Fixed bug #71841 (EG(error_zval) is not handled well)

diff --git a/NEWS b/NEWS
index c839954848d2448331a64dc3fead08e2336d4fce..5ffad7624a65bbcbf75aba8ae5625d09b5fb688e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016, PHP 5.6.21
 
+- Core: 
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+
 - Standard:
   . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
 

diff --git a/Zend/tests/bug71841.phpt b/Zend/tests/bug71841.phpt
new file mode 100644 (file)
index 0000000..f66761b
--- /dev/null
+++ b/Zend/tests/bug71841.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 2b8087e4b7ac7ed76e4eadde7b90051e26465e12..2e81f82e4989aa446d35cad0b5ac197d221b5b55 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -364,13 +364,20 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -625,13 +632,20 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -731,13 +745,16 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 9427fb7ae59cd16d1042d5b45bff380645f7ada1..df47bea982f438dc3941454e346bb196ba268669 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14540,13 +14540,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -14800,13 +14807,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -14906,13 +14920,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -17053,13 +17070,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -17314,13 +17338,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -17420,13 +17451,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -19153,13 +19187,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -19414,13 +19455,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -19520,13 +19568,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -21359,13 +21410,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -22789,13 +22847,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -23049,13 +23114,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -23155,13 +23227,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -24751,13 +24826,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -25010,13 +25092,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -25116,13 +25205,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -26164,13 +26256,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -26424,13 +26523,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -26530,13 +26636,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -27486,13 +27595,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -27746,13 +27862,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -27852,13 +27975,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -28809,13 +28935,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -29240,13 +29373,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -29499,13 +29639,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -29605,13 +29752,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -32075,13 +32225,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -32334,13 +32491,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -32440,13 +32604,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -34359,13 +34526,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -34619,13 +34793,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -34725,13 +34906,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -36322,13 +36506,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -36582,13 +36773,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -36688,13 +36886,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }
 
@@ -38390,13 +38591,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -39671,13 +39879,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
                        && Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                        zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                        if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                                have_get_ptr = 1;
-                               binary_op(*zptr, *zptr, value TSRMLS_CC);
-                               if (RETURN_VALUE_USED(opline)) {
-                                       PZVAL_LOCK(*zptr);
-                                       EX_T(opline->result.var).var.ptr = *zptr;
+                               if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(&EG(uninitialized_zval));
+                                               EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+                                       }
+                               } else {
+                                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                                       binary_op(*zptr, *zptr, value TSRMLS_CC);
+                                       if (RETURN_VALUE_USED(opline)) {
+                                               PZVAL_LOCK(*zptr);
+                                               EX_T(opline->result.var).var.ptr = *zptr;
+                                       }
                                }
                        }
                }
@@ -39930,13 +40145,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc
        if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
                        have_get_ptr = 1;
-                       incdec_op(*zptr);
-                       if (RETURN_VALUE_USED(opline)) {
-                               *retval = *zptr;
-                               PZVAL_LOCK(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               if (RETURN_VALUE_USED(opline)) {
+                                       PZVAL_LOCK(&EG(uninitialized_zval));
+                                       *retval = &EG(uninitialized_zval);
+                               }
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+                               incdec_op(*zptr);
+                               if (RETURN_VALUE_USED(opline)) {
+                                       *retval = *zptr;
+                                       PZVAL_LOCK(*retval);
+                               }
                        }
                }
        }
@@ -40036,13 +40258,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in
                zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
                if (zptr != NULL) {                     /* NULL means no success in getting PTR */
                        have_get_ptr = 1;
-                       SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-                       ZVAL_COPY_VALUE(retval, *zptr);
-                       zendi_zval_copy_ctor(*retval);
+                       if (UNEXPECTED(*zptr == &EG(error_zval))) {
+                               ZVAL_NULL(retval);
+                       } else {
+                               SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-                       incdec_op(*zptr);
+                               ZVAL_COPY_VALUE(retval, *zptr);
+                               zendi_zval_copy_ctor(*retval);
 
+                               incdec_op(*zptr);
+                       }
                }
        }