cvs: ZendEngine2 / zend_execute.c zend_vm_def.h zend_vm_execute.h zend_vm_opcodes.h

andrei Fri Apr 15 13:15:19 2005 EDT Modified files: /ZendEngine2 zend_execute.c zend_vm_def.h zend_vm_execute.h zend_vm_opcodes.h Log: Fix certain operations to stop relying on presence of read_property and write_property handlers. They may be NULL'ed out by certain objects pretending to be pure arrays, for example. Do checks first.

http://cvs.php.net/diff.php/ZendEngine2/zend_execute.c?r1=1.693&r2=1.694&ty=u Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.693 ZendEngine2/zend_execute.c:1.694 --- ZendEngine2/zend_execute.c:1.693 Wed Mar 23 16:05:56 2005 +++ ZendEngine2/zend_execute.c Fri Apr 15 13:15:15 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.693 2005/03/23 21:05:56 andrei Exp $ */ +/* $Id: zend_execute.c,v 1.694 2005/04/15 17:15:15 andrei Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -617,7 +617,7 @@ make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */ object = *object_ptr; - if (object->type != IS_OBJECT) { + if (object->type != IS_OBJECT || (opcode == ZEND_ASSIGN_OBJ && !Z_OBJ_HT_P(object)->write_property)) { zend_error(E_WARNING, "Attempt to assign property of non-object"); FREE_OP(free_op2); if (!RETURN_VALUE_UNUSED(result)) { http://cvs.php.net/diff.php/ZendEngine2/zend_vm_def.h?r1=1.19&r2=1.20&ty=u Index: ZendEngine2/zend_vm_def.h diff -u ZendEngine2/zend_vm_def.h:1.19 ZendEngine2/zend_vm_def.h:1.20 --- ZendEngine2/zend_vm_def.h:1.19 Thu Mar 24 18:52:34 2005 +++ ZendEngine2/zend_vm_def.h Fri Apr 15 13:15:17 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_def.h,v 1.19 2005/03/24 23:52:34 helly Exp $ */ +/* $Id: zend_vm_def.h,v 1.20 2005/04/15 17:15:17 andrei Exp $ */ ZEND_VM_HANDLER(1, ZEND_ADD, CONST|TMP|VAR|CV, CONST|TMP|VAR|CV) { @@ -336,41 +336,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -568,24 +580,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } FREE_OP2(); @@ -641,23 +661,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } FREE_OP2(); @@ -1096,7 +1121,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { http://cvs.php.net/diff.php/ZendEngine2/zend_vm_execute.h?r1=1.21&r2=1.22&ty=u Index: ZendEngine2/zend_vm_execute.h diff -u ZendEngine2/zend_vm_execute.h:1.21 ZendEngine2/zend_vm_execute.h:1.22 --- ZendEngine2/zend_vm_execute.h:1.21 Thu Mar 24 18:56:14 2005 +++ ZendEngine2/zend_vm_execute.h Fri Apr 15 13:15:17 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_execute.h,v 1.21 2005/03/24 23:56:14 helly Exp $ */ +/* $Id: zend_vm_execute.h,v 1.22 2005/04/15 17:15:17 andrei Exp $ */ #define ZEND_VM_CONTINUE() return 0 @@ -8095,41 +8095,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -8327,24 +8339,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -8400,23 +8420,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -8544,7 +8569,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -9410,41 +9435,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -9642,24 +9679,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } zval_dtor(free_op2.var); @@ -9715,23 +9760,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } zval_dtor(free_op2.var); @@ -9859,7 +9909,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -10725,41 +10775,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -10957,24 +11019,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -11030,23 +11100,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -11174,7 +11249,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -12191,41 +12266,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -12423,24 +12510,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -12496,23 +12591,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -12640,7 +12740,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -13369,41 +13469,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -13601,24 +13713,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -13674,23 +13794,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -13731,7 +13856,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -14359,41 +14484,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -14591,24 +14728,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } zval_dtor(free_op2.var); @@ -14664,23 +14809,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } zval_dtor(free_op2.var); @@ -14721,7 +14871,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -15308,41 +15458,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -15540,24 +15702,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -15613,23 +15783,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -15670,7 +15845,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -16376,41 +16551,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -16608,24 +16795,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -16681,23 +16876,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -16738,7 +16938,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -18747,41 +18947,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -18979,24 +19191,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -19052,23 +19272,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -19196,7 +19421,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -20062,41 +20287,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -20294,24 +20531,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } zval_dtor(free_op2.var); @@ -20367,23 +20612,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } zval_dtor(free_op2.var); @@ -20511,7 +20761,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -21377,41 +21627,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -21609,24 +21871,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -21682,23 +21952,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -21826,7 +22101,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -22843,41 +23118,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -23075,24 +23362,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } ; @@ -23148,23 +23443,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } ; @@ -23292,7 +23592,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { @@ -28043,41 +28343,53 @@ } if (!have_get_ptr) { - zval *z; + zval *z = NULL; switch (opline->extended_value) { case ZEND_ASSIGN_OBJ: - z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property) { + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + } break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_dimension) { + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_RW TSRMLS_CC); + } break; } - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z) { + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + binary_op(z, z, value TSRMLS_CC); + switch (opline->extended_value) { + case ZEND_ASSIGN_OBJ: + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + break; + case ZEND_ASSIGN_DIM: + Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); + break; + } + if (!RETURN_VALUE_UNUSED(result)) { + *retval = z; + PZVAL_LOCK(*retval); + } + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to assign property of non-object"); + if (!RETURN_VALUE_UNUSED(result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - binary_op(z, z, value TSRMLS_CC); - switch (opline->extended_value) { - case ZEND_ASSIGN_OBJ: - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - break; - case ZEND_ASSIGN_DIM: - Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); - break; - } - if (!RETURN_VALUE_UNUSED(result)) { - *retval = z; - PZVAL_LOCK(*retval); } - zval_ptr_dtor(&z); } if (property == &tmp) { @@ -28275,24 +28587,32 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - z->refcount++; - SEPARATE_ZVAL_IF_NOT_REF(&z); - incdec_op(z); - *retval = z; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - SELECTIVE_PZVAL_LOCK(*retval, &opline->result); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + z->refcount++; + SEPARATE_ZVAL_IF_NOT_REF(&z); + incdec_op(z); + *retval = z; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + SELECTIVE_PZVAL_LOCK(*retval, &opline->result); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + if (!RETURN_VALUE_UNUSED(&opline->result)) { + *retval = EG(uninitialized_zval_ptr); + PZVAL_LOCK(*retval); + } + } } FREE_OP(free_op2); @@ -28348,23 +28668,28 @@ } if (!have_get_ptr) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); + if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { + zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_RW TSRMLS_CC); - if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { - zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); + if (z->type == IS_OBJECT && Z_OBJ_HT_P(z)->get) { + zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); - if (z->refcount == 0) { - zval_dtor(z); - FREE_ZVAL(z); - } - z = value; - } - *retval = *z; - zendi_zval_copy_ctor(*retval); - incdec_op(z); - z->refcount++; - Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); - zval_ptr_dtor(&z); + if (z->refcount == 0) { + zval_dtor(z); + FREE_ZVAL(z); + } + z = value; + } + *retval = *z; + zendi_zval_copy_ctor(*retval); + incdec_op(z); + z->refcount++; + Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); + zval_ptr_dtor(&z); + } else { + zend_error(E_WARNING, "Attempt to increment/decrement property of non-object"); + *retval = *EG(uninitialized_zval_ptr); + } } FREE_OP(free_op2); @@ -28802,7 +29127,7 @@ } - if (container->type != IS_OBJECT) { + if (container->type != IS_OBJECT || !Z_OBJ_HT_P(container)->read_property) { zend_error(E_NOTICE, "Trying to get property of non-object"); *retval = EG(uninitialized_zval_ptr); } else { http://cvs.php.net/diff.php/ZendEngine2/zend_vm_opcodes.h?r1=1.8&r2=1.9&ty=u Index: ZendEngine2/zend_vm_opcodes.h diff -u ZendEngine2/zend_vm_opcodes.h:1.8 ZendEngine2/zend_vm_opcodes.h:1.9 --- ZendEngine2/zend_vm_opcodes.h:1.8 Thu Feb 24 03:52:11 2005 +++ ZendEngine2/zend_vm_opcodes.h Fri Apr 15 13:15:18 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_opcodes.h,v 1.8 2005/02/24 08:52:11 dmitry Exp $ */ +/* $Id: zend_vm_opcodes.h,v 1.9 2005/04/15 17:15:18 andrei Exp $ */ #define ZEND_NOP 0 #define ZEND_ADD 1