1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Nikita Popov <nikic@php.net>                                |
18    +----------------------------------------------------------------------+
19 */
20 
21 #include <zend_language_parser.h>
22 #include "zend.h"
23 #include "zend_compile.h"
24 #include "zend_constants.h"
25 #include "zend_llist.h"
26 #include "zend_API.h"
27 #include "zend_exceptions.h"
28 #include "zend_interfaces.h"
29 #include "zend_virtual_cwd.h"
30 #include "zend_multibyte.h"
31 #include "zend_language_scanner.h"
32 #include "zend_inheritance.h"
33 #include "zend_vm.h"
34 
35 #define SET_NODE(target, src) do { \
36 		target ## _type = (src)->op_type; \
37 		if ((src)->op_type == IS_CONST) { \
38 			target.constant = zend_add_literal(&(src)->u.constant); \
39 		} else { \
40 			target = (src)->u.op; \
41 		} \
42 	} while (0)
43 
44 #define GET_NODE(target, src) do { \
45 		(target)->op_type = src ## _type; \
46 		if ((target)->op_type == IS_CONST) { \
47 			ZVAL_COPY_VALUE(&(target)->u.constant, CT_CONSTANT(src)); \
48 		} else { \
49 			(target)->u.op = src; \
50 		} \
51 	} while (0)
52 
53 #define FC(member) (CG(file_context).member)
54 
55 typedef struct _zend_loop_var {
56 	zend_uchar opcode;
57 	zend_uchar var_type;
58 	uint32_t   var_num;
59 	uint32_t   try_catch_offset;
60 } zend_loop_var;
61 
zend_alloc_cache_slots(unsigned count)62 static inline uint32_t zend_alloc_cache_slots(unsigned count) {
63 	zend_op_array *op_array = CG(active_op_array);
64 	uint32_t ret = op_array->cache_size;
65 	op_array->cache_size += count * sizeof(void*);
66 	return ret;
67 }
68 
zend_alloc_cache_slot(void)69 static inline uint32_t zend_alloc_cache_slot(void) {
70 	return zend_alloc_cache_slots(1);
71 }
72 
73 ZEND_API zend_op_array *(*zend_compile_file)(zend_file_handle *file_handle, int type);
74 ZEND_API zend_op_array *(*zend_compile_string)(zval *source_string, char *filename);
75 
76 #ifndef ZTS
77 ZEND_API zend_compiler_globals compiler_globals;
78 ZEND_API zend_executor_globals executor_globals;
79 #endif
80 
81 static zend_op *zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2);
82 static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast);
83 
init_op(zend_op *op)84 static void init_op(zend_op *op)
85 {
86 	MAKE_NOP(op);
87 	op->extended_value = 0;
88 	op->lineno = CG(zend_lineno);
89 }
90 
get_next_op_number(void)91 static zend_always_inline uint32_t get_next_op_number(void)
92 {
93 	return CG(active_op_array)->last;
94 }
95 
get_next_op(void)96 static zend_op *get_next_op(void)
97 {
98 	zend_op_array *op_array = CG(active_op_array);
99 	uint32_t next_op_num = op_array->last++;
100 	zend_op *next_op;
101 
102 	if (UNEXPECTED(next_op_num >= CG(context).opcodes_size)) {
103 		CG(context).opcodes_size *= 4;
104 		op_array->opcodes = erealloc(op_array->opcodes, CG(context).opcodes_size * sizeof(zend_op));
105 	}
106 
107 	next_op = &(op_array->opcodes[next_op_num]);
108 
109 	init_op(next_op);
110 
111 	return next_op;
112 }
113 
get_next_brk_cont_element(void)114 static zend_brk_cont_element *get_next_brk_cont_element(void)
115 {
116 	CG(context).last_brk_cont++;
117 	CG(context).brk_cont_array = erealloc(CG(context).brk_cont_array, sizeof(zend_brk_cont_element) * CG(context).last_brk_cont);
118 	return &CG(context).brk_cont_array[CG(context).last_brk_cont-1];
119 }
120 
zend_destroy_property_info_internal(zval *zv)121 static void zend_destroy_property_info_internal(zval *zv) /* {{{ */
122 {
123 	zend_property_info *property_info = Z_PTR_P(zv);
124 
125 	zend_string_release(property_info->name);
126 	free(property_info);
127 }
128 /* }}} */
129 
zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno)130 static zend_string *zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno) /* {{{ */
131 {
132 	zend_string *filename = CG(active_op_array)->filename;
133 	zend_string *result = zend_strpprintf(0, "%c%s%s:%" PRIu32 "$%" PRIx32,
134 		'\0', ZSTR_VAL(name), ZSTR_VAL(filename), start_lineno, CG(rtd_key_counter)++);
135 	return zend_new_interned_string(result);
136 }
137 /* }}} */
138 
zend_get_unqualified_name(const zend_string *name, const char **result, size_t *result_len)139 static zend_bool zend_get_unqualified_name(const zend_string *name, const char **result, size_t *result_len) /* {{{ */
140 {
141 	const char *ns_separator = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
142 	if (ns_separator != NULL) {
143 		*result = ns_separator + 1;
144 		*result_len = ZSTR_VAL(name) + ZSTR_LEN(name) - *result;
145 		return 1;
146 	}
147 
148 	return 0;
149 }
150 /* }}} */
151 
152 struct reserved_class_name {
153 	const char *name;
154 	size_t len;
155 };
156 static const struct reserved_class_name reserved_class_names[] = {
157 	{ZEND_STRL("bool")},
158 	{ZEND_STRL("false")},
159 	{ZEND_STRL("float")},
160 	{ZEND_STRL("int")},
161 	{ZEND_STRL("null")},
162 	{ZEND_STRL("parent")},
163 	{ZEND_STRL("self")},
164 	{ZEND_STRL("static")},
165 	{ZEND_STRL("string")},
166 	{ZEND_STRL("true")},
167 	{ZEND_STRL("void")},
168 	{ZEND_STRL("iterable")},
169 	{ZEND_STRL("object")},
170 	{NULL, 0}
171 };
172 
zend_is_reserved_class_name(const zend_string *name)173 static zend_bool zend_is_reserved_class_name(const zend_string *name) /* {{{ */
174 {
175 	const struct reserved_class_name *reserved = reserved_class_names;
176 
177 	const char *uqname = ZSTR_VAL(name);
178 	size_t uqname_len = ZSTR_LEN(name);
179 	zend_get_unqualified_name(name, &uqname, &uqname_len);
180 
181 	for (; reserved->name; ++reserved) {
182 		if (uqname_len == reserved->len
183 			&& zend_binary_strcasecmp(uqname, uqname_len, reserved->name, reserved->len) == 0
184 		) {
185 			return 1;
186 		}
187 	}
188 
189 	return 0;
190 }
191 /* }}} */
192 
zend_assert_valid_class_name(const zend_string *name)193 void zend_assert_valid_class_name(const zend_string *name) /* {{{ */
194 {
195 	if (zend_is_reserved_class_name(name)) {
196 		zend_error_noreturn(E_COMPILE_ERROR,
197 			"Cannot use '%s' as class name as it is reserved", ZSTR_VAL(name));
198 	}
199 }
200 /* }}} */
201 
202 typedef struct _builtin_type_info {
203 	const char* name;
204 	const size_t name_len;
205 	const zend_uchar type;
206 } builtin_type_info;
207 
208 static const builtin_type_info builtin_types[] = {
209 	{ZEND_STRL("int"), IS_LONG},
210 	{ZEND_STRL("float"), IS_DOUBLE},
211 	{ZEND_STRL("string"), IS_STRING},
212 	{ZEND_STRL("bool"), _IS_BOOL},
213 	{ZEND_STRL("void"), IS_VOID},
214 	{ZEND_STRL("iterable"), IS_ITERABLE},
215 	{ZEND_STRL("object"), IS_OBJECT},
216 	{NULL, 0, IS_UNDEF}
217 };
218 
219 
zend_lookup_builtin_type_by_name(const zend_string *name)220 static zend_always_inline zend_uchar zend_lookup_builtin_type_by_name(const zend_string *name) /* {{{ */
221 {
222 	const builtin_type_info *info = &builtin_types[0];
223 
224 	for (; info->name; ++info) {
225 		if (ZSTR_LEN(name) == info->name_len
226 			&& zend_binary_strcasecmp(ZSTR_VAL(name), ZSTR_LEN(name), info->name, info->name_len) == 0
227 		) {
228 			return info->type;
229 		}
230 	}
231 
232 	return 0;
233 }
234 /* }}} */
235 
236 
zend_oparray_context_begin(zend_oparray_context *prev_context)237 void zend_oparray_context_begin(zend_oparray_context *prev_context) /* {{{ */
238 {
239 	*prev_context = CG(context);
240 	CG(context).opcodes_size = INITIAL_OP_ARRAY_SIZE;
241 	CG(context).vars_size = 0;
242 	CG(context).literals_size = 0;
243 	CG(context).fast_call_var = -1;
244 	CG(context).try_catch_offset = -1;
245 	CG(context).current_brk_cont = -1;
246 	CG(context).last_brk_cont = 0;
247 	CG(context).brk_cont_array = NULL;
248 	CG(context).labels = NULL;
249 }
250 /* }}} */
251 
zend_oparray_context_end(zend_oparray_context *prev_context)252 void zend_oparray_context_end(zend_oparray_context *prev_context) /* {{{ */
253 {
254 	if (CG(context).brk_cont_array) {
255 		efree(CG(context).brk_cont_array);
256 		CG(context).brk_cont_array = NULL;
257 	}
258 	if (CG(context).labels) {
259 		zend_hash_destroy(CG(context).labels);
260 		FREE_HASHTABLE(CG(context).labels);
261 		CG(context).labels = NULL;
262 	}
263 	CG(context) = *prev_context;
264 }
265 /* }}} */
266 
zend_reset_import_tables(void)267 static void zend_reset_import_tables(void) /* {{{ */
268 {
269 	if (FC(imports)) {
270 		zend_hash_destroy(FC(imports));
271 		efree(FC(imports));
272 		FC(imports) = NULL;
273 	}
274 
275 	if (FC(imports_function)) {
276 		zend_hash_destroy(FC(imports_function));
277 		efree(FC(imports_function));
278 		FC(imports_function) = NULL;
279 	}
280 
281 	if (FC(imports_const)) {
282 		zend_hash_destroy(FC(imports_const));
283 		efree(FC(imports_const));
284 		FC(imports_const) = NULL;
285 	}
286 }
287 /* }}} */
288 
zend_end_namespace(void)289 static void zend_end_namespace(void) /* {{{ */ {
290 	FC(in_namespace) = 0;
291 	zend_reset_import_tables();
292 	if (FC(current_namespace)) {
293 		zend_string_release_ex(FC(current_namespace), 0);
294 		FC(current_namespace) = NULL;
295 	}
296 }
297 /* }}} */
298 
zend_file_context_begin(zend_file_context *prev_context)299 void zend_file_context_begin(zend_file_context *prev_context) /* {{{ */
300 {
301 	*prev_context = CG(file_context);
302 	FC(imports) = NULL;
303 	FC(imports_function) = NULL;
304 	FC(imports_const) = NULL;
305 	FC(current_namespace) = NULL;
306 	FC(in_namespace) = 0;
307 	FC(has_bracketed_namespaces) = 0;
308 	FC(declarables).ticks = 0;
309 	zend_hash_init(&FC(seen_symbols), 8, NULL, NULL, 0);
310 }
311 /* }}} */
312 
zend_file_context_end(zend_file_context *prev_context)313 void zend_file_context_end(zend_file_context *prev_context) /* {{{ */
314 {
315 	zend_end_namespace();
316 	zend_hash_destroy(&FC(seen_symbols));
317 	CG(file_context) = *prev_context;
318 }
319 /* }}} */
320 
zend_init_compiler_data_structures(void)321 void zend_init_compiler_data_structures(void) /* {{{ */
322 {
323 	zend_stack_init(&CG(loop_var_stack), sizeof(zend_loop_var));
324 	zend_stack_init(&CG(delayed_oplines_stack), sizeof(zend_op));
325 	CG(active_class_entry) = NULL;
326 	CG(in_compilation) = 0;
327 	CG(skip_shebang) = 0;
328 
329 	CG(encoding_declared) = 0;
330 	CG(memoized_exprs) = NULL;
331 	CG(memoize_mode) = 0;
332 }
333 /* }}} */
334 
zend_register_seen_symbol(zend_string *name, uint32_t kind)335 static void zend_register_seen_symbol(zend_string *name, uint32_t kind) {
336 	zval *zv = zend_hash_find(&FC(seen_symbols), name);
337 	if (zv) {
338 		Z_LVAL_P(zv) |= kind;
339 	} else {
340 		zval tmp;
341 		ZVAL_LONG(&tmp, kind);
342 		zend_hash_add_new(&FC(seen_symbols), name, &tmp);
343 	}
344 }
345 
zend_have_seen_symbol(zend_string *name, uint32_t kind)346 static zend_bool zend_have_seen_symbol(zend_string *name, uint32_t kind) {
347 	zval *zv = zend_hash_find(&FC(seen_symbols), name);
348 	return zv && (Z_LVAL_P(zv) & kind) != 0;
349 }
350 
file_handle_dtor(zend_file_handle *fh)351 ZEND_API void file_handle_dtor(zend_file_handle *fh) /* {{{ */
352 {
353 
354 	zend_file_handle_dtor(fh);
355 }
356 /* }}} */
357 
init_compiler(void)358 void init_compiler(void) /* {{{ */
359 {
360 	CG(arena) = zend_arena_create(64 * 1024);
361 	CG(active_op_array) = NULL;
362 	memset(&CG(context), 0, sizeof(CG(context)));
363 	zend_init_compiler_data_structures();
364 	zend_init_rsrc_list();
365 	zend_hash_init(&CG(filenames_table), 8, NULL, ZVAL_PTR_DTOR, 0);
366 	zend_llist_init(&CG(open_files), sizeof(zend_file_handle), (void (*)(void *)) file_handle_dtor, 0);
367 	CG(unclean_shutdown) = 0;
368 
369 	CG(delayed_variance_obligations) = NULL;
370 	CG(delayed_autoloads) = NULL;
371 }
372 /* }}} */
373 
shutdown_compiler(void)374 void shutdown_compiler(void) /* {{{ */
375 {
376 	zend_stack_destroy(&CG(loop_var_stack));
377 	zend_stack_destroy(&CG(delayed_oplines_stack));
378 	zend_hash_destroy(&CG(filenames_table));
379 	zend_arena_destroy(CG(arena));
380 
381 	if (CG(delayed_variance_obligations)) {
382 		zend_hash_destroy(CG(delayed_variance_obligations));
383 		FREE_HASHTABLE(CG(delayed_variance_obligations));
384 		CG(delayed_variance_obligations) = NULL;
385 	}
386 	if (CG(delayed_autoloads)) {
387 		zend_hash_destroy(CG(delayed_autoloads));
388 		FREE_HASHTABLE(CG(delayed_autoloads));
389 		CG(delayed_autoloads) = NULL;
390 	}
391 }
392 /* }}} */
393 
zend_set_compiled_filename(zend_string *new_compiled_filename)394 ZEND_API zend_string *zend_set_compiled_filename(zend_string *new_compiled_filename) /* {{{ */
395 {
396 	zval *p, rv;
397 
398 	if ((p = zend_hash_find(&CG(filenames_table), new_compiled_filename))) {
399 		ZEND_ASSERT(Z_TYPE_P(p) == IS_STRING);
400 		CG(compiled_filename) = Z_STR_P(p);
401 		return Z_STR_P(p);
402 	}
403 
404 	new_compiled_filename = zend_new_interned_string(zend_string_copy(new_compiled_filename));
405 	ZVAL_STR(&rv, new_compiled_filename);
406 	zend_hash_add_new(&CG(filenames_table), new_compiled_filename, &rv);
407 
408 	CG(compiled_filename) = new_compiled_filename;
409 	return new_compiled_filename;
410 }
411 /* }}} */
412 
zend_restore_compiled_filename(zend_string *original_compiled_filename)413 ZEND_API void zend_restore_compiled_filename(zend_string *original_compiled_filename) /* {{{ */
414 {
415 	CG(compiled_filename) = original_compiled_filename;
416 }
417 /* }}} */
418 
zend_get_compiled_filename(void)419 ZEND_API zend_string *zend_get_compiled_filename(void) /* {{{ */
420 {
421 	return CG(compiled_filename);
422 }
423 /* }}} */
424 
zend_get_compiled_lineno(void)425 ZEND_API int zend_get_compiled_lineno(void) /* {{{ */
426 {
427 	return CG(zend_lineno);
428 }
429 /* }}} */
430 
zend_is_compiling(void)431 ZEND_API zend_bool zend_is_compiling(void) /* {{{ */
432 {
433 	return CG(in_compilation);
434 }
435 /* }}} */
436 
get_temporary_variable(void)437 static zend_always_inline uint32_t get_temporary_variable(void) /* {{{ */
438 {
439 	return (uint32_t)CG(active_op_array)->T++;
440 }
441 /* }}} */
442 
lookup_cv(zend_string *name)443 static int lookup_cv(zend_string *name) /* {{{ */{
444 	zend_op_array *op_array = CG(active_op_array);
445 	int i = 0;
446 	zend_ulong hash_value = zend_string_hash_val(name);
447 
448 	while (i < op_array->last_var) {
449 		if (ZSTR_H(op_array->vars[i]) == hash_value
450 		 && zend_string_equals(op_array->vars[i], name)) {
451 			return (int)(zend_intptr_t)ZEND_CALL_VAR_NUM(NULL, i);
452 		}
453 		i++;
454 	}
455 	i = op_array->last_var;
456 	op_array->last_var++;
457 	if (op_array->last_var > CG(context).vars_size) {
458 		CG(context).vars_size += 16; /* FIXME */
459 		op_array->vars = erealloc(op_array->vars, CG(context).vars_size * sizeof(zend_string*));
460 	}
461 
462 	op_array->vars[i] = zend_string_copy(name);
463 	return (int)(zend_intptr_t)ZEND_CALL_VAR_NUM(NULL, i);
464 }
465 /* }}} */
466 
zend_del_literal(zend_op_array *op_array, int n)467 void zend_del_literal(zend_op_array *op_array, int n) /* {{{ */
468 {
469 	zval_ptr_dtor_nogc(CT_CONSTANT_EX(op_array, n));
470 	if (n + 1 == op_array->last_literal) {
471 		op_array->last_literal--;
472 	} else {
473 		ZVAL_UNDEF(CT_CONSTANT_EX(op_array, n));
474 	}
475 }
476 /* }}} */
477 
zval_make_interned_string(zval *zv)478 static inline zend_string *zval_make_interned_string(zval *zv) /* {{{ */
479 {
480 	ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);
481 	Z_STR_P(zv) = zend_new_interned_string(Z_STR_P(zv));
482 	if (ZSTR_IS_INTERNED(Z_STR_P(zv))) {
483 		Z_TYPE_FLAGS_P(zv) = 0;
484 	}
485 	return Z_STR_P(zv);
486 }
487 
488 /* Common part of zend_add_literal and zend_append_individual_literal */
zend_insert_literal(zend_op_array *op_array, zval *zv, int literal_position)489 static inline void zend_insert_literal(zend_op_array *op_array, zval *zv, int literal_position) /* {{{ */
490 {
491 	zval *lit = CT_CONSTANT_EX(op_array, literal_position);
492 	if (Z_TYPE_P(zv) == IS_STRING) {
493 		zval_make_interned_string(zv);
494 	}
495 	ZVAL_COPY_VALUE(lit, zv);
496 	Z_EXTRA_P(lit) = 0;
497 }
498 /* }}} */
499 
500 /* Is used while compiling a function, using the context to keep track
501    of an approximate size to avoid to relocate to often.
502    Literals are truncated to actual size in the second compiler pass (pass_two()). */
zend_add_literal(zval *zv)503 static int zend_add_literal(zval *zv) /* {{{ */
504 {
505 	zend_op_array *op_array = CG(active_op_array);
506 	int i = op_array->last_literal;
507 	op_array->last_literal++;
508 	if (i >= CG(context).literals_size) {
509 		while (i >= CG(context).literals_size) {
510 			CG(context).literals_size += 16; /* FIXME */
511 		}
512 		op_array->literals = (zval*)erealloc(op_array->literals, CG(context).literals_size * sizeof(zval));
513 	}
514 	zend_insert_literal(op_array, zv, i);
515 	return i;
516 }
517 /* }}} */
518 
zend_add_literal_string(zend_string **str)519 static inline int zend_add_literal_string(zend_string **str) /* {{{ */
520 {
521 	int ret;
522 	zval zv;
523 	ZVAL_STR(&zv, *str);
524 	ret = zend_add_literal(&zv);
525 	*str = Z_STR(zv);
526 	return ret;
527 }
528 /* }}} */
529 
zend_add_func_name_literal(zend_string *name)530 static int zend_add_func_name_literal(zend_string *name) /* {{{ */
531 {
532 	/* Original name */
533 	int ret = zend_add_literal_string(&name);
534 
535 	/* Lowercased name */
536 	zend_string *lc_name = zend_string_tolower(name);
537 	zend_add_literal_string(&lc_name);
538 
539 	return ret;
540 }
541 /* }}} */
542 
zend_add_ns_func_name_literal(zend_string *name)543 static int zend_add_ns_func_name_literal(zend_string *name) /* {{{ */
544 {
545 	const char *unqualified_name;
546 	size_t unqualified_name_len;
547 
548 	/* Original name */
549 	int ret = zend_add_literal_string(&name);
550 
551 	/* Lowercased name */
552 	zend_string *lc_name = zend_string_tolower(name);
553 	zend_add_literal_string(&lc_name);
554 
555 	/* Lowercased unqualfied name */
556 	if (zend_get_unqualified_name(name, &unqualified_name, &unqualified_name_len)) {
557 		lc_name = zend_string_alloc(unqualified_name_len, 0);
558 		zend_str_tolower_copy(ZSTR_VAL(lc_name), unqualified_name, unqualified_name_len);
559 		zend_add_literal_string(&lc_name);
560 	}
561 
562 	return ret;
563 }
564 /* }}} */
565 
zend_add_class_name_literal(zend_string *name)566 static int zend_add_class_name_literal(zend_string *name) /* {{{ */
567 {
568 	/* Original name */
569 	int ret = zend_add_literal_string(&name);
570 
571 	/* Lowercased name */
572 	zend_string *lc_name = zend_string_tolower(name);
573 	zend_add_literal_string(&lc_name);
574 
575 	return ret;
576 }
577 /* }}} */
578 
zend_add_const_name_literal(zend_string *name, zend_bool unqualified)579 static int zend_add_const_name_literal(zend_string *name, zend_bool unqualified) /* {{{ */
580 {
581 	zend_string *tmp_name;
582 
583 	int ret = zend_add_literal_string(&name);
584 
585 	size_t ns_len = 0, after_ns_len = ZSTR_LEN(name);
586 	const char *after_ns = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
587 	if (after_ns) {
588 		after_ns += 1;
589 		ns_len = after_ns - ZSTR_VAL(name) - 1;
590 		after_ns_len = ZSTR_LEN(name) - ns_len - 1;
591 
592 		/* lowercased namespace name & original constant name */
593 		tmp_name = zend_string_init(ZSTR_VAL(name), ZSTR_LEN(name), 0);
594 		zend_str_tolower(ZSTR_VAL(tmp_name), ns_len);
595 		zend_add_literal_string(&tmp_name);
596 
597 		/* lowercased namespace name & lowercased constant name */
598 		tmp_name = zend_string_tolower(name);
599 		zend_add_literal_string(&tmp_name);
600 
601 		if (!unqualified) {
602 			return ret;
603 		}
604 	} else {
605 		after_ns = ZSTR_VAL(name);
606 	}
607 
608 	/* original unqualified constant name */
609 	tmp_name = zend_string_init(after_ns, after_ns_len, 0);
610 	zend_add_literal_string(&tmp_name);
611 
612 	/* lowercased unqualified constant name */
613 	tmp_name = zend_string_alloc(after_ns_len, 0);
614 	zend_str_tolower_copy(ZSTR_VAL(tmp_name), after_ns, after_ns_len);
615 	zend_add_literal_string(&tmp_name);
616 
617 	return ret;
618 }
619 /* }}} */
620 
621 #define LITERAL_STR(op, str) do { \
622 		zval _c; \
623 		ZVAL_STR(&_c, str); \
624 		op.constant = zend_add_literal(&_c); \
625 	} while (0)
626 
zend_stop_lexing(void)627 void zend_stop_lexing(void)
628 {
629 	if (LANG_SCNG(on_event)) {
630 		LANG_SCNG(on_event)(ON_STOP, END, 0, LANG_SCNG(on_event_context));
631 	}
632 
633 	LANG_SCNG(yy_cursor) = LANG_SCNG(yy_limit);
634 }
635 
zend_begin_loop( zend_uchar free_opcode, const znode *loop_var, zend_bool is_switch)636 static inline void zend_begin_loop(
637 		zend_uchar free_opcode, const znode *loop_var, zend_bool is_switch) /* {{{ */
638 {
639 	zend_brk_cont_element *brk_cont_element;
640 	int parent = CG(context).current_brk_cont;
641 	zend_loop_var info = {0};
642 
643 	CG(context).current_brk_cont = CG(context).last_brk_cont;
644 	brk_cont_element = get_next_brk_cont_element();
645 	brk_cont_element->parent = parent;
646 	brk_cont_element->is_switch = is_switch;
647 
648 	if (loop_var && (loop_var->op_type & (IS_VAR|IS_TMP_VAR))) {
649 		uint32_t start = get_next_op_number();
650 
651 		info.opcode = free_opcode;
652 		info.var_type = loop_var->op_type;
653 		info.var_num = loop_var->u.op.var;
654 		brk_cont_element->start = start;
655 	} else {
656 		info.opcode = ZEND_NOP;
657 		/* The start field is used to free temporary variables in case of exceptions.
658 		 * We won't try to free something of we don't have loop variable.  */
659 		brk_cont_element->start = -1;
660 	}
661 
662 	zend_stack_push(&CG(loop_var_stack), &info);
663 }
664 /* }}} */
665 
zend_end_loop(int cont_addr, const znode *var_node)666 static inline void zend_end_loop(int cont_addr, const znode *var_node) /* {{{ */
667 {
668 	uint32_t end = get_next_op_number();
669 	zend_brk_cont_element *brk_cont_element
670 		= &CG(context).brk_cont_array[CG(context).current_brk_cont];
671 	brk_cont_element->cont = cont_addr;
672 	brk_cont_element->brk = end;
673 	CG(context).current_brk_cont = brk_cont_element->parent;
674 
675 	zend_stack_del_top(&CG(loop_var_stack));
676 }
677 /* }}} */
678 
zend_do_free(znode *op1)679 void zend_do_free(znode *op1) /* {{{ */
680 {
681 	if (op1->op_type == IS_TMP_VAR) {
682 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
683 
684 		while (opline->opcode == ZEND_END_SILENCE) {
685 			opline--;
686 		}
687 
688 		if (opline->result_type == IS_TMP_VAR && opline->result.var == op1->u.op.var) {
689 			if (opline->opcode == ZEND_BOOL || opline->opcode == ZEND_BOOL_NOT) {
690 				return;
691 			}
692 		}
693 
694 		zend_emit_op(NULL, ZEND_FREE, op1, NULL);
695 	} else if (op1->op_type == IS_VAR) {
696 		zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
697 		while (opline->opcode == ZEND_END_SILENCE ||
698 				opline->opcode == ZEND_EXT_FCALL_END ||
699 				opline->opcode == ZEND_OP_DATA) {
700 			opline--;
701 		}
702 		if (opline->result_type == IS_VAR
703 			&& opline->result.var == op1->u.op.var) {
704 			if (opline->opcode == ZEND_FETCH_THIS) {
705 				opline->opcode = ZEND_NOP;
706 				opline->result_type = IS_UNUSED;
707 			} else {
708 				opline->result_type = IS_UNUSED;
709 			}
710 		} else {
711 			while (opline >= CG(active_op_array)->opcodes) {
712 				if ((opline->opcode == ZEND_FETCH_LIST_R ||
713                      opline->opcode == ZEND_FETCH_LIST_W) &&
714 				    opline->op1_type == IS_VAR &&
715 				    opline->op1.var == op1->u.op.var) {
716 					zend_emit_op(NULL, ZEND_FREE, op1, NULL);
717 					return;
718 				}
719 				if (opline->result_type == IS_VAR
720 					&& opline->result.var == op1->u.op.var) {
721 					if (opline->opcode == ZEND_NEW) {
722 						zend_emit_op(NULL, ZEND_FREE, op1, NULL);
723 					}
724 					break;
725 				}
726 				opline--;
727 			}
728 		}
729 	} else if (op1->op_type == IS_CONST) {
730 		/* Destroy value without using GC: When opcache moves arrays into SHM it will
731 		 * free the zend_array structure, so references to it from outside the op array
732 		 * become invalid. GC would cause such a reference in the root buffer. */
733 		zval_ptr_dtor_nogc(&op1->u.constant);
734 	}
735 }
736 /* }}} */
737 
zend_add_class_modifier(uint32_t flags, uint32_t new_flag)738 uint32_t zend_add_class_modifier(uint32_t flags, uint32_t new_flag) /* {{{ */
739 {
740 	uint32_t new_flags = flags | new_flag;
741 	if ((flags & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS) && (new_flag & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS)) {
742 		zend_throw_exception(zend_ce_compile_error,
743 			"Multiple abstract modifiers are not allowed", 0);
744 		return 0;
745 	}
746 	if ((flags & ZEND_ACC_FINAL) && (new_flag & ZEND_ACC_FINAL)) {
747 		zend_throw_exception(zend_ce_compile_error, "Multiple final modifiers are not allowed", 0);
748 		return 0;
749 	}
750 	if ((new_flags & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS) && (new_flags & ZEND_ACC_FINAL)) {
751 		zend_throw_exception(zend_ce_compile_error,
752 			"Cannot use the final modifier on an abstract class", 0);
753 		return 0;
754 	}
755 	return new_flags;
756 }
757 /* }}} */
758 
zend_add_member_modifier(uint32_t flags, uint32_t new_flag)759 uint32_t zend_add_member_modifier(uint32_t flags, uint32_t new_flag) /* {{{ */
760 {
761 	uint32_t new_flags = flags | new_flag;
762 	if ((flags & ZEND_ACC_PPP_MASK) && (new_flag & ZEND_ACC_PPP_MASK)) {
763 		zend_throw_exception(zend_ce_compile_error,
764 			"Multiple access type modifiers are not allowed", 0);
765 		return 0;
766 	}
767 	if ((flags & ZEND_ACC_ABSTRACT) && (new_flag & ZEND_ACC_ABSTRACT)) {
768 		zend_throw_exception(zend_ce_compile_error, "Multiple abstract modifiers are not allowed", 0);
769 		return 0;
770 	}
771 	if ((flags & ZEND_ACC_STATIC) && (new_flag & ZEND_ACC_STATIC)) {
772 		zend_throw_exception(zend_ce_compile_error, "Multiple static modifiers are not allowed", 0);
773 		return 0;
774 	}
775 	if ((flags & ZEND_ACC_FINAL) && (new_flag & ZEND_ACC_FINAL)) {
776 		zend_throw_exception(zend_ce_compile_error, "Multiple final modifiers are not allowed", 0);
777 		return 0;
778 	}
779 	if ((new_flags & ZEND_ACC_ABSTRACT) && (new_flags & ZEND_ACC_FINAL)) {
780 		zend_throw_exception(zend_ce_compile_error,
781 			"Cannot use the final modifier on an abstract class member", 0);
782 		return 0;
783 	}
784 	return new_flags;
785 }
786 /* }}} */
787 
zend_concat3(char *str1, size_t str1_len, char *str2, size_t str2_len, char *str3, size_t str3_len)788 zend_string *zend_concat3(char *str1, size_t str1_len, char *str2, size_t str2_len, char *str3, size_t str3_len) /* {{{ */
789 {
790 	size_t len = str1_len + str2_len + str3_len;
791 	zend_string *res = zend_string_alloc(len, 0);
792 
793 	memcpy(ZSTR_VAL(res), str1, str1_len);
794 	memcpy(ZSTR_VAL(res) + str1_len, str2, str2_len);
795 	memcpy(ZSTR_VAL(res) + str1_len + str2_len, str3, str3_len);
796 	ZSTR_VAL(res)[len] = '\0';
797 
798 	return res;
799 }
800 
zend_concat_names(char *name1, size_t name1_len, char *name2, size_t name2_len)801 zend_string *zend_concat_names(char *name1, size_t name1_len, char *name2, size_t name2_len) {
802 	return zend_concat3(name1, name1_len, "\\", 1, name2, name2_len);
803 }
804 
zend_prefix_with_ns(zend_string *name)805 zend_string *zend_prefix_with_ns(zend_string *name) {
806 	if (FC(current_namespace)) {
807 		zend_string *ns = FC(current_namespace);
808 		return zend_concat_names(ZSTR_VAL(ns), ZSTR_LEN(ns), ZSTR_VAL(name), ZSTR_LEN(name));
809 	} else {
810 		return zend_string_copy(name);
811 	}
812 }
813 
zend_hash_find_ptr_lc(HashTable *ht, const char *str, size_t len)814 void *zend_hash_find_ptr_lc(HashTable *ht, const char *str, size_t len) {
815 	void *result;
816 	zend_string *lcname;
817 	ALLOCA_FLAG(use_heap);
818 
819 	ZSTR_ALLOCA_ALLOC(lcname, len, use_heap);
820 	zend_str_tolower_copy(ZSTR_VAL(lcname), str, len);
821 	result = zend_hash_find_ptr(ht, lcname);
822 	ZSTR_ALLOCA_FREE(lcname, use_heap);
823 
824 	return result;
825 }
826 
zend_resolve_non_class_name( zend_string *name, uint32_t type, zend_bool *is_fully_qualified, zend_bool case_sensitive, HashTable *current_import_sub )827 zend_string *zend_resolve_non_class_name(
828 	zend_string *name, uint32_t type, zend_bool *is_fully_qualified,
829 	zend_bool case_sensitive, HashTable *current_import_sub
830 ) {
831 	char *compound;
832 	*is_fully_qualified = 0;
833 
834 	if (ZSTR_VAL(name)[0] == '\\') {
835 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
836 		*is_fully_qualified = 1;
837 		return zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
838 	}
839 
840 	if (type == ZEND_NAME_FQ) {
841 		*is_fully_qualified = 1;
842 		return zend_string_copy(name);
843 	}
844 
845 	if (type == ZEND_NAME_RELATIVE) {
846 		*is_fully_qualified = 1;
847 		return zend_prefix_with_ns(name);
848 	}
849 
850 	if (current_import_sub) {
851 		/* If an unqualified name is a function/const alias, replace it. */
852 		zend_string *import_name;
853 		if (case_sensitive) {
854 			import_name = zend_hash_find_ptr(current_import_sub, name);
855 		} else {
856 			import_name = zend_hash_find_ptr_lc(current_import_sub, ZSTR_VAL(name), ZSTR_LEN(name));
857 		}
858 
859 		if (import_name) {
860 			*is_fully_qualified = 1;
861 			return zend_string_copy(import_name);
862 		}
863 	}
864 
865 	compound = memchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
866 	if (compound) {
867 		*is_fully_qualified = 1;
868 	}
869 
870 	if (compound && FC(imports)) {
871 		/* If the first part of a qualified name is an alias, substitute it. */
872 		size_t len = compound - ZSTR_VAL(name);
873 		zend_string *import_name = zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), len);
874 
875 		if (import_name) {
876 			return zend_concat_names(
877 				ZSTR_VAL(import_name), ZSTR_LEN(import_name), ZSTR_VAL(name) + len + 1, ZSTR_LEN(name) - len - 1);
878 		}
879 	}
880 
881 	return zend_prefix_with_ns(name);
882 }
883 /* }}} */
884 
zend_resolve_function_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified)885 zend_string *zend_resolve_function_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified) /* {{{ */
886 {
887 	return zend_resolve_non_class_name(
888 		name, type, is_fully_qualified, 0, FC(imports_function));
889 }
890 /* }}} */
891 
zend_resolve_const_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified)892 zend_string *zend_resolve_const_name(zend_string *name, uint32_t type, zend_bool *is_fully_qualified) /* {{{ */ {
893 	return zend_resolve_non_class_name(
894 		name, type, is_fully_qualified, 1, FC(imports_const));
895 }
896 /* }}} */
897 
zend_resolve_class_name(zend_string *name, uint32_t type)898 zend_string *zend_resolve_class_name(zend_string *name, uint32_t type) /* {{{ */
899 {
900 	char *compound;
901 
902 	if (type == ZEND_NAME_RELATIVE) {
903 		return zend_prefix_with_ns(name);
904 	}
905 
906 	if (type == ZEND_NAME_FQ || ZSTR_VAL(name)[0] == '\\') {
907 		/* Remove \ prefix (only relevant if this is a string rather than a label) */
908 		if (ZSTR_VAL(name)[0] == '\\') {
909 			name = zend_string_init(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1, 0);
910 		} else {
911 			zend_string_addref(name);
912 		}
913 		/* Ensure that \self, \parent and \static are not used */
914 		if (ZEND_FETCH_CLASS_DEFAULT != zend_get_class_fetch_type(name)) {
915 			zend_error_noreturn(E_COMPILE_ERROR, "'\\%s' is an invalid class name", ZSTR_VAL(name));
916 		}
917 		return name;
918 	}
919 
920 	if (FC(imports)) {
921 		compound = memchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));
922 		if (compound) {
923 			/* If the first part of a qualified name is an alias, substitute it. */
924 			size_t len = compound - ZSTR_VAL(name);
925 			zend_string *import_name =
926 				zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), len);
927 
928 			if (import_name) {
929 				return zend_concat_names(
930 					ZSTR_VAL(import_name), ZSTR_LEN(import_name), ZSTR_VAL(name) + len + 1, ZSTR_LEN(name) - len - 1);
931 			}
932 		} else {
933 			/* If an unqualified name is an alias, replace it. */
934 			zend_string *import_name
935 				= zend_hash_find_ptr_lc(FC(imports), ZSTR_VAL(name), ZSTR_LEN(name));
936 
937 			if (import_name) {
938 				return zend_string_copy(import_name);
939 			}
940 		}
941 	}
942 
943 	/* If not fully qualified and not an alias, prepend the current namespace */
944 	return zend_prefix_with_ns(name);
945 }
946 /* }}} */
947 
zend_resolve_class_name_ast(zend_ast *ast)948 zend_string *zend_resolve_class_name_ast(zend_ast *ast) /* {{{ */
949 {
950 	zval *class_name = zend_ast_get_zval(ast);
951 	if (Z_TYPE_P(class_name) != IS_STRING) {
952 		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
953 	}
954 	return zend_resolve_class_name(Z_STR_P(class_name), ast->attr);
955 }
956 /* }}} */
957 
label_ptr_dtor(zval *zv)958 static void label_ptr_dtor(zval *zv) /* {{{ */
959 {
960 	efree_size(Z_PTR_P(zv), sizeof(zend_label));
961 }
962 /* }}} */
963 
str_dtor(zval *zv)964 static void str_dtor(zval *zv)  /* {{{ */ {
965 	zend_string_release_ex(Z_STR_P(zv), 0);
966 }
967 /* }}} */
968 
969 static zend_bool zend_is_call(zend_ast *ast);
970 
zend_add_try_element(uint32_t try_op)971 static uint32_t zend_add_try_element(uint32_t try_op) /* {{{ */
972 {
973 	zend_op_array *op_array = CG(active_op_array);
974 	uint32_t try_catch_offset = op_array->last_try_catch++;
975 	zend_try_catch_element *elem;
976 
977 	op_array->try_catch_array = safe_erealloc(
978 		op_array->try_catch_array, sizeof(zend_try_catch_element), op_array->last_try_catch, 0);
979 
980 	elem = &op_array->try_catch_array[try_catch_offset];
981 	elem->try_op = try_op;
982 	elem->catch_op = 0;
983 	elem->finally_op = 0;
984 	elem->finally_end = 0;
985 
986 	return try_catch_offset;
987 }
988 /* }}} */
989 
function_add_ref(zend_function *function)990 ZEND_API void function_add_ref(zend_function *function) /* {{{ */
991 {
992 	if (function->type == ZEND_USER_FUNCTION) {
993 		zend_op_array *op_array = &function->op_array;
994 
995 		if (op_array->refcount) {
996 			(*op_array->refcount)++;
997 		}
998 		if (op_array->static_variables) {
999 			if (!(GC_FLAGS(op_array->static_variables) & IS_ARRAY_IMMUTABLE)) {
1000 				GC_ADDREF(op_array->static_variables);
1001 			}
1002 		}
1003 
1004 		if (CG(compiler_options) & ZEND_COMPILE_PRELOAD) {
1005 			ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_PRELOADED);
1006 			ZEND_MAP_PTR_NEW(op_array->run_time_cache);
1007 			ZEND_MAP_PTR_NEW(op_array->static_variables_ptr);
1008 		} else {
1009 			ZEND_MAP_PTR_INIT(op_array->static_variables_ptr, &op_array->static_variables);
1010 			ZEND_MAP_PTR_INIT(op_array->run_time_cache, zend_arena_alloc(&CG(arena), sizeof(void*)));
1011 			ZEND_MAP_PTR_SET(op_array->run_time_cache, NULL);
1012 		}
1013 	} else if (function->type == ZEND_INTERNAL_FUNCTION) {
1014 		if (function->common.function_name) {
1015 			zend_string_addref(function->common.function_name);
1016 		}
1017 	}
1018 }
1019 /* }}} */
1020 
do_bind_function_error(zend_string *lcname, zend_op_array *op_array, zend_bool compile_time)1021 static zend_never_inline ZEND_COLD ZEND_NORETURN void do_bind_function_error(zend_string *lcname, zend_op_array *op_array, zend_bool compile_time) /* {{{ */
1022 {
1023 	zval *zv = zend_hash_find_ex(compile_time ? CG(function_table) : EG(function_table), lcname, 1);
1024 	int error_level = compile_time ? E_COMPILE_ERROR : E_ERROR;
1025 	zend_function *old_function;
1026 
1027 	ZEND_ASSERT(zv != NULL);
1028 	old_function = (zend_function*)Z_PTR_P(zv);
1029 	if (old_function->type == ZEND_USER_FUNCTION
1030 		&& old_function->op_array.last > 0) {
1031 		zend_error_noreturn(error_level, "Cannot redeclare %s() (previously declared in %s:%d)",
1032 					op_array ? ZSTR_VAL(op_array->function_name) : ZSTR_VAL(old_function->common.function_name),
1033 					ZSTR_VAL(old_function->op_array.filename),
1034 					old_function->op_array.opcodes[0].lineno);
1035 	} else {
1036 		zend_error_noreturn(error_level, "Cannot redeclare %s()",
1037 			op_array ? ZSTR_VAL(op_array->function_name) : ZSTR_VAL(old_function->common.function_name));
1038 	}
1039 }
1040 
do_bind_function(zval *lcname)1041 ZEND_API int do_bind_function(zval *lcname) /* {{{ */
1042 {
1043 	zend_function *function;
1044 	zval *rtd_key, *zv;
1045 
1046 	rtd_key = lcname + 1;
1047 	zv = zend_hash_find_ex(EG(function_table), Z_STR_P(rtd_key), 1);
1048 	if (UNEXPECTED(!zv)) {
1049 		do_bind_function_error(Z_STR_P(lcname), NULL, 0);
1050 		return FAILURE;
1051 	}
1052 	function = (zend_function*)Z_PTR_P(zv);
1053 	if (UNEXPECTED(function->common.fn_flags & ZEND_ACC_PRELOADED)) {
1054 		zv = zend_hash_add(EG(function_table), Z_STR_P(lcname), zv);
1055 	} else {
1056 		zv = zend_hash_set_bucket_key(EG(function_table), (Bucket*)zv, Z_STR_P(lcname));
1057 	}
1058 	if (UNEXPECTED(!zv)) {
1059 		do_bind_function_error(Z_STR_P(lcname), &function->op_array, 0);
1060 		return FAILURE;
1061 	}
1062 	return SUCCESS;
1063 }
1064 /* }}} */
1065 
do_bind_class(zval *lcname, zend_string *lc_parent_name)1066 ZEND_API int do_bind_class(zval *lcname, zend_string *lc_parent_name) /* {{{ */
1067 {
1068 	zend_class_entry *ce;
1069 	zval *rtd_key, *zv;
1070 
1071 	rtd_key = lcname + 1;
1072 
1073 	zv = zend_hash_find_ex(EG(class_table), Z_STR_P(rtd_key), 1);
1074 
1075 	if (UNEXPECTED(!zv)) {
1076 		ce = zend_hash_find_ptr(EG(class_table), Z_STR_P(lcname));
1077 		if (ce) {
1078 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
1079 			return FAILURE;
1080 		} else {
1081 			do {
1082 				ZEND_ASSERT(EG(current_execute_data)->func->op_array.fn_flags & ZEND_ACC_PRELOADED);
1083 				if (zend_preload_autoload
1084 				  && zend_preload_autoload(EG(current_execute_data)->func->op_array.filename) == SUCCESS) {
1085 					zv = zend_hash_find_ex(EG(class_table), Z_STR_P(rtd_key), 1);
1086 					if (EXPECTED(zv != NULL)) {
1087 						break;
1088 					}
1089 				}
1090 				zend_error_noreturn(E_ERROR, "Class %s wasn't preloaded", Z_STRVAL_P(lcname));
1091 				return FAILURE;
1092 			} while (0);
1093 		}
1094 	}
1095 
1096 	/* Register the derived class */
1097 	ce = (zend_class_entry*)Z_PTR_P(zv);
1098 	zv = zend_hash_set_bucket_key(EG(class_table), (Bucket*)zv, Z_STR_P(lcname));
1099 	if (UNEXPECTED(!zv)) {
1100 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot declare %s %s, because the name is already in use", zend_get_object_type(ce), ZSTR_VAL(ce->name));
1101 		return FAILURE;
1102 	}
1103 
1104 	if (zend_do_link_class(ce, lc_parent_name) == FAILURE) {
1105 		/* Reload bucket pointer, the hash table may have been reallocated */
1106 		zv = zend_hash_find(EG(class_table), Z_STR_P(lcname));
1107 		zend_hash_set_bucket_key(EG(class_table), (Bucket *) zv, Z_STR_P(rtd_key));
1108 		return FAILURE;
1109 	}
1110 
1111 	return SUCCESS;
1112 }
1113 /* }}} */
1114 
zend_mark_function_as_generatornull1115 static void zend_mark_function_as_generator() /* {{{ */
1116 {
1117 	if (!CG(active_op_array)->function_name) {
1118 		zend_error_noreturn(E_COMPILE_ERROR,
1119 			"The \"yield\" expression can only be used inside a function");
1120 	}
1121 
1122 	if (CG(active_op_array)->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
1123 		zend_arg_info return_info = CG(active_op_array)->arg_info[-1];
1124 
1125 		if (ZEND_TYPE_CODE(return_info.type) != IS_ITERABLE) {
1126 			const char *msg = "Generators may only declare a return type of Generator, Iterator, Traversable, or iterable, %s is not permitted";
1127 
1128 			if (!ZEND_TYPE_IS_CLASS(return_info.type)) {
1129 				zend_error_noreturn(E_COMPILE_ERROR, msg, zend_get_type_by_const(ZEND_TYPE_CODE(return_info.type)));
1130 			}
1131 
1132 			if (!zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Traversable")
1133 				&& !zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Iterator")
1134 				&& !zend_string_equals_literal_ci(ZEND_TYPE_NAME(return_info.type), "Generator")) {
1135 				zend_error_noreturn(E_COMPILE_ERROR, msg, ZSTR_VAL(ZEND_TYPE_NAME(return_info.type)));
1136 			}
1137 		}
1138 	}
1139 
1140 	CG(active_op_array)->fn_flags |= ZEND_ACC_GENERATOR;
1141 }
1142 /* }}} */
1143 
zend_build_delayed_early_binding_list(const zend_op_array *op_array)1144 ZEND_API uint32_t zend_build_delayed_early_binding_list(const zend_op_array *op_array) /* {{{ */
1145 {
1146 	if (op_array->fn_flags & ZEND_ACC_EARLY_BINDING) {
1147 		uint32_t  first_early_binding_opline = (uint32_t)-1;
1148 		uint32_t *prev_opline_num = &first_early_binding_opline;
1149 		zend_op  *opline = op_array->opcodes;
1150 		zend_op  *end = opline + op_array->last;
1151 
1152 		while (opline < end) {
1153 			if (opline->opcode == ZEND_DECLARE_CLASS_DELAYED) {
1154 				*prev_opline_num = opline - op_array->opcodes;
1155 				prev_opline_num = &opline->result.opline_num;
1156 			}
1157 			++opline;
1158 		}
1159 		*prev_opline_num = -1;
1160 		return first_early_binding_opline;
1161 	}
1162 	return (uint32_t)-1;
1163 }
1164 /* }}} */
1165 
zend_do_delayed_early_binding(zend_op_array *op_array, uint32_t first_early_binding_opline)1166 ZEND_API void zend_do_delayed_early_binding(zend_op_array *op_array, uint32_t first_early_binding_opline) /* {{{ */
1167 {
1168 	if (first_early_binding_opline != (uint32_t)-1) {
1169 		zend_bool orig_in_compilation = CG(in_compilation);
1170 		uint32_t opline_num = first_early_binding_opline;
1171 		void **run_time_cache;
1172 
1173 		if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
1174 			void *ptr;
1175 
1176 			ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
1177 			ptr = emalloc(op_array->cache_size + sizeof(void*));
1178 			ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
1179 			ptr = (char*)ptr + sizeof(void*);
1180 			ZEND_MAP_PTR_SET(op_array->run_time_cache, ptr);
1181 			memset(ptr, 0, op_array->cache_size);
1182 		}
1183 		run_time_cache = RUN_TIME_CACHE(op_array);
1184 
1185 		CG(in_compilation) = 1;
1186 		while (opline_num != (uint32_t)-1) {
1187 			const zend_op *opline = &op_array->opcodes[opline_num];
1188 			zval *lcname = RT_CONSTANT(opline, opline->op1);
1189 			zval *zv = zend_hash_find_ex(EG(class_table), Z_STR_P(lcname + 1), 1);
1190 
1191 			if (zv) {
1192 				zend_class_entry *ce = Z_CE_P(zv);
1193 				zend_string *lc_parent_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1194 				zend_class_entry *parent_ce = zend_hash_find_ex_ptr(EG(class_table), lc_parent_name, 1);
1195 
1196 				if (parent_ce) {
1197 					if (zend_try_early_bind(ce, parent_ce, Z_STR_P(lcname), zv)) {
1198 						/* Store in run-time cache */
1199 						((void**)((char*)run_time_cache + opline->extended_value))[0] = ce;
1200 					}
1201 				}
1202 			}
1203 			opline_num = op_array->opcodes[opline_num].result.opline_num;
1204 		}
1205 		CG(in_compilation) = orig_in_compilation;
1206 	}
1207 }
1208 /* }}} */
1209 
zend_mangle_property_name(const char *src1, size_t src1_length, const char *src2, size_t src2_length, int internal)1210 ZEND_API zend_string *zend_mangle_property_name(const char *src1, size_t src1_length, const char *src2, size_t src2_length, int internal) /* {{{ */
1211 {
1212 	size_t prop_name_length = 1 + src1_length + 1 + src2_length;
1213 	zend_string *prop_name = zend_string_alloc(prop_name_length, internal);
1214 
1215 	ZSTR_VAL(prop_name)[0] = '\0';
1216 	memcpy(ZSTR_VAL(prop_name) + 1, src1, src1_length+1);
1217 	memcpy(ZSTR_VAL(prop_name) + 1 + src1_length + 1, src2, src2_length+1);
1218 	return prop_name;
1219 }
1220 /* }}} */
1221 
zend_strnlen(const char* s, size_t maxlen)1222 static zend_always_inline size_t zend_strnlen(const char* s, size_t maxlen) /* {{{ */
1223 {
1224 	size_t len = 0;
1225 	while (*s++ && maxlen--) len++;
1226 	return len;
1227 }
1228 /* }}} */
1229 
zend_unmangle_property_name_ex(const zend_string *name, const char **class_name, const char **prop_name, size_t *prop_len)1230 ZEND_API int zend_unmangle_property_name_ex(const zend_string *name, const char **class_name, const char **prop_name, size_t *prop_len) /* {{{ */
1231 {
1232 	size_t class_name_len;
1233 	size_t anonclass_src_len;
1234 
1235 	*class_name = NULL;
1236 
1237 	if (!ZSTR_LEN(name) || ZSTR_VAL(name)[0] != '\0') {
1238 		*prop_name = ZSTR_VAL(name);
1239 		if (prop_len) {
1240 			*prop_len = ZSTR_LEN(name);
1241 		}
1242 		return SUCCESS;
1243 	}
1244 	if (ZSTR_LEN(name) < 3 || ZSTR_VAL(name)[1] == '\0') {
1245 		zend_error(E_NOTICE, "Illegal member variable name");
1246 		*prop_name = ZSTR_VAL(name);
1247 		if (prop_len) {
1248 			*prop_len = ZSTR_LEN(name);
1249 		}
1250 		return FAILURE;
1251 	}
1252 
1253 	class_name_len = zend_strnlen(ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 2);
1254 	if (class_name_len >= ZSTR_LEN(name) - 2 || ZSTR_VAL(name)[class_name_len + 1] != '\0') {
1255 		zend_error(E_NOTICE, "Corrupt member variable name");
1256 		*prop_name = ZSTR_VAL(name);
1257 		if (prop_len) {
1258 			*prop_len = ZSTR_LEN(name);
1259 		}
1260 		return FAILURE;
1261 	}
1262 
1263 	*class_name = ZSTR_VAL(name) + 1;
1264 	anonclass_src_len = zend_strnlen(*class_name + class_name_len + 1, ZSTR_LEN(name) - class_name_len - 2);
1265 	if (class_name_len + anonclass_src_len + 2 != ZSTR_LEN(name)) {
1266 		class_name_len += anonclass_src_len + 1;
1267 	}
1268 	*prop_name = ZSTR_VAL(name) + class_name_len + 2;
1269 	if (prop_len) {
1270 		*prop_len = ZSTR_LEN(name) - class_name_len - 2;
1271 	}
1272 	return SUCCESS;
1273 }
1274 /* }}} */
1275 
zend_lookup_reserved_const(const char *name, size_t len)1276 static zend_constant *zend_lookup_reserved_const(const char *name, size_t len) /* {{{ */
1277 {
1278 	zend_constant *c = zend_hash_find_ptr_lc(EG(zend_constants), name, len);
1279 	if (c && !(ZEND_CONSTANT_FLAGS(c) & CONST_CS) && (ZEND_CONSTANT_FLAGS(c) & CONST_CT_SUBST)) {
1280 		return c;
1281 	}
1282 	return NULL;
1283 }
1284 /* }}} */
1285 
zend_try_ct_eval_const(zval *zv, zend_string *name, zend_bool is_fully_qualified)1286 static zend_bool zend_try_ct_eval_const(zval *zv, zend_string *name, zend_bool is_fully_qualified) /* {{{ */
1287 {
1288 	zend_constant *c;
1289 
1290 	/* Substitute case-sensitive (or lowercase) constants */
1291 	c = zend_hash_find_ptr(EG(zend_constants), name);
1292 	if (c && (
1293 	      ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
1294 	      && !(CG(compiler_options) & ZEND_COMPILE_NO_PERSISTENT_CONSTANT_SUBSTITUTION)
1295 	      && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE) || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE)))
1296 	   || (Z_TYPE(c->value) < IS_OBJECT && !(CG(compiler_options) & ZEND_COMPILE_NO_CONSTANT_SUBSTITUTION))
1297 	)) {
1298 		ZVAL_COPY_OR_DUP(zv, &c->value);
1299 		return 1;
1300 	}
1301 
1302 	{
1303 		/* Substitute true, false and null (including unqualified usage in namespaces) */
1304 		const char *lookup_name = ZSTR_VAL(name);
1305 		size_t lookup_len = ZSTR_LEN(name);
1306 
1307 		if (!is_fully_qualified) {
1308 			zend_get_unqualified_name(name, &lookup_name, &lookup_len);
1309 		}
1310 
1311 		c = zend_lookup_reserved_const(lookup_name, lookup_len);
1312 		if (c) {
1313 			ZVAL_COPY_OR_DUP(zv, &c->value);
1314 			return 1;
1315 		}
1316 	}
1317 
1318 	return 0;
1319 }
1320 /* }}} */
1321 
zend_is_scope_knownnull1322 static inline zend_bool zend_is_scope_known() /* {{{ */
1323 {
1324 	if (CG(active_op_array)->fn_flags & ZEND_ACC_CLOSURE) {
1325 		/* Closures can be rebound to a different scope */
1326 		return 0;
1327 	}
1328 
1329 	if (!CG(active_class_entry)) {
1330 		/* The scope is known if we're in a free function (no scope), but not if we're in
1331 		 * a file/eval (which inherits including/eval'ing scope). */
1332 		return CG(active_op_array)->function_name != NULL;
1333 	}
1334 
1335 	/* For traits self etc refers to the using class, not the trait itself */
1336 	return (CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) == 0;
1337 }
1338 /* }}} */
1339 
class_name_refers_to_active_ce(zend_string *class_name, uint32_t fetch_type)1340 static inline zend_bool class_name_refers_to_active_ce(zend_string *class_name, uint32_t fetch_type) /* {{{ */
1341 {
1342 	if (!CG(active_class_entry)) {
1343 		return 0;
1344 	}
1345 	if (fetch_type == ZEND_FETCH_CLASS_SELF && zend_is_scope_known()) {
1346 		return 1;
1347 	}
1348 	return fetch_type == ZEND_FETCH_CLASS_DEFAULT
1349 		&& zend_string_equals_ci(class_name, CG(active_class_entry)->name);
1350 }
1351 /* }}} */
1352 
zend_get_class_fetch_type(zend_string *name)1353 uint32_t zend_get_class_fetch_type(zend_string *name) /* {{{ */
1354 {
1355 	if (zend_string_equals_literal_ci(name, "self")) {
1356 		return ZEND_FETCH_CLASS_SELF;
1357 	} else if (zend_string_equals_literal_ci(name, "parent")) {
1358 		return ZEND_FETCH_CLASS_PARENT;
1359 	} else if (zend_string_equals_literal_ci(name, "static")) {
1360 		return ZEND_FETCH_CLASS_STATIC;
1361 	} else {
1362 		return ZEND_FETCH_CLASS_DEFAULT;
1363 	}
1364 }
1365 /* }}} */
1366 
zend_get_class_fetch_type_ast(zend_ast *name_ast)1367 static uint32_t zend_get_class_fetch_type_ast(zend_ast *name_ast) /* {{{ */
1368 {
1369 	/* Fully qualified names are always default refs */
1370 	if (name_ast->attr == ZEND_NAME_FQ) {
1371 		return ZEND_FETCH_CLASS_DEFAULT;
1372 	}
1373 
1374 	return zend_get_class_fetch_type(zend_ast_get_str(name_ast));
1375 }
1376 /* }}} */
1377 
zend_ensure_valid_class_fetch_type(uint32_t fetch_type)1378 static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
1379 {
1380 	if (fetch_type != ZEND_FETCH_CLASS_DEFAULT && zend_is_scope_known()) {
1381 		zend_class_entry *ce = CG(active_class_entry);
1382 		if (!ce) {
1383 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use \"%s\" when no class scope is active",
1384 				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
1385 				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
1386 		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT && !ce->parent_name) {
1387 			zend_error(E_DEPRECATED,
1388 				"Cannot use \"parent\" when current class scope has no parent");
1389 		}
1390 	}
1391 }
1392 /* }}} */
1393 
zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast)1394 static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast) /* {{{ */
1395 {
1396 	uint32_t fetch_type;
1397 	zval *class_name;
1398 
1399 	if (class_ast->kind != ZEND_AST_ZVAL) {
1400 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use ::class with dynamic class name");
1401 	}
1402 
1403 	class_name = zend_ast_get_zval(class_ast);
1404 
1405 	if (Z_TYPE_P(class_name) != IS_STRING) {
1406 		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
1407 	}
1408 
1409 	fetch_type = zend_get_class_fetch_type(Z_STR_P(class_name));
1410 	zend_ensure_valid_class_fetch_type(fetch_type);
1411 
1412 	switch (fetch_type) {
1413 		case ZEND_FETCH_CLASS_SELF:
1414 			if (CG(active_class_entry) && zend_is_scope_known()) {
1415 				ZVAL_STR_COPY(zv, CG(active_class_entry)->name);
1416 				return 1;
1417 			}
1418 			return 0;
1419 		case ZEND_FETCH_CLASS_PARENT:
1420 			if (CG(active_class_entry) && CG(active_class_entry)->parent_name
1421 					&& zend_is_scope_known()) {
1422 				ZVAL_STR_COPY(zv, CG(active_class_entry)->parent_name);
1423 				return 1;
1424 			}
1425 			return 0;
1426 		case ZEND_FETCH_CLASS_STATIC:
1427 			return 0;
1428 		case ZEND_FETCH_CLASS_DEFAULT:
1429 			ZVAL_STR(zv, zend_resolve_class_name_ast(class_ast));
1430 			return 1;
1431 		EMPTY_SWITCH_DEFAULT_CASE()
1432 	}
1433 }
1434 /* }}} */
1435 
1436 /* We don't use zend_verify_const_access because we need to deal with unlinked classes. */
zend_verify_ct_const_access(zend_class_constant *c, zend_class_entry *scope)1437 static zend_bool zend_verify_ct_const_access(zend_class_constant *c, zend_class_entry *scope)
1438 {
1439 	if (Z_ACCESS_FLAGS(c->value) & ZEND_ACC_PUBLIC) {
1440 		return 1;
1441 	} else if (Z_ACCESS_FLAGS(c->value) & ZEND_ACC_PRIVATE) {
1442 		return c->ce == scope;
1443 	} else {
1444 		zend_class_entry *ce = c->ce;
1445 		while (1) {
1446 			if (ce == scope) {
1447 				return 1;
1448 			}
1449 			if (!ce->parent) {
1450 				break;
1451 			}
1452 			if (ce->ce_flags & ZEND_ACC_RESOLVED_PARENT) {
1453 				ce = ce->parent;
1454 			} else {
1455 				ce = zend_hash_find_ptr_lc(CG(class_table), ZSTR_VAL(ce->parent_name), ZSTR_LEN(ce->parent_name));
1456 				if (!ce) {
1457 					break;
1458 				}
1459 			}
1460 		}
1461 		/* Reverse case cannot be true during compilation */
1462 		return 0;
1463 	}
1464 }
1465 
zend_try_ct_eval_class_const(zval *zv, zend_string *class_name, zend_string *name)1466 static zend_bool zend_try_ct_eval_class_const(zval *zv, zend_string *class_name, zend_string *name) /* {{{ */
1467 {
1468 	uint32_t fetch_type = zend_get_class_fetch_type(class_name);
1469 	zend_class_constant *cc;
1470 	zval *c;
1471 
1472 	if (class_name_refers_to_active_ce(class_name, fetch_type)) {
1473 		cc = zend_hash_find_ptr(&CG(active_class_entry)->constants_table, name);
1474 	} else if (fetch_type == ZEND_FETCH_CLASS_DEFAULT && !(CG(compiler_options) & ZEND_COMPILE_NO_CONSTANT_SUBSTITUTION)) {
1475 		zend_class_entry *ce = zend_hash_find_ptr_lc(CG(class_table), ZSTR_VAL(class_name), ZSTR_LEN(class_name));
1476 		if (ce) {
1477 			cc = zend_hash_find_ptr(&ce->constants_table, name);
1478 		} else {
1479 			return 0;
1480 		}
1481 	} else {
1482 		return 0;
1483 	}
1484 
1485 	if (CG(compiler_options) & ZEND_COMPILE_NO_PERSISTENT_CONSTANT_SUBSTITUTION) {
1486 		return 0;
1487 	}
1488 
1489 	if (!cc || !zend_verify_ct_const_access(cc, CG(active_class_entry))) {
1490 		return 0;
1491 	}
1492 
1493 	c = &cc->value;
1494 
1495 	/* Substitute case-sensitive (or lowercase) persistent class constants */
1496 	if (Z_TYPE_P(c) < IS_OBJECT) {
1497 		ZVAL_COPY_OR_DUP(zv, c);
1498 		return 1;
1499 	}
1500 
1501 	return 0;
1502 }
1503 /* }}} */
1504 
zend_add_to_list(void *result, void *item)1505 static void zend_add_to_list(void *result, void *item) /* {{{ */
1506 {
1507 	void** list = *(void**)result;
1508 	size_t n = 0;
1509 
1510 	if (list) {
1511 		while (list[n]) {
1512 			n++;
1513 		}
1514 	}
1515 
1516 	list = erealloc(list, sizeof(void*) * (n+2));
1517 
1518 	list[n]   = item;
1519 	list[n+1] = NULL;
1520 
1521 	*(void**)result = list;
1522 }
1523 /* }}} */
1524 
zend_do_extended_stmt(void)1525 void zend_do_extended_stmt(void) /* {{{ */
1526 {
1527 	zend_op *opline;
1528 
1529 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT)) {
1530 		return;
1531 	}
1532 
1533 	opline = get_next_op();
1534 
1535 	opline->opcode = ZEND_EXT_STMT;
1536 }
1537 /* }}} */
1538 
zend_do_extended_fcall_begin(void)1539 void zend_do_extended_fcall_begin(void) /* {{{ */
1540 {
1541 	zend_op *opline;
1542 
1543 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_FCALL)) {
1544 		return;
1545 	}
1546 
1547 	opline = get_next_op();
1548 
1549 	opline->opcode = ZEND_EXT_FCALL_BEGIN;
1550 }
1551 /* }}} */
1552 
zend_do_extended_fcall_end(void)1553 void zend_do_extended_fcall_end(void) /* {{{ */
1554 {
1555 	zend_op *opline;
1556 
1557 	if (!(CG(compiler_options) & ZEND_COMPILE_EXTENDED_FCALL)) {
1558 		return;
1559 	}
1560 
1561 	opline = get_next_op();
1562 
1563 	opline->opcode = ZEND_EXT_FCALL_END;
1564 }
1565 /* }}} */
1566 
zend_is_auto_global_str(char *name, size_t len)1567 zend_bool zend_is_auto_global_str(char *name, size_t len) /* {{{ */ {
1568 	zend_auto_global *auto_global;
1569 
1570 	if ((auto_global = zend_hash_str_find_ptr(CG(auto_globals), name, len)) != NULL) {
1571 		if (auto_global->armed) {
1572 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1573 		}
1574 		return 1;
1575 	}
1576 	return 0;
1577 }
1578 /* }}} */
1579 
zend_is_auto_global(zend_string *name)1580 zend_bool zend_is_auto_global(zend_string *name) /* {{{ */
1581 {
1582 	zend_auto_global *auto_global;
1583 
1584 	if ((auto_global = zend_hash_find_ptr(CG(auto_globals), name)) != NULL) {
1585 		if (auto_global->armed) {
1586 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1587 		}
1588 		return 1;
1589 	}
1590 	return 0;
1591 }
1592 /* }}} */
1593 
zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global_callback auto_global_callback)1594 int zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global_callback auto_global_callback) /* {{{ */
1595 {
1596 	zend_auto_global auto_global;
1597 	int retval;
1598 
1599 	auto_global.name = name;
1600 	auto_global.auto_global_callback = auto_global_callback;
1601 	auto_global.jit = jit;
1602 
1603 	retval = zend_hash_add_mem(CG(auto_globals), auto_global.name, &auto_global, sizeof(zend_auto_global)) != NULL ? SUCCESS : FAILURE;
1604 
1605 	return retval;
1606 }
1607 /* }}} */
1608 
zend_activate_auto_globals(void)1609 ZEND_API void zend_activate_auto_globals(void) /* {{{ */
1610 {
1611 	zend_auto_global *auto_global;
1612 
1613 	ZEND_HASH_FOREACH_PTR(CG(auto_globals), auto_global) {
1614 		if (auto_global->jit) {
1615 			auto_global->armed = 1;
1616 		} else if (auto_global->auto_global_callback) {
1617 			auto_global->armed = auto_global->auto_global_callback(auto_global->name);
1618 		} else {
1619 			auto_global->armed = 0;
1620 		}
1621 	} ZEND_HASH_FOREACH_END();
1622 }
1623 /* }}} */
1624 
zendlex(zend_parser_stack_elem *elem)1625 int ZEND_FASTCALL zendlex(zend_parser_stack_elem *elem) /* {{{ */
1626 {
1627 	zval zv;
1628 	int ret;
1629 
1630 	if (CG(increment_lineno)) {
1631 		CG(zend_lineno)++;
1632 		CG(increment_lineno) = 0;
1633 	}
1634 
1635 	ret = lex_scan(&zv, elem);
1636 	ZEND_ASSERT(!EG(exception) || ret == T_ERROR);
1637 	return ret;
1638 
1639 }
1640 /* }}} */
1641 
zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers)1642 ZEND_API void zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers) /* {{{ */
1643 {
1644 	zend_bool persistent_hashes = ce->type == ZEND_INTERNAL_CLASS;
1645 
1646 	ce->refcount = 1;
1647 	ce->ce_flags = ZEND_ACC_CONSTANTS_UPDATED;
1648 
1649 	if (CG(compiler_options) & ZEND_COMPILE_GUARDS) {
1650 		ce->ce_flags |= ZEND_ACC_USE_GUARDS;
1651 	}
1652 
1653 	ce->default_properties_table = NULL;
1654 	ce->default_static_members_table = NULL;
1655 	zend_hash_init_ex(&ce->properties_info, 8, NULL, (persistent_hashes ? zend_destroy_property_info_internal : NULL), persistent_hashes, 0);
1656 	zend_hash_init_ex(&ce->constants_table, 8, NULL, NULL, persistent_hashes, 0);
1657 	zend_hash_init_ex(&ce->function_table, 8, NULL, ZEND_FUNCTION_DTOR, persistent_hashes, 0);
1658 
1659 	if (ce->type == ZEND_INTERNAL_CLASS) {
1660 		ZEND_MAP_PTR_INIT(ce->static_members_table, NULL);
1661 	} else {
1662 		ZEND_MAP_PTR_INIT(ce->static_members_table, &ce->default_static_members_table);
1663 		ce->info.user.doc_comment = NULL;
1664 	}
1665 
1666 	ce->default_properties_count = 0;
1667 	ce->default_static_members_count = 0;
1668 	ce->properties_info_table = NULL;
1669 
1670 	if (nullify_handlers) {
1671 		ce->constructor = NULL;
1672 		ce->destructor = NULL;
1673 		ce->clone = NULL;
1674 		ce->__get = NULL;
1675 		ce->__set = NULL;
1676 		ce->__unset = NULL;
1677 		ce->__isset = NULL;
1678 		ce->__call = NULL;
1679 		ce->__callstatic = NULL;
1680 		ce->__tostring = NULL;
1681 		ce->create_object = NULL;
1682 		ce->get_iterator = NULL;
1683 		ce->iterator_funcs_ptr = NULL;
1684 		ce->get_static_method = NULL;
1685 		ce->parent = NULL;
1686 		ce->parent_name = NULL;
1687 		ce->num_interfaces = 0;
1688 		ce->interfaces = NULL;
1689 		ce->num_traits = 0;
1690 		ce->trait_names = NULL;
1691 		ce->trait_aliases = NULL;
1692 		ce->trait_precedences = NULL;
1693 		ce->serialize = NULL;
1694 		ce->unserialize = NULL;
1695 		ce->serialize_func = NULL;
1696 		ce->unserialize_func = NULL;
1697 		ce->__debugInfo = NULL;
1698 		if (ce->type == ZEND_INTERNAL_CLASS) {
1699 			ce->info.internal.module = NULL;
1700 			ce->info.internal.builtin_functions = NULL;
1701 		}
1702 	}
1703 }
1704 /* }}} */
1705 
zend_get_compiled_variable_name(const zend_op_array *op_array, uint32_t var)1706 ZEND_API zend_string *zend_get_compiled_variable_name(const zend_op_array *op_array, uint32_t var) /* {{{ */
1707 {
1708 	return op_array->vars[EX_VAR_TO_NUM(var)];
1709 }
1710 /* }}} */
1711 
zend_ast_append_str(zend_ast *left_ast, zend_ast *right_ast)1712 zend_ast *zend_ast_append_str(zend_ast *left_ast, zend_ast *right_ast) /* {{{ */
1713 {
1714 	zval *left_zv = zend_ast_get_zval(left_ast);
1715 	zend_string *left = Z_STR_P(left_zv);
1716 	zend_string *right = zend_ast_get_str(right_ast);
1717 
1718 	zend_string *result;
1719 	size_t left_len = ZSTR_LEN(left);
1720 	size_t len = left_len + ZSTR_LEN(right) + 1; /* left\right */
1721 
1722 	result = zend_string_extend(left, len, 0);
1723 	ZSTR_VAL(result)[left_len] = '\\';
1724 	memcpy(&ZSTR_VAL(result)[left_len + 1], ZSTR_VAL(right), ZSTR_LEN(right));
1725 	ZSTR_VAL(result)[len] = '\0';
1726 	zend_string_release_ex(right, 0);
1727 
1728 	ZVAL_STR(left_zv, result);
1729 	return left_ast;
1730 }
1731 /* }}} */
1732 
zend_negate_num_string(zend_ast *ast)1733 zend_ast *zend_negate_num_string(zend_ast *ast) /* {{{ */
1734 {
1735 	zval *zv = zend_ast_get_zval(ast);
1736 	if (Z_TYPE_P(zv) == IS_LONG) {
1737 		if (Z_LVAL_P(zv) == 0) {
1738 			ZVAL_NEW_STR(zv, zend_string_init("-0", sizeof("-0")-1, 0));
1739 		} else {
1740 			ZEND_ASSERT(Z_LVAL_P(zv) > 0);
1741 			Z_LVAL_P(zv) *= -1;
1742 		}
1743 	} else if (Z_TYPE_P(zv) == IS_STRING) {
1744 		size_t orig_len = Z_STRLEN_P(zv);
1745 		Z_STR_P(zv) = zend_string_extend(Z_STR_P(zv), orig_len + 1, 0);
1746 		memmove(Z_STRVAL_P(zv) + 1, Z_STRVAL_P(zv), orig_len + 1);
1747 		Z_STRVAL_P(zv)[0] = '-';
1748 	} else {
1749 		ZEND_ASSERT(0);
1750 	}
1751 	return ast;
1752 }
1753 /* }}} */
1754 
zend_verify_namespace(void)1755 void zend_verify_namespace(void) /* {{{ */
1756 {
1757 	if (FC(has_bracketed_namespaces) && !FC(in_namespace)) {
1758 		zend_error_noreturn(E_COMPILE_ERROR, "No code may exist outside of namespace {}");
1759 	}
1760 }
1761 /* }}} */
1762 
1763 /* {{{ zend_dirname
1764    Returns directory name component of path */
zend_dirname(char *path, size_t len)1765 ZEND_API size_t zend_dirname(char *path, size_t len)
1766 {
1767 	register char *end = path + len - 1;
1768 	unsigned int len_adjust = 0;
1769 
1770 #ifdef ZEND_WIN32
1771 	/* Note that on Win32 CWD is per drive (heritage from CP/M).
1772 	 * This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive.
1773 	 */
1774 	if ((2 <= len) && isalpha((int)((unsigned char *)path)[0]) && (':' == path[1])) {
1775 		/* Skip over the drive spec (if any) so as not to change */
1776 		path += 2;
1777 		len_adjust += 2;
1778 		if (2 == len) {
1779 			/* Return "c:" on Win32 for dirname("c:").
1780 			 * It would be more consistent to return "c:."
1781 			 * but that would require making the string *longer*.
1782 			 */
1783 			return len;
1784 		}
1785 	}
1786 #endif
1787 
1788 	if (len == 0) {
1789 		/* Illegal use of this function */
1790 		return 0;
1791 	}
1792 
1793 	/* Strip trailing slashes */
1794 	while (end >= path && IS_SLASH_P(end)) {
1795 		end--;
1796 	}
1797 	if (end < path) {
1798 		/* The path only contained slashes */
1799 		path[0] = DEFAULT_SLASH;
1800 		path[1] = '\0';
1801 		return 1 + len_adjust;
1802 	}
1803 
1804 	/* Strip filename */
1805 	while (end >= path && !IS_SLASH_P(end)) {
1806 		end--;
1807 	}
1808 	if (end < path) {
1809 		/* No slash found, therefore return '.' */
1810 		path[0] = '.';
1811 		path[1] = '\0';
1812 		return 1 + len_adjust;
1813 	}
1814 
1815 	/* Strip slashes which came before the file name */
1816 	while (end >= path && IS_SLASH_P(end)) {
1817 		end--;
1818 	}
1819 	if (end < path) {
1820 		path[0] = DEFAULT_SLASH;
1821 		path[1] = '\0';
1822 		return 1 + len_adjust;
1823 	}
1824 	*(end+1) = '\0';
1825 
1826 	return (size_t)(end + 1 - path) + len_adjust;
1827 }
1828 /* }}} */
1829 
zend_adjust_for_fetch_type(zend_op *opline, znode *result, uint32_t type)1830 static void zend_adjust_for_fetch_type(zend_op *opline, znode *result, uint32_t type) /* {{{ */
1831 {
1832 	zend_uchar factor = (opline->opcode == ZEND_FETCH_STATIC_PROP_R) ? 1 : 3;
1833 
1834 	switch (type) {
1835 		case BP_VAR_R:
1836 			opline->result_type = IS_TMP_VAR;
1837 			result->op_type = IS_TMP_VAR;
1838 			return;
1839 		case BP_VAR_W:
1840 			opline->opcode += 1 * factor;
1841 			return;
1842 		case BP_VAR_RW:
1843 			opline->opcode += 2 * factor;
1844 			return;
1845 		case BP_VAR_IS:
1846 			opline->result_type = IS_TMP_VAR;
1847 			result->op_type = IS_TMP_VAR;
1848 			opline->opcode += 3 * factor;
1849 			return;
1850 		case BP_VAR_FUNC_ARG:
1851 			opline->opcode += 4 * factor;
1852 			return;
1853 		case BP_VAR_UNSET:
1854 			opline->opcode += 5 * factor;
1855 			return;
1856 		EMPTY_SWITCH_DEFAULT_CASE()
1857 	}
1858 }
1859 /* }}} */
1860 
zend_make_var_result(znode *result, zend_op *opline)1861 static inline void zend_make_var_result(znode *result, zend_op *opline) /* {{{ */
1862 {
1863 	opline->result_type = IS_VAR;
1864 	opline->result.var = get_temporary_variable();
1865 	GET_NODE(result, opline->result);
1866 }
1867 /* }}} */
1868 
zend_make_tmp_result(znode *result, zend_op *opline)1869 static inline void zend_make_tmp_result(znode *result, zend_op *opline) /* {{{ */
1870 {
1871 	opline->result_type = IS_TMP_VAR;
1872 	opline->result.var = get_temporary_variable();
1873 	GET_NODE(result, opline->result);
1874 }
1875 /* }}} */
1876 
zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2)1877 static zend_op *zend_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
1878 {
1879 	zend_op *opline = get_next_op();
1880 	opline->opcode = opcode;
1881 
1882 	if (op1 != NULL) {
1883 		SET_NODE(opline->op1, op1);
1884 	}
1885 
1886 	if (op2 != NULL) {
1887 		SET_NODE(opline->op2, op2);
1888 	}
1889 
1890 	if (result) {
1891 		zend_make_var_result(result, opline);
1892 	}
1893 	return opline;
1894 }
1895 /* }}} */
1896 
zend_emit_op_tmp(znode *result, zend_uchar opcode, znode *op1, znode *op2)1897 static zend_op *zend_emit_op_tmp(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
1898 {
1899 	zend_op *opline = get_next_op();
1900 	opline->opcode = opcode;
1901 
1902 	if (op1 != NULL) {
1903 		SET_NODE(opline->op1, op1);
1904 	}
1905 
1906 	if (op2 != NULL) {
1907 		SET_NODE(opline->op2, op2);
1908 	}
1909 
1910 	if (result) {
1911 		zend_make_tmp_result(result, opline);
1912 	}
1913 
1914 	return opline;
1915 }
1916 /* }}} */
1917 
zend_emit_tick(void)1918 static void zend_emit_tick(void) /* {{{ */
1919 {
1920 	zend_op *opline;
1921 
1922 	/* This prevents a double TICK generated by the parser statement of "declare()" */
1923 	if (CG(active_op_array)->last && CG(active_op_array)->opcodes[CG(active_op_array)->last - 1].opcode == ZEND_TICKS) {
1924 		return;
1925 	}
1926 
1927 	opline = get_next_op();
1928 
1929 	opline->opcode = ZEND_TICKS;
1930 	opline->extended_value = FC(declarables).ticks;
1931 }
1932 /* }}} */
1933 
zend_emit_op_data(znode *value)1934 static inline zend_op *zend_emit_op_data(znode *value) /* {{{ */
1935 {
1936 	return zend_emit_op(NULL, ZEND_OP_DATA, value, NULL);
1937 }
1938 /* }}} */
1939 
zend_emit_jump(uint32_t opnum_target)1940 static inline uint32_t zend_emit_jump(uint32_t opnum_target) /* {{{ */
1941 {
1942 	uint32_t opnum = get_next_op_number();
1943 	zend_op *opline = zend_emit_op(NULL, ZEND_JMP, NULL, NULL);
1944 	opline->op1.opline_num = opnum_target;
1945 	return opnum;
1946 }
1947 /* }}} */
1948 
zend_is_smart_branch(zend_op *opline)1949 ZEND_API int zend_is_smart_branch(zend_op *opline) /* {{{ */
1950 {
1951 	switch (opline->opcode) {
1952 		case ZEND_IS_IDENTICAL:
1953 		case ZEND_IS_NOT_IDENTICAL:
1954 		case ZEND_IS_EQUAL:
1955 		case ZEND_IS_NOT_EQUAL:
1956 		case ZEND_IS_SMALLER:
1957 		case ZEND_IS_SMALLER_OR_EQUAL:
1958 		case ZEND_CASE:
1959 		case ZEND_ISSET_ISEMPTY_CV:
1960 		case ZEND_ISSET_ISEMPTY_VAR:
1961 		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1962 		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1963 		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1964 		case ZEND_INSTANCEOF:
1965 		case ZEND_TYPE_CHECK:
1966 		case ZEND_DEFINED:
1967 		case ZEND_IN_ARRAY:
1968 		case ZEND_ARRAY_KEY_EXISTS:
1969 			return 1;
1970 		default:
1971 			return 0;
1972 	}
1973 }
1974 /* }}} */
1975 
zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target)1976 static inline uint32_t zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target) /* {{{ */
1977 {
1978 	uint32_t opnum = get_next_op_number();
1979 	zend_op *opline;
1980 
1981 	if ((cond->op_type & (IS_CV|IS_CONST))
1982 	 && opnum > 0
1983 	 && zend_is_smart_branch(CG(active_op_array)->opcodes + opnum - 1)) {
1984 		/* emit extra NOP to avoid incorrect SMART_BRANCH in very rare cases */
1985 		zend_emit_op(NULL, ZEND_NOP, NULL, NULL);
1986 		opnum = get_next_op_number();
1987 	}
1988 	opline = zend_emit_op(NULL, opcode, cond, NULL);
1989 	opline->op2.opline_num = opnum_target;
1990 	return opnum;
1991 }
1992 /* }}} */
1993 
zend_update_jump_target(uint32_t opnum_jump, uint32_t opnum_target)1994 static inline void zend_update_jump_target(uint32_t opnum_jump, uint32_t opnum_target) /* {{{ */
1995 {
1996 	zend_op *opline = &CG(active_op_array)->opcodes[opnum_jump];
1997 	switch (opline->opcode) {
1998 		case ZEND_JMP:
1999 			opline->op1.opline_num = opnum_target;
2000 			break;
2001 		case ZEND_JMPZ:
2002 		case ZEND_JMPNZ:
2003 		case ZEND_JMPZ_EX:
2004 		case ZEND_JMPNZ_EX:
2005 		case ZEND_JMP_SET:
2006 		case ZEND_COALESCE:
2007 			opline->op2.opline_num = opnum_target;
2008 			break;
2009 		EMPTY_SWITCH_DEFAULT_CASE()
2010 	}
2011 }
2012 /* }}} */
2013 
zend_update_jump_target_to_next(uint32_t opnum_jump)2014 static inline void zend_update_jump_target_to_next(uint32_t opnum_jump) /* {{{ */
2015 {
2016 	zend_update_jump_target(opnum_jump, get_next_op_number());
2017 }
2018 /* }}} */
2019 
zend_delayed_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2)2020 static inline zend_op *zend_delayed_emit_op(znode *result, zend_uchar opcode, znode *op1, znode *op2) /* {{{ */
2021 {
2022 	zend_op tmp_opline;
2023 
2024 	init_op(&tmp_opline);
2025 
2026 	tmp_opline.opcode = opcode;
2027 	if (op1 != NULL) {
2028 		SET_NODE(tmp_opline.op1, op1);
2029 	}
2030 	if (op2 != NULL) {
2031 		SET_NODE(tmp_opline.op2, op2);
2032 	}
2033 	if (result) {
2034 		zend_make_var_result(result, &tmp_opline);
2035 	}
2036 
2037 	zend_stack_push(&CG(delayed_oplines_stack), &tmp_opline);
2038 	return zend_stack_top(&CG(delayed_oplines_stack));
2039 }
2040 /* }}} */
2041 
zend_delayed_compile_begin(void)2042 static inline uint32_t zend_delayed_compile_begin(void) /* {{{ */
2043 {
2044 	return zend_stack_count(&CG(delayed_oplines_stack));
2045 }
2046 /* }}} */
2047 
zend_delayed_compile_end(uint32_t offset)2048 static zend_op *zend_delayed_compile_end(uint32_t offset) /* {{{ */
2049 {
2050 	zend_op *opline = NULL, *oplines = zend_stack_base(&CG(delayed_oplines_stack));
2051 	uint32_t i, count = zend_stack_count(&CG(delayed_oplines_stack));
2052 
2053 	ZEND_ASSERT(count >= offset);
2054 	for (i = offset; i < count; ++i) {
2055 		opline = get_next_op();
2056 		memcpy(opline, &oplines[i], sizeof(zend_op));
2057 	}
2058 	CG(delayed_oplines_stack).top = offset;
2059 	return opline;
2060 }
2061 /* }}} */
2062 
2063 #define ZEND_MEMOIZE_NONE 0
2064 #define ZEND_MEMOIZE_COMPILE 1
2065 #define ZEND_MEMOIZE_FETCH 2
2066 
zend_compile_memoized_expr(znode *result, zend_ast *expr)2067 static void zend_compile_memoized_expr(znode *result, zend_ast *expr) /* {{{ */
2068 {
2069 	int memoize_mode = CG(memoize_mode);
2070 	if (memoize_mode == ZEND_MEMOIZE_COMPILE) {
2071 		znode memoized_result;
2072 
2073 		/* Go through normal compilation */
2074 		CG(memoize_mode) = ZEND_MEMOIZE_NONE;
2075 		zend_compile_expr(result, expr);
2076 		CG(memoize_mode) = ZEND_MEMOIZE_COMPILE;
2077 
2078 		if (result->op_type == IS_VAR) {
2079 			zend_emit_op(&memoized_result, ZEND_COPY_TMP, result, NULL);
2080 		} else if (result->op_type == IS_TMP_VAR) {
2081 			zend_emit_op_tmp(&memoized_result, ZEND_COPY_TMP, result, NULL);
2082 		} else {
2083 			if (result->op_type == IS_CONST) {
2084 				Z_TRY_ADDREF(result->u.constant);
2085 			}
2086 			memoized_result = *result;
2087 		}
2088 
2089 		zend_hash_index_update_mem(
2090 			CG(memoized_exprs), (uintptr_t) expr, &memoized_result, sizeof(znode));
2091 	} else if (memoize_mode == ZEND_MEMOIZE_FETCH) {
2092 		znode *memoized_result = zend_hash_index_find_ptr(CG(memoized_exprs), (uintptr_t) expr);
2093 		*result = *memoized_result;
2094 		if (result->op_type == IS_CONST) {
2095 			Z_TRY_ADDREF(result->u.constant);
2096 		}
2097 	} else {
2098 		ZEND_ASSERT(0);
2099 	}
2100 }
2101 /* }}} */
2102 
zend_emit_return_type_check( znode *expr, zend_arg_info *return_info, zend_bool implicit)2103 static void zend_emit_return_type_check(
2104 		znode *expr, zend_arg_info *return_info, zend_bool implicit) /* {{{ */
2105 {
2106 	if (ZEND_TYPE_IS_SET(return_info->type)) {
2107 		zend_op *opline;
2108 
2109 		/* `return ...;` is illegal in a void function (but `return;` isn't) */
2110 		if (ZEND_TYPE_CODE(return_info->type) == IS_VOID) {
2111 			if (expr) {
2112 				if (expr->op_type == IS_CONST && Z_TYPE(expr->u.constant) == IS_NULL) {
2113 					zend_error_noreturn(E_COMPILE_ERROR,
2114 						"A void function must not return a value "
2115 						"(did you mean \"return;\" instead of \"return null;\"?)");
2116 				} else {
2117 					zend_error_noreturn(E_COMPILE_ERROR, "A void function must not return a value");
2118 				}
2119 			}
2120 			/* we don't need run-time check */
2121 			return;
2122 		}
2123 
2124 		if (!expr && !implicit) {
2125 			if (ZEND_TYPE_ALLOW_NULL(return_info->type)) {
2126 				zend_error_noreturn(E_COMPILE_ERROR,
2127 					"A function with return type must return a value "
2128 					"(did you mean \"return null;\" instead of \"return;\"?)");
2129 			} else {
2130 				zend_error_noreturn(E_COMPILE_ERROR,
2131 					"A function with return type must return a value");
2132 			}
2133 		}
2134 
2135 		if (expr && expr->op_type == IS_CONST) {
2136 			if ((ZEND_TYPE_CODE(return_info->type) == Z_TYPE(expr->u.constant))
2137 			 ||((ZEND_TYPE_CODE(return_info->type) == _IS_BOOL)
2138 			  && (Z_TYPE(expr->u.constant) == IS_FALSE
2139 			   || Z_TYPE(expr->u.constant) == IS_TRUE))
2140 			 || (ZEND_TYPE_ALLOW_NULL(return_info->type)
2141 			  && Z_TYPE(expr->u.constant) == IS_NULL)) {
2142 				/* we don't need run-time check */
2143 				return;
2144 			}
2145 		}
2146 
2147 		opline = zend_emit_op(NULL, ZEND_VERIFY_RETURN_TYPE, expr, NULL);
2148 		if (expr && expr->op_type == IS_CONST) {
2149 			opline->result_type = expr->op_type = IS_TMP_VAR;
2150 			opline->result.var = expr->u.op.var = get_temporary_variable();
2151 		}
2152 		if (ZEND_TYPE_IS_CLASS(return_info->type)) {
2153 			opline->op2.num = CG(active_op_array)->cache_size;
2154 			CG(active_op_array)->cache_size += sizeof(void*);
2155 		} else {
2156 			opline->op2.num = -1;
2157 		}
2158 	}
2159 }
2160 /* }}} */
2161 
zend_emit_final_return(int return_one)2162 void zend_emit_final_return(int return_one) /* {{{ */
2163 {
2164 	znode zn;
2165 	zend_op *ret;
2166 	zend_bool returns_reference = (CG(active_op_array)->fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0;
2167 
2168 	if (CG(active_op_array)->fn_flags & ZEND_ACC_HAS_RETURN_TYPE
2169 			&& !(CG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR)) {
2170 		zend_emit_return_type_check(NULL, CG(active_op_array)->arg_info - 1, 1);
2171 	}
2172 
2173 	zn.op_type = IS_CONST;
2174 	if (return_one) {
2175 		ZVAL_LONG(&zn.u.constant, 1);
2176 	} else {
2177 		ZVAL_NULL(&zn.u.constant);
2178 	}
2179 
2180 	ret = zend_emit_op(NULL, returns_reference ? ZEND_RETURN_BY_REF : ZEND_RETURN, &zn, NULL);
2181 	ret->extended_value = -1;
2182 }
2183 /* }}} */
2184 
zend_is_variable(zend_ast *ast)2185 static inline zend_bool zend_is_variable(zend_ast *ast) /* {{{ */
2186 {
2187 	return ast->kind == ZEND_AST_VAR || ast->kind == ZEND_AST_DIM
2188 		|| ast->kind == ZEND_AST_PROP || ast->kind == ZEND_AST_STATIC_PROP;
2189 }
2190 /* }}} */
2191 
zend_is_call(zend_ast *ast)2192 static inline zend_bool zend_is_call(zend_ast *ast) /* {{{ */
2193 {
2194 	return ast->kind == ZEND_AST_CALL
2195 		|| ast->kind == ZEND_AST_METHOD_CALL
2196 		|| ast->kind == ZEND_AST_STATIC_CALL;
2197 }
2198 /* }}} */
2199 
zend_is_variable_or_call(zend_ast *ast)2200 static inline zend_bool zend_is_variable_or_call(zend_ast *ast) /* {{{ */
2201 {
2202 	return zend_is_variable(ast) || zend_is_call(ast);
2203 }
2204 /* }}} */
2205 
zend_is_unticked_stmt(zend_ast *ast)2206 static inline zend_bool zend_is_unticked_stmt(zend_ast *ast) /* {{{ */
2207 {
2208 	return ast->kind == ZEND_AST_STMT_LIST || ast->kind == ZEND_AST_LABEL
2209 		|| ast->kind == ZEND_AST_PROP_DECL || ast->kind == ZEND_AST_CLASS_CONST_DECL
2210 		|| ast->kind == ZEND_AST_USE_TRAIT || ast->kind == ZEND_AST_METHOD;
2211 }
2212 /* }}} */
2213 
zend_can_write_to_variable(zend_ast *ast)2214 static inline zend_bool zend_can_write_to_variable(zend_ast *ast) /* {{{ */
2215 {
2216 	while (ast->kind == ZEND_AST_DIM || ast->kind == ZEND_AST_PROP) {
2217 		ast = ast->child[0];
2218 	}
2219 
2220 	return zend_is_variable_or_call(ast);
2221 }
2222 /* }}} */
2223 
zend_is_const_default_class_ref(zend_ast *name_ast)2224 static inline zend_bool zend_is_const_default_class_ref(zend_ast *name_ast) /* {{{ */
2225 {
2226 	if (name_ast->kind != ZEND_AST_ZVAL) {
2227 		return 0;
2228 	}
2229 
2230 	return ZEND_FETCH_CLASS_DEFAULT == zend_get_class_fetch_type_ast(name_ast);
2231 }
2232 /* }}} */
2233 
zend_handle_numeric_op(znode *node)2234 static inline void zend_handle_numeric_op(znode *node) /* {{{ */
2235 {
2236 	if (node->op_type == IS_CONST && Z_TYPE(node->u.constant) == IS_STRING) {
2237 		zend_ulong index;
2238 
2239 		if (ZEND_HANDLE_NUMERIC(Z_STR(node->u.constant), index)) {
2240 			zval_ptr_dtor(&node->u.constant);
2241 			ZVAL_LONG(&node->u.constant, index);
2242 		}
2243 	}
2244 }
2245 /* }}} */
2246 
zend_handle_numeric_dim(zend_op *opline, znode *dim_node)2247 static inline void zend_handle_numeric_dim(zend_op *opline, znode *dim_node) /* {{{ */
2248 {
2249 	if (Z_TYPE(dim_node->u.constant) == IS_STRING) {
2250 		zend_ulong index;
2251 
2252 		if (ZEND_HANDLE_NUMERIC(Z_STR(dim_node->u.constant), index)) {
2253 			/* For numeric indexes we also keep the original value to use by ArrayAccess
2254 			 * See bug #63217
2255 			 */
2256 			int c = zend_add_literal(&dim_node->u.constant);
2257 			ZEND_ASSERT(opline->op2.constant + 1 == c);
2258 			ZVAL_LONG(CT_CONSTANT(opline->op2), index);
2259 			Z_EXTRA_P(CT_CONSTANT(opline->op2)) = ZEND_EXTRA_VALUE;
2260 			return;
2261 		}
2262 	}
2263 }
2264 /* }}} */
2265 
zend_set_class_name_op1(zend_op *opline, znode *class_node)2266 static inline void zend_set_class_name_op1(zend_op *opline, znode *class_node) /* {{{ */
2267 {
2268 	if (class_node->op_type == IS_CONST) {
2269 		opline->op1_type = IS_CONST;
2270 		opline->op1.constant = zend_add_class_name_literal(
2271 			Z_STR(class_node->u.constant));
2272 	} else {
2273 		SET_NODE(opline->op1, class_node);
2274 	}
2275 }
2276 /* }}} */
2277 
zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags)2278 static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags) /* {{{ */
2279 {
2280 	uint32_t fetch_type;
2281 
2282 	if (name_ast->kind != ZEND_AST_ZVAL) {
2283 		znode name_node;
2284 
2285 		zend_compile_expr(&name_node, name_ast);
2286 
2287 		if (name_node.op_type == IS_CONST) {
2288 			zend_string *name;
2289 
2290 			if (Z_TYPE(name_node.u.constant) != IS_STRING) {
2291 				zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
2292 			}
2293 
2294 			name = Z_STR(name_node.u.constant);
2295 			fetch_type = zend_get_class_fetch_type(name);
2296 
2297 			if (fetch_type == ZEND_FETCH_CLASS_DEFAULT) {
2298 				result->op_type = IS_CONST;
2299 				ZVAL_STR(&result->u.constant, zend_resolve_class_name(name, ZEND_NAME_FQ));
2300 			} else {
2301 				zend_ensure_valid_class_fetch_type(fetch_type);
2302 				result->op_type = IS_UNUSED;
2303 				result->u.op.num = fetch_type | fetch_flags;
2304 			}
2305 
2306 			zend_string_release_ex(name, 0);
2307 		} else {
2308 			zend_op *opline = zend_emit_op(result, ZEND_FETCH_CLASS, NULL, &name_node);
2309 			opline->op1.num = ZEND_FETCH_CLASS_DEFAULT | fetch_flags;
2310 		}
2311 		return;
2312 	}
2313 
2314 	/* Fully qualified names are always default refs */
2315 	if (name_ast->attr == ZEND_NAME_FQ) {
2316 		result->op_type = IS_CONST;
2317 		ZVAL_STR(&result->u.constant, zend_resolve_class_name_ast(name_ast));
2318 		return;
2319 	}
2320 
2321 	fetch_type = zend_get_class_fetch_type(zend_ast_get_str(name_ast));
2322 	if (ZEND_FETCH_CLASS_DEFAULT == fetch_type) {
2323 		result->op_type = IS_CONST;
2324 		ZVAL_STR(&result->u.constant, zend_resolve_class_name_ast(name_ast));
2325 	} else {
2326 		zend_ensure_valid_class_fetch_type(fetch_type);
2327 		result->op_type = IS_UNUSED;
2328 		result->u.op.num = fetch_type | fetch_flags;
2329 	}
2330 }
2331 /* }}} */
2332 
zend_try_compile_cv(znode *result, zend_ast *ast)2333 static int zend_try_compile_cv(znode *result, zend_ast *ast) /* {{{ */
2334 {
2335 	zend_ast *name_ast = ast->child[0];
2336 	if (name_ast->kind == ZEND_AST_ZVAL) {
2337 		zval *zv = zend_ast_get_zval(name_ast);
2338 		zend_string *name;
2339 
2340 		if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
2341 			name = zval_make_interned_string(zv);
2342 		} else {
2343 			name = zend_new_interned_string(zval_get_string_func(zv));
2344 		}
2345 
2346 		if (zend_is_auto_global(name)) {
2347 			return FAILURE;
2348 		}
2349 
2350 		result->op_type = IS_CV;
2351 		result->u.op.var = lookup_cv(name);
2352 
2353 		if (UNEXPECTED(Z_TYPE_P(zv) != IS_STRING)) {
2354 			zend_string_release_ex(name, 0);
2355 		}
2356 
2357 		return SUCCESS;
2358 	}
2359 
2360 	return FAILURE;
2361 }
2362 /* }}} */
2363 
zend_compile_simple_var_no_cv(znode *result, zend_ast *ast, uint32_t type, int delayed)2364 static zend_op *zend_compile_simple_var_no_cv(znode *result, zend_ast *ast, uint32_t type, int delayed) /* {{{ */
2365 {
2366 	zend_ast *name_ast = ast->child[0];
2367 	znode name_node;
2368 	zend_op *opline;
2369 
2370 	zend_compile_expr(&name_node, name_ast);
2371 	if (name_node.op_type == IS_CONST) {
2372 		convert_to_string(&name_node.u.constant);
2373 	}
2374 
2375 	if (delayed) {
2376 		opline = zend_delayed_emit_op(result, ZEND_FETCH_R, &name_node, NULL);
2377 	} else {
2378 		opline = zend_emit_op(result, ZEND_FETCH_R, &name_node, NULL);
2379 	}
2380 
2381 	if (name_node.op_type == IS_CONST &&
2382 	    zend_is_auto_global(Z_STR(name_node.u.constant))) {
2383 
2384 		opline->extended_value = ZEND_FETCH_GLOBAL;
2385 	} else {
2386 		opline->extended_value = ZEND_FETCH_LOCAL;
2387 	}
2388 
2389 	zend_adjust_for_fetch_type(opline, result, type);
2390 	return opline;
2391 }
2392 /* }}} */
2393 
is_this_fetch(zend_ast *ast)2394 static zend_bool is_this_fetch(zend_ast *ast) /* {{{ */
2395 {
2396 	if (ast->kind == ZEND_AST_VAR && ast->child[0]->kind == ZEND_AST_ZVAL) {
2397 		zval *name = zend_ast_get_zval(ast->child[0]);
2398 		return Z_TYPE_P(name) == IS_STRING && zend_string_equals_literal(Z_STR_P(name), "this");
2399 	}
2400 
2401 	return 0;
2402 }
2403 /* }}} */
2404 
zend_compile_simple_var(znode *result, zend_ast *ast, uint32_t type, int delayed)2405 static zend_op *zend_compile_simple_var(znode *result, zend_ast *ast, uint32_t type, int delayed) /* {{{ */
2406 {
2407 	if (is_this_fetch(ast)) {
2408 		zend_op *opline = zend_emit_op(result, ZEND_FETCH_THIS, NULL, NULL);
2409 		if ((type == BP_VAR_R) || (type == BP_VAR_IS)) {
2410 			opline->result_type = IS_TMP_VAR;
2411 			result->op_type = IS_TMP_VAR;
2412 		}
2413 		CG(active_op_array)->fn_flags |= ZEND_ACC_USES_THIS;
2414 		return opline;
2415 	} else if (zend_try_compile_cv(result, ast) == FAILURE) {
2416 		return zend_compile_simple_var_no_cv(result, ast, type, delayed);
2417 	}
2418 	return NULL;
2419 }
2420 /* }}} */
2421 
zend_separate_if_call_and_write(znode *node, zend_ast *ast, uint32_t type)2422 static void zend_separate_if_call_and_write(znode *node, zend_ast *ast, uint32_t type) /* {{{ */
2423 {
2424 	if (type != BP_VAR_R && type != BP_VAR_IS && zend_is_call(ast)) {
2425 		if (node->op_type == IS_VAR) {
2426 			zend_op *opline = zend_emit_op(NULL, ZEND_SEPARATE, node, NULL);
2427 			opline->result_type = IS_VAR;
2428 			opline->result.var = opline->op1.var;
2429 		} else {
2430 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");
2431 		}
2432 	}
2433 }
2434 /* }}} */
2435 
2436 zend_op *zend_delayed_compile_var(znode *result, zend_ast *ast, uint32_t type, zend_bool by_ref);
2437 void zend_compile_assign(znode *result, zend_ast *ast);
2438 
zend_emit_assign_znode(zend_ast *var_ast, znode *value_node)2439 static inline void zend_emit_assign_znode(zend_ast *var_ast, znode *value_node) /* {{{ */
2440 {
2441 	znode dummy_node;
2442 	zend_ast *assign_ast = zend_ast_create(ZEND_AST_ASSIGN, var_ast,
2443 		zend_ast_create_znode(value_node));
2444 	zend_compile_assign(&dummy_node, assign_ast);
2445 	zend_do_free(&dummy_node);
2446 }
2447 /* }}} */
2448 
zend_delayed_compile_dim(znode *result, zend_ast *ast, uint32_t type)2449 static zend_op *zend_delayed_compile_dim(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2450 {
2451 	if (ast->attr == ZEND_DIM_ALTERNATIVE_SYNTAX) {
2452 		zend_error(E_DEPRECATED, "Array and string offset access syntax with curly braces is deprecated");
2453 	}
2454 
2455 	zend_ast *var_ast = ast->child[0];
2456 	zend_ast *dim_ast = ast->child[1];
2457 	zend_op *opline;
2458 
2459 	znode var_node, dim_node;
2460 
2461 	opline = zend_delayed_compile_var(&var_node, var_ast, type, 0);
2462 	if (opline && type == BP_VAR_W && (opline->opcode == ZEND_FETCH_STATIC_PROP_W || opline->opcode == ZEND_FETCH_OBJ_W)) {
2463 		opline->extended_value |= ZEND_FETCH_DIM_WRITE;
2464 	}
2465 
2466 	zend_separate_if_call_and_write(&var_node, var_ast, type);
2467 
2468 	if (dim_ast == NULL) {
2469 		if (type == BP_VAR_R || type == BP_VAR_IS) {
2470 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
2471 		}
2472 		if (type == BP_VAR_UNSET) {
2473 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for unsetting");
2474 		}
2475 		dim_node.op_type = IS_UNUSED;
2476 	} else {
2477 		zend_compile_expr(&dim_node, dim_ast);
2478 	}
2479 
2480 	opline = zend_delayed_emit_op(result, ZEND_FETCH_DIM_R, &var_node, &dim_node);
2481 	zend_adjust_for_fetch_type(opline, result, type);
2482 
2483 	if (dim_node.op_type == IS_CONST) {
2484 		zend_handle_numeric_dim(opline, &dim_node);
2485 	}
2486 	return opline;
2487 }
2488 /* }}} */
2489 
zend_compile_dim(znode *result, zend_ast *ast, uint32_t type)2490 static zend_op *zend_compile_dim(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2491 {
2492 	uint32_t offset = zend_delayed_compile_begin();
2493 	zend_delayed_compile_dim(result, ast, type);
2494 	return zend_delayed_compile_end(offset);
2495 }
2496 /* }}} */
2497 
zend_delayed_compile_prop(znode *result, zend_ast *ast, uint32_t type)2498 static zend_op *zend_delayed_compile_prop(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
2499 {
2500 	zend_ast *obj_ast = ast->child[0];
2501 	zend_ast *prop_ast = ast->child[1];
2502 
2503 	znode obj_node, prop_node;
2504 	zend_op *opline;
2505 
2506 	if (is_this_fetch(obj_ast)) {
2507 		obj_node.op_type = IS_UNUSED;
2508 		CG(active_op_array)->fn_flags |= ZEND_ACC_USES_THIS;
2509 	} else {
2510 		opline = zend_delayed_compile_var(&obj_node, obj_ast, type, 0);
2511 		if (opline && type == BP_VAR_W && (opline->opcode == ZEND_FETCH_STATIC_PROP_W || opline->opcode == ZEND_FETCH_OBJ_W)) {
2512 			opline->extended_value |= ZEND_FETCH_OBJ_WRITE;
2513 		}
2514 
2515 		zend_separate_if_call_and_write(&obj_node, obj_ast, type);
2516 	}
2517 	zend_compile_expr(&prop_node, prop_ast);
2518 
2519 	opline = zend_delayed_emit_op(result, ZEND_FETCH_OBJ_R, &obj_node, &prop_node);
2520 	if (opline->op2_type == IS_CONST) {
2521 		convert_to_string(CT_CONSTANT(opline->op2));
2522 		opline->extended_value = zend_alloc_cache_slots(3);
2523 	}
2524 
2525 	zend_adjust_for_fetch_type(opline, result, type);
2526 	return opline;
2527 }
2528 /* }}} */
2529 
zend_compile_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref)2530 static zend_op *zend_compile_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref) /* {{{ */
2531 {
2532 	uint32_t offset = zend_delayed_compile_begin();
2533 	zend_op *opline = zend_delayed_compile_prop(result, ast, type);
2534 	if (by_ref) { /* shared with cache_slot */
2535 		opline->extended_value |= ZEND_FETCH_REF;
2536 	}
2537 	return zend_delayed_compile_end(offset);
2538 }
2539 /* }}} */
2540 
zend_compile_static_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref, int delayed)2541 zend_op *zend_compile_static_prop(znode *result, zend_ast *ast, uint32_t type, int by_ref, int delayed) /* {{{ */
2542 {
2543 	zend_ast *class_ast = ast->child[0];
2544 	zend_ast *prop_ast = ast->child[1];
2545 
2546 	znode class_node, prop_node;
2547 	zend_op *opline;
2548 
2549 	zend_compile_class_ref(&class_node, class_ast, ZEND_FETCH_CLASS_EXCEPTION);
2550 
2551 	zend_compile_expr(&prop_node, prop_ast);
2552 
2553 	if (delayed) {
2554 		opline = zend_delayed_emit_op(result, ZEND_FETCH_STATIC_PROP_R, &prop_node, NULL);
2555 	} else {
2556 		opline = zend_emit_op(result, ZEND_FETCH_STATIC_PROP_R, &prop_node, NULL);
2557 	}
2558 	if (opline->op1_type == IS_CONST) {
2559 		convert_to_string(CT_CONSTANT(opline->op1));
2560 		opline->extended_value = zend_alloc_cache_slots(3);
2561 	}
2562 	if (class_node.op_type == IS_CONST) {
2563 		opline->op2_type = IS_CONST;
2564 		opline->op2.constant = zend_add_class_name_literal(
2565 			Z_STR(class_node.u.constant));
2566 		if (opline->op1_type != IS_CONST) {
2567 			opline->extended_value = zend_alloc_cache_slot();
2568 		}
2569 	} else {
2570 		SET_NODE(opline->op2, &class_node);
2571 	}
2572 
2573 	if (by_ref && (type == BP_VAR_W || type == BP_VAR_FUNC_ARG)) { /* shared with cache_slot */
2574 		opline->extended_value |= ZEND_FETCH_REF;
2575 	}
2576 
2577 	zend_adjust_for_fetch_type(opline, result, type);
2578 	return opline;
2579 }
2580 /* }}} */
2581 
zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_style)2582 static void zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_style) /* {{{ */ {
2583 	if (var_ast->kind == ZEND_AST_ARRAY) {
2584 		if (var_ast->attr == ZEND_ARRAY_SYNTAX_LONG) {
2585 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot assign to array(), use [] instead");
2586 		}
2587 		if (old_style != var_ast->attr) {
2588 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot mix [] and list()");
2589 		}
2590 	} else if (!zend_can_write_to_variable(var_ast)) {
2591 		zend_error_noreturn(E_COMPILE_ERROR, "Assignments can only happen to writable values");
2592 	}
2593 }
2594 /* }}} */
2595 
2596 static inline void zend_emit_assign_ref_znode(zend_ast *var_ast, znode *value_node);
2597 
2598 /* Propagate refs used on leaf elements to the surrounding list() structures. */
zend_propagate_list_refs(zend_ast *ast)2599 static zend_bool zend_propagate_list_refs(zend_ast *ast) { /* {{{ */
2600 	zend_ast_list *list = zend_ast_get_list(ast);
2601 	zend_bool has_refs = 0;
2602 	uint32_t i;
2603 
2604 	for (i = 0; i < list->children; ++i) {
2605 		zend_ast *elem_ast = list->child[i];
2606 
2607 		if (elem_ast) {
2608 			zend_ast *var_ast = elem_ast->child[0];
2609 			if (var_ast->kind == ZEND_AST_ARRAY) {
2610 				elem_ast->attr = zend_propagate_list_refs(var_ast);
2611 			}
2612 			has_refs |= elem_ast->attr;
2613 		}
2614 	}
2615 
2616 	return has_refs;
2617 }
2618 /* }}} */
2619 
zend_compile_list_assign( znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style)2620 static void zend_compile_list_assign(
2621 		znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style) /* {{{ */
2622 {
2623 	zend_ast_list *list = zend_ast_get_list(ast);
2624 	uint32_t i;
2625 	zend_bool has_elems = 0;
2626 	zend_bool is_keyed =
2627 		list->children > 0 && list->child[0] != NULL && list->child[0]->child[1] != NULL;
2628 
2629 	if (list->children && expr_node->op_type == IS_CONST && Z_TYPE(expr_node->u.constant) == IS_STRING) {
2630 		zval_make_interned_string(&expr_node->u.constant);
2631 	}
2632 
2633 	for (i = 0; i < list->children; ++i) {
2634 		zend_ast *elem_ast = list->child[i];
2635 		zend_ast *var_ast, *key_ast;
2636 		znode fetch_result, dim_node;
2637 		zend_op *opline;
2638 
2639 		if (elem_ast == NULL) {
2640 			if (is_keyed) {
2641 				zend_error(E_COMPILE_ERROR,
2642 					"Cannot use empty array entries in keyed array assignment");
2643 			} else {
2644 				continue;
2645 			}
2646 		}
2647 
2648 		if (elem_ast->kind == ZEND_AST_UNPACK) {
2649 			zend_error(E_COMPILE_ERROR,
2650 					"Spread operator is not supported in assignments");
2651 		}
2652 
2653 		var_ast = elem_ast->child[0];
2654 		key_ast = elem_ast->child[1];
2655 		has_elems = 1;
2656 
2657 		if (is_keyed) {
2658 			if (key_ast == NULL) {
2659 				zend_error(E_COMPILE_ERROR,
2660 					"Cannot mix keyed and unkeyed array entries in assignments");
2661 			}
2662 
2663 			zend_compile_expr(&dim_node, key_ast);
2664 		} else {
2665 			if (key_ast != NULL) {
2666 				zend_error(E_COMPILE_ERROR,
2667 					"Cannot mix keyed and unkeyed array entries in assignments");
2668 			}
2669 
2670 			dim_node.op_type = IS_CONST;
2671 			ZVAL_LONG(&dim_node.u.constant, i);
2672 		}
2673 
2674 		if (expr_node->op_type == IS_CONST) {
2675 			Z_TRY_ADDREF(expr_node->u.constant);
2676 		}
2677 
2678 		zend_verify_list_assign_target(var_ast, old_style);
2679 
2680 		opline = zend_emit_op(&fetch_result,
2681 			elem_ast->attr ? (expr_node->op_type == IS_CV ? ZEND_FETCH_DIM_W : ZEND_FETCH_LIST_W) : ZEND_FETCH_LIST_R, expr_node, &dim_node);
2682 
2683 		if (dim_node.op_type == IS_CONST) {
2684 			zend_handle_numeric_dim(opline, &dim_node);
2685 		}
2686 
2687 		if (var_ast->kind == ZEND_AST_ARRAY) {
2688 			if (elem_ast->attr) {
2689 				zend_emit_op(&fetch_result, ZEND_MAKE_REF, &fetch_result, NULL);
2690 			}
2691 			zend_compile_list_assign(NULL, var_ast, &fetch_result, var_ast->attr);
2692 		} else if (elem_ast->attr) {
2693 			zend_emit_assign_ref_znode(var_ast, &fetch_result);
2694 		} else {
2695 			zend_emit_assign_znode(var_ast, &fetch_result);
2696 		}
2697 	}
2698 
2699 	if (has_elems == 0) {
2700 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use empty list");
2701 	}
2702 
2703 	if (result) {
2704 		*result = *expr_node;
2705 	} else {
2706 		zend_do_free(expr_node);
2707 	}
2708 }
2709 /* }}} */
2710 
zend_ensure_writable_variable(const zend_ast *ast)2711 static void zend_ensure_writable_variable(const zend_ast *ast) /* {{{ */
2712 {
2713 	if (ast->kind == ZEND_AST_CALL) {
2714 		zend_error_noreturn(E_COMPILE_ERROR, "Can't use function return value in write context");
2715 	}
2716 	if (ast->kind == ZEND_AST_METHOD_CALL || ast->kind == ZEND_AST_STATIC_CALL) {
2717 		zend_error_noreturn(E_COMPILE_ERROR, "Can't use method return value in write context");
2718 	}
2719 }
2720 /* }}} */
2721 
2722 /* Detects $a... = $a pattern */
zend_is_assign_to_self(zend_ast *var_ast, zend_ast *expr_ast)2723 zend_bool zend_is_assign_to_self(zend_ast *var_ast, zend_ast *expr_ast) /* {{{ */
2724 {
2725 	if (expr_ast->kind != ZEND_AST_VAR || expr_ast->child[0]->kind != ZEND_AST_ZVAL) {
2726 		return 0;
2727 	}
2728 
2729 	while (zend_is_variable(var_ast) && var_ast->kind != ZEND_AST_VAR) {
2730 		var_ast = var_ast->child[0];
2731 	}
2732 
2733 	if (var_ast->kind != ZEND_AST_VAR || var_ast->child[0]->kind != ZEND_AST_ZVAL) {
2734 		return 0;
2735 	}
2736 
2737 	{
2738 		zend_string *name1 = zval_get_string(zend_ast_get_zval(var_ast->child[0]));
2739 		zend_string *name2 = zval_get_string(zend_ast_get_zval(expr_ast->child[0]));
2740 		zend_bool result = zend_string_equals(name1, name2);
2741 		zend_string_release_ex(name1, 0);
2742 		zend_string_release_ex(name2, 0);
2743 		return result;
2744 	}
2745 }
2746 /* }}} */
2747 
zend_compile_assign(znode *result, zend_ast *ast)2748 void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
2749 {
2750 	zend_ast *var_ast = ast->child[0];
2751 	zend_ast *expr_ast = ast->child[1];
2752 
2753 	znode var_node, expr_node;
2754 	zend_op *opline;
2755 	uint32_t offset;
2756 
2757 	if (is_this_fetch(var_ast)) {
2758 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
2759 	}
2760 
2761 	zend_ensure_writable_variable(var_ast);
2762 
2763 	switch (var_ast->kind) {
2764 		case ZEND_AST_VAR:
2765 			offset = zend_delayed_compile_begin();
2766 			zend_delayed_compile_var(&var_node, var_ast, BP_VAR_W, 0);
2767 			zend_compile_expr(&expr_node, expr_ast);
2768 			zend_delayed_compile_end(offset);
2769 			zend_emit_op(result, ZEND_ASSIGN, &var_node, &expr_node);
2770 			return;
2771 		case ZEND_AST_STATIC_PROP:
2772 			offset = zend_delayed_compile_begin();
2773 			zend_delayed_compile_var(result, var_ast, BP_VAR_W, 0);
2774 			zend_compile_expr(&expr_node, expr_ast);
2775 
2776 			opline = zend_delayed_compile_end(offset);
2777 			opline->opcode = ZEND_ASSIGN_STATIC_PROP;
2778 
2779 			zend_emit_op_data(&expr_node);
2780 			return;
2781 		case ZEND_AST_DIM:
2782 			offset = zend_delayed_compile_begin();
2783 			zend_delayed_compile_dim(result, var_ast, BP_VAR_W);
2784 
2785 			if (zend_is_assign_to_self(var_ast, expr_ast)
2786 			 && !is_this_fetch(expr_ast)) {
2787 				/* $a[0] = $a should evaluate the right $a first */
2788 				znode cv_node;
2789 
2790 				if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
2791 					zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
2792 				} else {
2793 					zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
2794 				}
2795 			} else {
2796 				zend_compile_expr(&expr_node, expr_ast);
2797 			}
2798 
2799 			opline = zend_delayed_compile_end(offset);
2800 			opline->opcode = ZEND_ASSIGN_DIM;
2801 
2802 			opline = zend_emit_op_data(&expr_node);
2803 			return;
2804 		case ZEND_AST_PROP:
2805 			offset = zend_delayed_compile_begin();
2806 			zend_delayed_compile_prop(result, var_ast, BP_VAR_W);
2807 			zend_compile_expr(&expr_node, expr_ast);
2808 
2809 			opline = zend_delayed_compile_end(offset);
2810 			opline->opcode = ZEND_ASSIGN_OBJ;
2811 
2812 			zend_emit_op_data(&expr_node);
2813 			return;
2814 		case ZEND_AST_ARRAY:
2815 			if (zend_propagate_list_refs(var_ast)) {
2816 				if (!zend_is_variable_or_call(expr_ast)) {
2817 					zend_error_noreturn(E_COMPILE_ERROR,
2818 						"Cannot assign reference to non referencable value");
2819 				}
2820 
2821 				zend_compile_var(&expr_node, expr_ast, BP_VAR_W, 1);
2822 				/* MAKE_REF is usually not necessary for CVs. However, if there are
2823 				 * self-assignments, this forces the RHS to evaluate first. */
2824 				zend_emit_op(&expr_node, ZEND_MAKE_REF, &expr_node, NULL);
2825 			} else {
2826 				if (expr_ast->kind == ZEND_AST_VAR) {
2827 					/* list($a, $b) = $a should evaluate the right $a first */
2828 					znode cv_node;
2829 
2830 					if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
2831 						zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
2832 					} else {
2833 						zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
2834 					}
2835 				} else {
2836 					zend_compile_expr(&expr_node, expr_ast);
2837 				}
2838 			}
2839 
2840 			zend_compile_list_assign(result, var_ast, &expr_node, var_ast->attr);
2841 			return;
2842 		EMPTY_SWITCH_DEFAULT_CASE();
2843 	}
2844 }
2845 /* }}} */
2846 
zend_compile_assign_ref(znode *result, zend_ast *ast)2847 void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
2848 {
2849 	zend_ast *target_ast = ast->child[0];
2850 	zend_ast *source_ast = ast->child[1];
2851 
2852 	znode target_node, source_node;
2853 	zend_op *opline;
2854 	uint32_t offset, flags;
2855 
2856 	if (is_this_fetch(target_ast)) {
2857 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
2858 	}
2859 	zend_ensure_writable_variable(target_ast);
2860 
2861 	offset = zend_delayed_compile_begin();
2862 	zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W, 1);
2863 	zend_compile_var(&source_node, source_ast, BP_VAR_W, 1);
2864 
2865 	if ((target_ast->kind != ZEND_AST_VAR
2866 	  || target_ast->child[0]->kind != ZEND_AST_ZVAL)
2867 	 && source_node.op_type != IS_CV) {
2868 		/* Both LHS and RHS expressions may modify the same data structure,
2869 		 * and the modification during RHS evaluation may dangle the pointer
2870 		 * to the result of the LHS evaluation.
2871 		 * Use MAKE_REF instruction to replace direct pointer with REFERENCE.
2872 		 * See: Bug #71539
2873 		 */
2874 		zend_emit_op(&source_node, ZEND_MAKE_REF, &source_node, NULL);
2875 	}
2876 
2877 	opline = zend_delayed_compile_end(offset);
2878 
2879 	if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) {
2880 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");
2881 	}
2882 
2883 	flags = zend_is_call(source_ast) ? ZEND_RETURNS_FUNCTION : 0;
2884 
2885 	if (opline && opline->opcode == ZEND_FETCH_OBJ_W) {
2886 		opline->opcode = ZEND_ASSIGN_OBJ_REF;
2887 		opline->extended_value &= ~ZEND_FETCH_REF;
2888 		opline->extended_value |= flags;
2889 		zend_emit_op_data(&source_node);
2890 		if (