Merge branch 'PHP-7.2' into PHP-7.3

diff --cc NEWS
index c6c3af84b7aed482ef474425b87200f1b433f04b,d2acdd1b908ae2deebb27bca032c7f69133c21d3..a81584080987beeee2a9d8b99a63e03ff5cf0669
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,37 -1,16 +1,39 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2018, PHP 7.2.11
 +?? ??? ????, PHP 7.3.0RC2
 +
 +- CURL:
 +  . Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected).
 +    (Pierrick)
  
  - Core:
 +  . Fixed bug #76869 (Incorrect bypassing protected method accessibilty check).
 +    (Dmitry)
    . Fixed bug #76800 (foreach inconsistent if array modified during loop).
      (Dmitry)
+   . Fixed bug #76901 (method_exists on SPL iterator passthrough method corrupts
+     memory). (Nikita)
  
 -- CURL:
 -  . Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected).
 -    (Pierrick)
 +- Standard:
 +  . Fixed bug #75533 (array_reduce is slow when $carry is large array).
 +    (Manabu Matsui)
 +
 +- XMLRPC:
 +  . Fixed bug #76886 (Can't build xmlrpc with expat). (Thomas Petazzoni, cmb)
 +
 +13 Sep 2018, PHP 7.3.0RC1
 +
 +- Core:
 +  . Fixed bug #76825 (Undefined symbols ___cpuid_count). (Laruence)
 +  . Fixed bug #76820 (Z_COPYABLE invalid definition). (mvdwerve, cmb)
 +  . Fixed bug #76510 (file_exists() stopped working for phar://). (cmb)
 +
 +- intl:
 +  . Fixed bug #76829 (Incorrect validation of domain on idn_to_utf8()
 +    function). (Anatol)
 +
 +- MBString:
 +  . Updated to Oniguruma 6.9.0. (cmb)
  
  - Opcache:
    . Fixed bug #76832 (ZendOPcache.MemoryBase periodically deleted by the OS).

diff --cc Zend/zend_builtin_functions.c
index 4989b4b5b5324344d40022047c72beb94b5ba644,8cd0207e46c71adf5912bcaf0af93436a277ceb7..96d5127711eda450fae147284936d264f991aeef
--- 1/Zend/zend_builtin_functions.c
--- 2/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@@ -1345,15 -1292,12 +1345,12 @@@ ZEND_FUNCTION(method_exists
  
        lcname = zend_string_tolower(method_name);
        if (zend_hash_exists(&ce->function_table, lcname)) {
 -              zend_string_release(lcname);
 +              zend_string_release_ex(lcname, 0);
                RETURN_TRUE;
-       } else {
-               union _zend_function *func = NULL;
- 
-               if (Z_TYPE_P(klass) == IS_OBJECT
-               && Z_OBJ_HT_P(klass)->get_method != NULL
-               && (func = Z_OBJ_HT_P(klass)->get_method(&Z_OBJ_P(klass), method_name, NULL)) != NULL
-               ) {
+       } else if (Z_TYPE_P(klass) == IS_OBJECT && Z_OBJ_HT_P(klass)->get_method != NULL) {
+               zend_object *obj = Z_OBJ_P(klass);
+               zend_function *func = Z_OBJ_HT_P(klass)->get_method(&obj, method_name, NULL);
+               if (func != NULL) {
                        if (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
                                /* Returns true to the fake Closure's __invoke */
                                RETVAL_BOOL(func->common.scope == zend_ce_closure