From cbc0b1afeb97044f7a813e8678736649c15f3974 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Mon, 13 Dec 2021 14:59:30 +0300 Subject: [PATCH] Fix array clobering by user error handler Fixes oss-fuzz #42234 --- Zend/tests/objects_034.phpt | 10 +- Zend/tests/objects_035.phpt | 25 ++ Zend/zend_execute.c | 39 +- Zend/zend_vm_def.h | 20 +- Zend/zend_vm_execute.h | 640 ++++++++++------------------- ext/opcache/jit/zend_jit_helpers.c | 61 ++- 6 files changed, 317 insertions(+), 478 deletions(-) create mode 100644 Zend/tests/objects_035.phpt diff --git a/Zend/tests/objects_034.phpt b/Zend/tests/objects_034.phpt index ddb11a13fea..e7cc5f9e90c 100644 --- a/Zend/tests/objects_034.phpt +++ b/Zend/tests/objects_034.phpt @@ -2,7 +2,15 @@ Array object clobbering by user error handler --FILE-- +DONE +--EXPECT-- +DONE diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index d9f7789847c..a8f5c270716 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1264,9 +1264,9 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_string_offset zend_type_error("Cannot access offset of type %s on string", zend_zval_type_name(offset)); } -static zend_never_inline void zend_assign_to_object_dim(zval *object, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC) +static zend_never_inline void zend_assign_to_object_dim(zend_object *obj, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC) { - Z_OBJ_HT_P(object)->write_dimension(Z_OBJ_P(object), dim, value); + obj->handlers->write_dimension(obj, dim, value); if (UNEXPECTED(RETURN_VALUE_USED(opline))) { ZVAL_COPY(EX_VAR(opline->result.var), value); @@ -1300,12 +1300,14 @@ static zend_never_inline void zend_binary_assign_op_obj_dim(zval *object, zval * zval *value; zval *z; zval rv, res; + zend_object *obj = Z_OBJ_P(object); + GC_ADDREF(obj); value = get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1); - if ((z = Z_OBJ_HT_P(object)->read_dimension(Z_OBJ_P(object), property, BP_VAR_R, &rv)) != NULL) { + if ((z = obj->handlers->read_dimension(obj, property, BP_VAR_R, &rv)) != NULL) { if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) { - Z_OBJ_HT_P(object)->write_dimension(Z_OBJ_P(object), property, &res); + obj->handlers->write_dimension(obj, property, &res); } if (z == &rv) { zval_ptr_dtor(&rv); @@ -1321,6 +1323,9 @@ static zend_never_inline void zend_binary_assign_op_obj_dim(zval *object, zval * } } FREE_OP((opline+1)->op1_type, (opline+1)->op1.var); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *ref, zval *value OPLINE_DC EXECUTE_DATA_DC) @@ -2317,22 +2322,17 @@ fetch_from_array: } ZVAL_UNDEF(result); } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(container); + GC_ADDREF(obj); if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) { - zend_object *obj = Z_OBJ_P(container); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - ZVAL_NULL(result); - return; - } } else if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } - retval = Z_OBJ_HT_P(container)->read_dimension(Z_OBJ_P(container), dim, type, result); + retval = obj->handlers->read_dimension(obj, dim, type, result); if (UNEXPECTED(retval == &EG(uninitialized_zval))) { - zend_class_entry *ce = Z_OBJCE_P(container); + zend_class_entry *ce = obj->ce; ZVAL_NULL(result); zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name)); @@ -2343,7 +2343,7 @@ fetch_from_array: retval = result; } if (Z_TYPE_P(retval) != IS_OBJECT) { - zend_class_entry *ce = Z_OBJCE_P(container); + zend_class_entry *ce = obj->ce; zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name)); } } else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) { @@ -2356,6 +2356,9 @@ fetch_from_array: ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception"); ZVAL_UNDEF(result); } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else { if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { if (type != BP_VAR_W && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) { @@ -2508,13 +2511,16 @@ try_string_offset: ZVAL_CHAR(result, c); } } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(container); + + GC_ADDREF(obj); if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) { dim = ZVAL_UNDEFINED_OP2(); } if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } - retval = Z_OBJ_HT_P(container)->read_dimension(Z_OBJ_P(container), dim, type, result); + retval = obj->handlers->read_dimension(obj, dim, type, result); ZEND_ASSERT(result != NULL); if (retval) { @@ -2526,6 +2532,9 @@ try_string_offset: } else { ZVAL_NULL(result); } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else { if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) { container = ZVAL_UNDEFINED_OP1(); diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 80db78b36ad..0648ddac770 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -2583,35 +2583,29 @@ ZEND_VM_C_LABEL(try_assign_dim_array): } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R); if (OP2_TYPE == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - ZEND_VM_C_GOTO(assign_dim_error); - } } else if (OP2_TYPE == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = GET_OP_DATA_ZVAL_PTR_UNDEF(BP_VAR_R); if (OP_DATA_TYPE == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - ZEND_VM_C_GOTO(assign_dim_error); - } } else if (OP_DATA_TYPE & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); FREE_OP_DATA(); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (OP2_TYPE == IS_UNUSED) { zend_use_new_element_for_string(); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index d74e40a0427..a5300d9099b 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -23243,34 +23243,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -23375,35 +23369,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -23508,35 +23496,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -23641,34 +23623,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -25843,34 +25819,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -25975,35 +25945,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -26108,35 +26072,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -26241,34 +26199,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -27299,34 +27251,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -27431,35 +27377,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -27564,35 +27504,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -27697,34 +27631,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -29914,34 +29842,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -30046,35 +29968,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -30179,35 +30095,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -30312,34 +30222,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -40853,34 +40757,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -40985,35 +40883,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -41118,35 +41010,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -41251,34 +41137,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = RT_CONSTANT(opline, opline->op2); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CONST == IS_UNUSED) { zend_use_new_element_for_string(); @@ -44527,34 +44407,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -44659,35 +44533,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -44792,35 +44660,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -44925,34 +44787,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC); if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if ((IS_TMP_VAR|IS_VAR) == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) { zend_use_new_element_for_string(); @@ -46429,34 +46285,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -46561,35 +46411,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -46694,35 +46538,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -46827,34 +46665,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = NULL; if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_UNUSED == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_UNUSED == IS_UNUSED) { zend_use_new_element_for_string(); @@ -49712,34 +49544,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = RT_CONSTANT((opline+1), (opline+1)->op1); if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CONST & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -49844,35 +49670,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_tmp((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_TMP_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -49977,35 +49797,29 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = _get_zval_ptr_var((opline+1)->op1.var EXECUTE_DATA_CC); if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_VAR & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var)); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); @@ -50110,34 +49924,28 @@ try_assign_dim_array: } } if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { + zend_object *obj = Z_OBJ_P(object_ptr); + + GC_ADDREF(obj); dim = EX_VAR(opline->op2.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(dim))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); dim = ZVAL_UNDEFINED_OP2(); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) { dim++; } value = EX_VAR((opline+1)->op1.var); if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(value))) { - zend_object *obj = Z_OBJ_P(object_ptr); - GC_ADDREF(obj); value = zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - goto assign_dim_error; - } } else if (IS_CV & (IS_CV|IS_VAR)) { ZVAL_DEREF(value); } - zend_assign_to_object_dim(object_ptr, dim, value OPLINE_CC EXECUTE_DATA_CC); + zend_assign_to_object_dim(obj, dim, value OPLINE_CC EXECUTE_DATA_CC); + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (IS_CV == IS_UNUSED) { zend_use_new_element_for_string(); diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c index 31d48709fc9..4595afdc178 100644 --- a/ext/opcache/jit/zend_jit_helpers.c +++ b/ext/opcache/jit/zend_jit_helpers.c @@ -992,13 +992,15 @@ try_string_offset: static void ZEND_FASTCALL zend_jit_fetch_dim_obj_r_helper(zval *container, zval *dim, zval *result) { zval *retval; + zend_object *obj = Z_OBJ_P(container); + GC_ADDREF(obj); if (UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) { zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var); dim = &EG(uninitialized_zval); } - retval = Z_OBJ_HT_P(container)->read_dimension(Z_OBJ_P(container), dim, BP_VAR_R, result); + retval = obj->handlers->read_dimension(obj, dim, BP_VAR_R, result); if (retval) { if (result != retval) { @@ -1009,18 +1011,23 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_obj_r_helper(zval *container, zval } else { ZVAL_NULL(result); } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } static void ZEND_FASTCALL zend_jit_fetch_dim_obj_is_helper(zval *container, zval *dim, zval *result) { zval *retval; + zend_object *obj = Z_OBJ_P(container); + GC_ADDREF(obj); if (UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) { zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var); dim = &EG(uninitialized_zval); } - retval = Z_OBJ_HT_P(container)->read_dimension(Z_OBJ_P(container), dim, BP_VAR_IS, result); + retval = obj->handlers->read_dimension(obj, dim, BP_VAR_IS, result); if (retval) { if (result != retval) { @@ -1031,6 +1038,9 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_obj_is_helper(zval *container, zval } else { ZVAL_NULL(result); } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } static zend_never_inline ZEND_COLD void zend_wrong_string_offset(void) @@ -1292,16 +1302,11 @@ static zend_always_inline void ZEND_FASTCALL zend_jit_fetch_dim_obj_helper(zval if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { zend_object *obj = Z_OBJ_P(object_ptr); + GC_ADDREF(obj); if (dim && UNEXPECTED(Z_ISUNDEF_P(dim))) { const zend_op *opline = EG(current_execute_data)->opline; - GC_ADDREF(obj); zend_jit_undefined_op_helper(opline->op2.var); dim = &EG(uninitialized_zval); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - ZVAL_NULL(result); - return; - } } retval = obj->handlers->read_dimension(obj, dim, type, result); @@ -1330,6 +1335,9 @@ static zend_always_inline void ZEND_FASTCALL zend_jit_fetch_dim_obj_helper(zval ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception"); ZVAL_UNDEF(result); } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) { if (!dim) { zend_throw_error(NULL, "[] operator not supported for strings"); @@ -1373,38 +1381,23 @@ static void ZEND_FASTCALL zend_jit_assign_dim_helper(zval *object_ptr, zval *dim if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) { zend_object *obj = Z_OBJ_P(object_ptr); + GC_ADDREF(obj); if (dim && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) { const zend_op *opline = EG(current_execute_data)->opline; - GC_ADDREF(obj); zend_jit_undefined_op_helper(opline->op2.var); dim = &EG(uninitialized_zval); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - if (result) { - ZVAL_NULL(result); - } - return; - } } if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) { const zend_op *op_data = EG(current_execute_data)->opline + 1; ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV); - GC_ADDREF(obj); zend_jit_undefined_op_helper(op_data->op1.var); value = &EG(uninitialized_zval); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); - if (result) { - ZVAL_NULL(result); - } - return; - } } else { ZVAL_DEREF(value); } - Z_OBJ_HT_P(object_ptr)->write_dimension(obj, dim, value); + obj->handlers->write_dimension(obj, dim, value); if (result) { if (EXPECTED(!EG(exception))) { ZVAL_COPY(result, value); @@ -1412,6 +1405,9 @@ static void ZEND_FASTCALL zend_jit_assign_dim_helper(zval *object_ptr, zval *dim ZVAL_UNDEF(result); } } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); + } return; } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING) && EXPECTED(dim != NULL)) { zend_assign_to_string_offset(object_ptr, dim, value, result); @@ -1451,18 +1447,11 @@ static void ZEND_FASTCALL zend_jit_assign_dim_op_helper(zval *container, zval *d zval *z; zval rv, res; + GC_ADDREF(obj); if (dim && UNEXPECTED(Z_ISUNDEF_P(dim))) { const zend_op *opline = EG(current_execute_data)->opline; - GC_ADDREF(obj); zend_jit_undefined_op_helper(opline->op2.var); dim = &EG(uninitialized_zval); - if (UNEXPECTED(GC_DELREF(obj) == 0)) { - zend_objects_store_del(obj); -//??? if (retval) { -//??? ZVAL_NULL(retval); -//??? } - return; - } } z = obj->handlers->read_dimension(obj, dim, BP_VAR_R, &rv); @@ -1484,6 +1473,12 @@ static void ZEND_FASTCALL zend_jit_assign_dim_op_helper(zval *container, zval *d //??? ZVAL_NULL(retval); //??? } } + if (UNEXPECTED(GC_DELREF(obj) == 0)) { + zend_objects_store_del(obj); +//??? if (retval) { +//??? ZVAL_NULL(retval); +//??? } + } } else { if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) { if (!dim) {