
1925                zend_error(E_EXCEPTION | E_ERROR, "Cannot access undefined property for object with overloaded property access");
1926                ZVAL_INDIRECT(result, &EG(error_zval));
1927            }
1928        } else {
1929            ZVAL_INDIRECT(result, ptr);
1930        }
1931    } else if (EXPECTED(Z_OBJ_HT_P(container)->read_property)) {
1932        zval *ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type, cache_slot, result);
1933        if (ptr != result) {
1934            ZVAL_INDIRECT(result, ptr);
1935        }
1936    } else {
1937        zend_error(E_WARNING, "This object doesn't support property references");
1938        ZVAL_INDIRECT(result, &EG(error_zval));
1939    }
1940}
1941
1942static inline zend_brk_cont_element* zend_brk_cont(int nest_levels, int array_offset, const zend_op_array *op_array, const zend_execute_data *execute_data)
1943{
1944    zend_brk_cont_element *jmp_to;
1945
1946    do {
1947        ZEND_ASSERT(array_offset != -1);
1948        jmp_to = &op_array->brk_cont_array[array_offset];
1949        if (nest_levels > 1 && jmp_to->start >= 0) {
1950            zend_op *brk_opline = &op_array->opcodes[jmp_to->brk];
1951
1952            if (brk_opline->opcode == ZEND_FREE) {
1953                zval_ptr_dtor_nogc(EX_VAR(brk_opline->op1.var));
1954            } else if (brk_opline->opcode == ZEND_FE_FREE) {
1955                zval *var = EX_VAR(brk_opline->op1.var);
1956                if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
1957                    zend_hash_iterator_del(Z_FE_ITER_P(var));
1958                }
1959                zval_ptr_dtor_nogc(var);
1960            }
1961        }
1962        array_offset = jmp_to->parent;
1963    } while (--nest_levels > 0);
1964    return jmp_to;
1965}
1966
1967#if ZEND_INTENSIVE_DEBUGGING
1968
1969#define CHECK_SYMBOL_TABLES()                                                   \
1970    zend_hash_apply(&EG(symbol_table), zend_check_symbol);          \
1971    if (&EG(symbol_table)!=EX(symbol_table)) {                          \
1972        zend_hash_apply(EX(symbol_table), zend_check_symbol);   \
1973    }
1974
1975static int zend_check_symbol(zval *pz)
1976{
1977    if (Z_TYPE_P(pz) == IS_INDIRECT) {
1978        pz = Z_INDIRECT_P(pz);
1979    }
1980    if (Z_TYPE_P(pz) > 10) {
1981        fprintf(stderr, "Warning!  %x has invalid type!\n", *pz);
1982/* See http://support.microsoft.com/kb/190351 */
1983#ifdef PHP_WIN32
1984        fflush(stderr);
1985#endif
1986    } else if (Z_TYPE_P(pz) == IS_ARRAY) {
1987        zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol);
1988    } else if (Z_TYPE_P(pz) == IS_OBJECT) {
1989        /* OBJ-TBI - doesn't support new object model! */
1990        zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol);
1991    }
1992
1993    return 0;
1994}
1995
1996
1997#else
1998#define CHECK_SYMBOL_TABLES()
1999#endif
2000
2001ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value)
2002{
2003    execute_data->func->internal_function.handler(execute_data, return_value);
2004}
2005
2006ZEND_API void zend_clean_and_cache_symbol_table(zend_array *symbol_table) /* {{{ */
2007{
2008    if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
2009        zend_array_destroy(symbol_table);
2010    } else {
2011        /* clean before putting into the cache, since clean
2012           could call dtors, which could use cached hash */
2013        zend_symtable_clean(symbol_table);
2014        *(++EG(symtable_cache_ptr)) = symbol_table;
2015    }
2016}
2017/* }}} */
2018
2019static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
2020{
2021    zval *cv = EX_VAR_NUM(0);
2022    zval *end = cv + EX(func)->op_array.last_var;
2023    while (EXPECTED(cv != end)) {
2024        if (Z_REFCOUNTED_P(cv)) {
2025            if (!Z_DELREF_P(cv)) {
2026                zend_refcounted *r = Z_COUNTED_P(cv);
2027                ZVAL_NULL(cv);
2028                zval_dtor_func_for_ptr(r);
2029            } else {
2030                GC_ZVAL_CHECK_POSSIBLE_ROOT(cv);
2031            }
2032        }
2033        cv++;
2034    }
2035}
2036/* }}} */
2037
2038void zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
2039{
2040    i_free_compiled_variables(execute_data);
2041}
2042/* }}} */
2043
2044#ifdef ZEND_WIN32
2045# define ZEND_VM_INTERRUPT_CHECK() do { \
2046        if (EG(timed_out)) { \
2047            zend_timeout(0); \
2048        } \
2049    } while (0)
2050#else
2051# define ZEND_VM_INTERRUPT_CHECK() do { \
2052    } while (0)
2053#endif
2054
2055/*
2056 * Stack Frame Layout (the whole stack frame is allocated at once)
2057 * ==================
2058 *
2059 *                             +========================================+
2060 * EG(current_execute_data) -> | zend_execute_data                      |
2061 *                             +----------------------------------------+
2062 *     EX_CV_NUM(0) ---------> | VAR[0] = ARG[1]                        |
2063 *                             | ...                                    |
2064 *                             | VAR[op_array->num_args-1] = ARG[N]     |
2065 *                             | ...                                    |
2066 *                             | VAR[op_array->last_var-1]              |
2067 *                             | VAR[op_array->last_var] = TMP[0]       |
2068 *                             | ...                                    |
2069 *                             | VAR[op_array->last_var+op_array->T-1]  |
2070 *                             | ARG[N+1] (extra_args)                  |
2071 *                             | ...                                    |
2072 *                             +----------------------------------------+
2073 */
2074
2075static zend_always_inline void i_init_func_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value, int check_this) /* {{{ */
2076{
2077    uint32_t first_extra_arg, num_args;
2078    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
2079
2080    EX(opline) = op_array->opcodes;
2081    EX(call) = NULL;
2082    EX(return_value) = return_value;
2083
2084    /* Handle arguments */
2085    first_extra_arg = op_array->num_args;
2086    num_args = EX_NUM_ARGS();
2087    if (UNEXPECTED(num_args > first_extra_arg)) {
2088        zval *end, *src, *dst;
2089        uint32_t type_flags = 0;
2090
2091        if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
2092            /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
2093            EX(opline) += first_extra_arg;
2094        }
2095
2096        /* move extra args into separate array after all CV and TMP vars */
2097        end = EX_VAR_NUM(first_extra_arg - 1);
2098        src = end + (num_args - first_extra_arg);
2099        dst = src + (op_array->last_var + op_array->T - first_extra_arg);
2100        if (EXPECTED(src != dst)) {
2101            do {
2102                type_flags |= Z_TYPE_INFO_P(src);
2103                ZVAL_COPY_VALUE(dst, src);
2104                ZVAL_UNDEF(src);
2105                src--;
2106                dst--;
2107            } while (src != end);
2108        } else {
2109            do {
2110                type_flags |= Z_TYPE_INFO_P(src);
2111                src--;
2112            } while (src != end);
2113        }
2114        ZEND_ADD_CALL_FLAG(execute_data, ((type_flags >> Z_TYPE_FLAGS_SHIFT) & IS_TYPE_REFCOUNTED));
2115    } else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
2116        /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
2117        EX(opline) += num_args;
2118    }
2119
2120    /* Initialize CV variables (skip arguments) */
2121    if (EXPECTED((int)num_args < op_array->last_var)) {
2122        zval *var = EX_VAR_NUM(num_args);
2123        zval *end = EX_VAR_NUM(op_array->last_var);
2124
2125        do {
2126            ZVAL_UNDEF(var);
2127            var++;
2128        } while (var != end);
2129    }
2130
2131    if (check_this && op_array->this_var != (uint32_t)-1 && EXPECTED(Z_OBJ(EX(This)))) {
2132        ZVAL_OBJ(EX_VAR(op_array->this_var), Z_OBJ(EX(This)));
2133        GC_REFCOUNT(Z_OBJ(EX(This)))++;
2134    }
2135
2136    if (UNEXPECTED(!op_array->run_time_cache)) {
2137        op_array->run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
2138        memset(op_array->run_time_cache, 0, op_array->cache_size);
2139    }
2140    EX_LOAD_RUN_TIME_CACHE(op_array);
2141    EX_LOAD_LITERALS(op_array);
2142
2143    EG(current_execute_data) = execute_data;
2144    ZEND_VM_INTERRUPT_CHECK();
2145}
2146/* }}} */
2147
2148static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
2149{
2150    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
2151
2152    EX(opline) = op_array->opcodes;
2153    EX(call) = NULL;
2154    EX(return_value) = return_value;
2155
2156    zend_attach_symbol_table(execute_data);
2157
2158    if (op_array->this_var != (uint32_t)-1 && EXPECTED(Z_OBJ(EX(This)))) {
2159        ZVAL_OBJ(EX_VAR(op_array->this_var), Z_OBJ(EX(This)));
2160        GC_REFCOUNT(Z_OBJ(EX(This)))++;
2161    }
2162
2163    if (!op_array->run_time_cache) {
2164        op_array->run_time_cache = emalloc(op_array->cache_size);
2165        memset(op_array->run_time_cache, 0, op_array->cache_size);
2166    }
2167    EX_LOAD_RUN_TIME_CACHE(op_array);
2168    EX_LOAD_LITERALS(op_array);
2169
2170    EG(current_execute_data) = execute_data;
2171    ZEND_VM_INTERRUPT_CHECK();
2172}
2173/* }}} */
2174
2175static zend_always_inline void i_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
2176{
2177    ZEND_ASSERT(EX(func) == (zend_function*)op_array);
2178
2179    EX(opline) = op_array->opcodes;
2180    EX(call) = NULL;
2181    EX(return_value) = return_value;
2182
2183    if (UNEXPECTED(EX(symbol_table) != NULL)) {
2184        zend_attach_symbol_table(execute_data);
2185    } else {
2186        uint32_t first_extra_arg, num_args;
2187
2188        /* Handle arguments */
2189        first_extra_arg = op_array->num_args;
2190        num_args = EX_NUM_ARGS();
2191        if (UNEXPECTED(num_args > first_extra_arg)) {
2192            zval *end, *src, *dst;
2193            uint32_t type_flags = 0;
2194
2195            if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
2196                /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
2197                EX(opline) += first_extra_arg;
2198            }
2199
2200            /* move extra args into separate array after all CV and TMP vars */
2201            end = EX_VAR_NUM(first_extra_arg - 1);
2202            src = end + (num_args - first_extra_arg);
2203            dst = src + (op_array->last_var + op_array->T - first_extra_arg);
2204            if (EXPECTED(src != dst)) {
2205                do {
2206                    type_flags |= Z_TYPE_INFO_P(src);
2207                    ZVAL_COPY_VALUE(dst, src);
2208                    ZVAL_UNDEF(src);
2209                    src--;
2210                    dst--;
2211                } while (src != end);
2212            } else {
2213                do {
2214                    type_flags |= Z_TYPE_INFO_P(src);
2215                    src--;
2216                } while (src != end);
2217            }
2218            ZEND_ADD_CALL_FLAG(execute_data, ((type_flags >> Z_TYPE_FLAGS_SHIFT) & IS_TYPE_REFCOUNTED));
2219        } else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
2220            /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
2221            EX(opline) += num_args;
2222        }
2223
2224        /* Initialize CV variables (skip arguments) */
2225        if (EXPECTED((int)num_args < op_array->last_var)) {
2226            zval *var = EX_VAR_NUM(num_args);
2227            zval *end = EX_VAR_NUM(op_array->last_var);
2228
2229            do {
2230                ZVAL_UNDEF(var);
2231                var++;
2232            } while (var != end);
2233        }
2234    }
2235
2236    if (op_array->this_var != (uint32_t)-1 && EXPECTED(Z_OBJ(EX(This)))) {
2237        ZVAL_OBJ(EX_VAR(op_array->this_var), Z_OBJ(EX(This)));
2238        GC_REFCOUNT(Z_OBJ(EX(This)))++;
2239    }
2240
2241    if (!op_array->run_time_cache) {
2242        if (op_array->function_name) {
2243            op_array->run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
2244        } else {
2245            op_array->run_time_cache = emalloc(op_array->cache_size);
2246        }
2247        memset(op_array->run_time_cache, 0, op_array->cache_size);
2248    }
2249    EX_LOAD_RUN_TIME_CACHE(op_array);
2250    EX_LOAD_LITERALS(op_array);
2251
2252    EG(current_execute_data) = execute_data;
2253    ZEND_VM_INTERRUPT_CHECK();
2254}
2255/* }}} */
2256
2257ZEND_API zend_execute_data *zend_create_generator_execute_data(zend_execute_data *call, zend_op_array *op_array, zval *return_value) /* {{{ */
2258{
2259    /*
2260     * Normally the execute_data is allocated on the VM stack (because it does
2261     * not actually do any allocation and thus is faster). For generators
2262     * though this behavior would be suboptimal, because the (rather large)
2263     * structure would have to be copied back and forth every time execution is
2264     * suspended or resumed. That's why for generators the execution context
2265     * is allocated using a separate VM stack, thus allowing to save and
2266     * restore it simply by replacing a pointer.
2267     */
2268    zend_execute_data *execute_data;
2269    uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
2270    size_t stack_size = (ZEND_CALL_FRAME_SLOT + MAX(op_array->last_var + op_array->T, num_args)) * sizeof(zval);
2271    uint32_t call_info;
2272
2273    EG(vm_stack) = zend_vm_stack_new_page(
2274        EXPECTED(stack_size < ZEND_VM_STACK_FREE_PAGE_SIZE(1)) ?
2275            ZEND_VM_STACK_PAGE_SIZE(1) :
2276            ZEND_VM_STACK_PAGE_ALIGNED_SIZE(1, stack_size),
2277        NULL);
2278    EG(vm_stack_top) = EG(vm_stack)->top;
2279    EG(vm_stack_end) = EG(vm_stack)->end;
2280
2281    call_info = ZEND_CALL_TOP_FUNCTION | ZEND_CALL_ALLOCATED | (ZEND_CALL_INFO(call) & (ZEND_CALL_CLOSURE|ZEND_CALL_RELEASE_THIS));
2282    if (Z_OBJ(call->This)) {
2283        call_info |= ZEND_CALL_RELEASE_THIS;
2284    }
2285    execute_data = zend_vm_stack_push_call_frame(
2286        call_info,
2287        (zend_function*)op_array,
2288        num_args,
2289        call->called_scope,
2290        Z_OBJ(call->This));
2291    EX(prev_execute_data) = NULL;
2292    EX_NUM_ARGS() = num_args;
2293
2294    /* copy arguments */
2295    if (num_args > 0) {
2296        zval *arg_src = ZEND_CALL_ARG(call, 1);
2297        zval *arg_dst = ZEND_CALL_ARG(execute_data, 1);
2298        zval *end = arg_src + num_args;
2299
2300        do {
2301            ZVAL_COPY_VALUE(arg_dst, arg_src);
2302            arg_src++;
2303            arg_dst++;
2304        } while (arg_src != end);
2305    }
2306
2307    EX(symbol_table) = NULL;
2308
2309    i_init_func_execute_data(execute_data, op_array, return_value, 1);
2310
2311    return execute_data;
2312}
2313/* }}} */
2314
2315ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
2316{
2317    EX(prev_execute_data) = EG(current_execute_data);
2318    i_init_execute_data(execute_data, op_array, return_value);
2319}
2320/* }}} */
2321
2322static zend_always_inline zend_bool zend_is_by_ref_func_arg_fetch(const zend_op *opline, zend_execute_data *call) /* {{{ */
2323{
2324    uint32_t arg_num = opline->extended_value & ZEND_FETCH_ARG_MASK;
2325    return ARG_SHOULD_BE_SENT_BY_REF(call->func, arg_num);
2326}
2327/* }}} */
2328
2329static zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
2330{
2331    zend_execute_data *new_call;
2332    int used_stack = (EG(vm_stack_top) - (zval*)call) + additional_args;
2333
2334    /* copy call frame into new stack segment */
2335    new_call = zend_vm_stack_extend(used_stack * sizeof(zval));
2336    *new_call = *call;
2337    ZEND_SET_CALL_INFO(new_call, ZEND_CALL_INFO(new_call) | ZEND_CALL_ALLOCATED);
2338
2339    if (passed_args) {
2340        zval *src = ZEND_CALL_ARG(call, 1);
2341        zval *dst = ZEND_CALL_ARG(new_call, 1);
2342        do {
2343            ZVAL_COPY_VALUE(dst, src);
2344            passed_args--;
2345            src++;
2346            dst++;
2347        } while (passed_args);
2348    }
2349
2350    /* delete old call_frame from previous stack segment */
2351    EG(vm_stack)->prev->top = (zval*)call;
2352
2353    /* delete previous stack segment if it becames empty */
2354    if (UNEXPECTED(EG(vm_stack)->prev->top == ZEND_VM_STACK_ELEMETS(EG(vm_stack)->prev))) {
2355        zend_vm_stack r = EG(vm_stack)->prev;
2356
2357        EG(vm_stack)->prev = r->prev;
2358        efree(r);
2359    }
2360
2361    return new_call;
2362}
2363/* }}} */
2364
2365static zend_always_inline void zend_vm_stack_extend_call_frame(zend_execute_data **call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
2366{
2367    if (EXPECTED((uint32_t)(EG(vm_stack_end) - EG(vm_stack_top)) > additional_args)) {
2368        EG(vm_stack_top) += additional_args;
2369    } else {
2370        *call = zend_vm_stack_copy_call_frame(*call, passed_args, additional_args);
2371    }
2372}
2373/* }}} */
2374
2375static zend_always_inline zend_generator *zend_get_running_generator(zend_execute_data *execute_data) /* {{{ */
2376{
2377    /* The generator object is stored in EX(return_value) */
2378    zend_generator *generator = (zend_generator *) EX(return_value);
2379    /* However control may currently be delegated to another generator.
2380     * That's the one we're interested in. */
2381    return generator;
2382}
2383/* }}} */
2384
2385static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
2386{
2387    int i;
2388    if (UNEXPECTED(EX(call))) {
2389        zend_execute_data *call = EX(call);
2390        zend_op *opline = EX(func)->op_array.opcodes + op_num;
2391        int level;
2392        int do_exit;
2393
2394        do {
2395            /* If the exception was thrown during a function call there might be
2396             * arguments pushed to the stack that have to be dtor'ed. */
2397
2398            /* find the number of actually passed arguments */
2399            level = 0;
2400            do_exit = 0;
2401            do {
2402                switch (opline->opcode) {
2403                    case ZEND_DO_FCALL:
2404                    case ZEND_DO_ICALL:
2405                    case ZEND_DO_UCALL:
2406                    case ZEND_DO_FCALL_BY_NAME:
2407                        level++;
2408                        break;
2409                    case ZEND_INIT_FCALL:
2410                    case ZEND_INIT_FCALL_BY_NAME:
2411                    case ZEND_INIT_NS_FCALL_BY_NAME:
2412                    case ZEND_INIT_DYNAMIC_CALL:
2413                    case ZEND_INIT_USER_CALL:
2414                    case ZEND_INIT_METHOD_CALL:
2415                    case ZEND_INIT_STATIC_METHOD_CALL:
2416                    case ZEND_NEW:
2417                        if (level == 0) {
2418                            ZEND_CALL_NUM_ARGS(call) = 0;
2419                            do_exit = 1;
2420                        }
2421                        level--;
2422                        break;
2423                    case ZEND_SEND_VAL:
2424                    case ZEND_SEND_VAL_EX:
2425                    case ZEND_SEND_VAR:
2426                    case ZEND_SEND_VAR_EX:
2427                    case ZEND_SEND_REF:
2428                    case ZEND_SEND_VAR_NO_REF:
2429                    case ZEND_SEND_USER:
2430                        if (level == 0) {
2431                            ZEND_CALL_NUM_ARGS(call) = opline->op2.num;
2432                            do_exit = 1;
2433                        }
2434                        break;
2435                    case ZEND_SEND_ARRAY:
2436                    case ZEND_SEND_UNPACK:
2437                        if (level == 0) {
2438                            do_exit = 1;
2439                        }
2440                        break;
2441                }
2442                if (!do_exit) {
2443                    opline--;
2444                }
2445            } while (!do_exit);
2446            if (call->prev_execute_data) {
2447                /* skip current call region */
2448                level = 0;
2449                do_exit = 0;
2450                do {
2451                    switch (opline->opcode) {
2452                        case ZEND_DO_FCALL:
2453                        case ZEND_DO_ICALL:
2454                        case ZEND_DO_UCALL:
2455                        case ZEND_DO_FCALL_BY_NAME:
2456                            level++;
2457                            break;
2458                        case ZEND_INIT_FCALL:
2459                        case ZEND_INIT_FCALL_BY_NAME:
2460                        case ZEND_INIT_NS_FCALL_BY_NAME:
2461                        case ZEND_INIT_DYNAMIC_CALL:
2462                        case ZEND_INIT_USER_CALL:
2463                        case ZEND_INIT_METHOD_CALL:
2464                        case ZEND_INIT_STATIC_METHOD_CALL:
2465                        case ZEND_NEW:
2466                            if (level == 0) {
2467                                do_exit = 1;
2468                            }
2469                            level--;
2470                            break;
2471                    }
2472                    opline--;
2473                } while (!do_exit);
2474            }
2475
2476            zend_vm_stack_free_args(EX(call));
2477
2478            if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
2479                if (ZEND_CALL_INFO(call) & ZEND_CALL_CTOR) {
2480                    if (!(ZEND_CALL_INFO(call) & ZEND_CALL_CTOR_RESULT_UNUSED)) {
2481                        GC_REFCOUNT(Z_OBJ(call->This))--;
2482                    }
2483                    if (GC_REFCOUNT(Z_OBJ(call->This)) == 1) {
2484                        zend_object_store_ctor_failed(Z_OBJ(call->This));
2485                    }
2486                }
2487                OBJ_RELEASE(Z_OBJ(call->This));
2488            }
2489            if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
2490                zend_object_release((zend_object *) call->func->common.prototype);
2491            }
2492            if (call->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
2493                zend_string_release(call->func->common.function_name);
2494                zend_free_trampoline(call->func);
2495            }
2496
2497            EX(call) = call->prev_execute_data;
2498            zend_vm_stack_free_call_frame(call);
2499            call = EX(call);
2500        } while (call);
2501    }
2502
2503    for (i = 0; i < EX(func)->op_array.last_brk_cont; i++) {
2504        const zend_brk_cont_element *brk_cont = &EX(func)->op_array.brk_cont_array[i];
2505        if (brk_cont->start < 0) {
2506            continue;
2507        } else if (brk_cont->start > op_num) {
2508            /* further blocks will not be relevant... */
2509            break;
2510        } else if (op_num < brk_cont->brk) {
2511            if (!catch_op_num || catch_op_num >= brk_cont->brk) {
2512                zend_op *brk_opline = &EX(func)->op_array.opcodes[brk_cont->brk];
2513
2514                if (brk_opline->opcode == ZEND_FREE) {
2515                    zval_ptr_dtor_nogc(EX_VAR(brk_opline->op1.var));
2516                } else if (brk_opline->opcode == ZEND_FE_FREE) {
2517                    zval *var = EX_VAR(brk_opline->op1.var);
2518                    if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
2519                        zend_hash_iterator_del(Z_FE_ITER_P(var));
2520                    }
2521                    zval_ptr_dtor_nogc(var);
2522                } else if (brk_opline->opcode == ZEND_ROPE_END) {
2523                    zend_string **rope = (zend_string **) EX_VAR(brk_opline->op1.var);
2524                    zend_op *last = EX(func)->op_array.opcodes + op_num;
2525                    while (last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT) {
2526                        ZEND_ASSERT(last >= EX(func)->op_array.opcodes);
2527                        last--;
2528                    }
2529                    if (last->opcode == ZEND_ROPE_INIT) {
2530                        zend_string_release(*rope);
2531                    } else {
2532                        int j = last->extended_value;
2533                        do {
2534                            zend_string_release(rope[j]);
2535                        } while (j--);
2536                    }
2537                } else if (brk_opline->opcode == ZEND_END_SILENCE) {
2538                    /* restore previous error_reporting value */
2539                    if (!EG(error_reporting) && Z_LVAL_P(EX_VAR(brk_opline->op1.var)) != 0) {
2540                        EG(error_reporting) = Z_LVAL_P(EX_VAR(brk_opline->op1.var));
2541                    }
2542                }
2543            }
2544        }
2545    }
2546}
2547/* }}} */
2548
2549void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
2550    i_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
2551}
2552
2553#ifdef HAVE_GCC_GLOBAL_REGS
2554# if defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(i386)
2555#  define ZEND_VM_FP_GLOBAL_REG "%esi"
2556#  define ZEND_VM_IP_GLOBAL_REG "%edi"
2557# elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__x86_64__)
2558#  define ZEND_VM_FP_GLOBAL_REG "%r14"
2559#  define ZEND_VM_IP_GLOBAL_REG "%r15"
2560# elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
2561#  define ZEND_VM_FP_GLOBAL_REG "r28"
2562#  define ZEND_VM_IP_GLOBAL_REG "r29"
2563# endif
2564#endif
2565
2566#define ZEND_VM_NEXT_OPCODE() \
2567    CHECK_SYMBOL_TABLES() \
2568    ZEND_VM_INC_OPCODE(); \
2569    ZEND_VM_CONTINUE()
2570
2571#define ZEND_VM_SET_NEXT_OPCODE(new_op) \
2572    CHECK_SYMBOL_TABLES() \
2573    OPLINE = new_op
2574
2575#define ZEND_VM_SET_OPCODE(new_op) \
2576    CHECK_SYMBOL_TABLES() \
2577    OPLINE = new_op; \
2578    ZEND_VM_INTERRUPT_CHECK()
2579
2580#define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
2581    ZEND_VM_SET_OPCODE(ZEND_OFFSET_TO_OPLINE(opline, offset))
2582
2583#define ZEND_VM_JMP(new_op) \
2584    if (EXPECTED(!EG(exception))) { \
2585        ZEND_VM_SET_OPCODE(new_op); \
2586    } else { \
2587        LOAD_OPLINE(); \
2588    } \
2589    ZEND_VM_CONTINUE()
2590
2591#define ZEND_VM_INC_OPCODE() \
2592    OPLINE++
2593
2594
2595#ifndef VM_SMART_OPCODES
2596# define VM_SMART_OPCODES 1
2597#endif
2598
2599#if VM_SMART_OPCODES
2600# define ZEND_VM_REPEATABLE_OPCODE \
2601    do {
2602# define ZEND_VM_REPEAT_OPCODE(_opcode) \
2603    } while (UNEXPECTED((++opline)->opcode == _opcode)); \
2604    OPLINE = opline; \
2605    ZEND_VM_CONTINUE()
2606# define ZEND_VM_SMART_BRANCH(_result, _check) do { \
2607        int __result; \
2608        if (EXPECTED((opline+1)->opcode == ZEND_JMPZ)) { \
2609            __result = (_result); \
2610        } else if (EXPECTED((opline+1)->opcode == ZEND_JMPNZ)) { \
2611            __result = !(_result); \
2612        } else { \
2613            break; \
2614        } \
2615        if ((_check) && UNEXPECTED(EG(exception))) { \
2616            HANDLE_EXCEPTION(); \
2617        } \
2618        if (__result) { \
2619            ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
2620        } else { \
2621            ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
2622        } \
2623        ZEND_VM_CONTINUE(); \
2624    } while (0)
2625#else
2626# define ZEND_VM_REPEATABLE_OPCODE
2627# define ZEND_VM_REPEAT_OPCODE(_opcode)
2628# define ZEND_VM_SMART_BRANCH(_result, _check)
2629#endif
2630
2631#ifdef __GNUC__
2632# define ZEND_VM_GUARD(name) __asm__("#" #name)
2633#else
2634# define ZEND_VM_GUARD(name)
2635#endif
2636
2637#define GET_OP1_UNDEF_CV(ptr, type) \
2638    _get_zval_cv_lookup_ ## type(ptr, opline->op1.var, execute_data)
2639#define GET_OP2_UNDEF_CV(ptr, type) \
2640    _get_zval_cv_lookup_ ## type(ptr, opline->op2.var, execute_data)
2641
2642#include "zend_vm_execute.h"
2643
2644ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
2645{
2646    if (opcode != ZEND_USER_OPCODE) {
2647        if (handler == NULL) {
2648            /* restore the original handler */
2649            zend_user_opcodes[opcode] = opcode;
2650        } else {
2651            zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
2652        }
2653        zend_user_opcode_handlers[opcode] = handler;
2654        return SUCCESS;
2655    }
2656    return FAILURE;
2657}
2658
2659ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
2660{
2661    return zend_user_opcode_handlers[opcode];
2662}
2663
2664ZEND_API zval *zend_get_zval_ptr(int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type) {
2665    return get_zval_ptr(op_type, *node, execute_data, should_free, type);
2666}
2667
2668/*
2669 * Local variables:
2670 * tab-width: 4
2671 * c-basic-offset: 4
2672 * indent-tabs-mode: t
2673 * End:
2674 */
2675