Implement list() reference assignments

Support list() reference assignments of the form:

    list(&$a, list(&$b, $c)) = $d;

RFC: https://wiki.php.net/rfc/list_reference_assignment

diff --git a/NEWS b/NEWS
index ccd359605083d6d600a1a7fce1d5cd8923e80abf..1611c51ccc98615371534e5072143c00b421b904 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Removed support for BeOS. (Kalle)
   . Add PHP_VERSION to phpinfo() <title/>. (github/MattJeevas)
   . Add net_get_interfaces(). (Sara, Joe, Anatol)
+  . Added support for references in list() and array destructuring, per
+    RFC https://wiki.php.net/rfc/list_reference_assignment.
+    (David Walker)
   . Fixed bug #75031 (support append mode in temp/memory streams). (adsr)
   . Fixed bug #74860 (Uncaught exceptions not being formatted properly when
     error_log set to "syslog"). (Philip Prindeville)

diff --git a/UPGRADING b/UPGRADING
index 64ce1a0cb038d3752aac41e19d6a3ee4bf8e1811..b2ad92add021f39d344cd524688dc79690c52417 100644 (file)
--- a/UPGRADING
+++ b/UPGRADING
@@ -45,6 +45,11 @@ Standard:
 2. New Features
 ========================================
 
+Core:
+  . Array destructuring now supports reference assignments using the syntax
+    [&$a, [$b, &$c]] = $d. The same is also supported for list().
+    (RFC: https://wiki.php.net/rfc/list_reference_assignment)
+
 BCMath:
   . bcscale() can now also be used as getter to retrieve the current scale in use.
 

diff --git a/Zend/tests/list/list_reference_001.phpt b/Zend/tests/list/list_reference_001.phpt
new file mode 100644 (file)
index 0000000..a173c71
--- /dev/null
+++ b/Zend/tests/list/list_reference_001.phpt
@@ -0,0 +1,88 @@
+--TEST--
+"Reference Unpacking - General" list()
+--FILE--
+<?php
+$arr = array(1, array(2));
+list(&$a, list(&$b)) = $arr;
+var_dump($a, $b);
+var_dump($arr);
+
+$arr = array(1, array(2));
+list($a, &$b) = $arr;
+var_dump($arr);
+
+$arr = array(1, array(2));
+[&$a, [&$b]] = $arr;
+var_dump($a, $b);
+var_dump($arr);
+
+$arr = array(1, array(2));
+[&$a, [&$b], &$c] = $arr;
+var_dump($a, $b, $c);
+var_dump($arr);
+
+$arr = array("one" => 1, "two" => array(2));
+["one" => &$a, "two" => [&$b], "three" => &$c] = $arr;
+var_dump($a, $b, $c);
+var_dump($arr);
+?>
+--EXPECTF--
+int(1)
+int(2)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  array(1) {
+    [0]=>
+    &int(2)
+  }
+}
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  &array(1) {
+    [0]=>
+    int(2)
+  }
+}
+int(1)
+int(2)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  array(1) {
+    [0]=>
+    &int(2)
+  }
+}
+int(1)
+int(2)
+NULL
+array(3) {
+  [0]=>
+  &int(1)
+  [1]=>
+  array(1) {
+    [0]=>
+    &int(2)
+  }
+  [2]=>
+  &NULL
+}
+int(1)
+int(2)
+NULL
+array(3) {
+  ["one"]=>
+  &int(1)
+  ["two"]=>
+  array(1) {
+    [0]=>
+    &int(2)
+  }
+  ["three"]=>
+  &NULL
+}

diff --git a/Zend/tests/list/list_reference_002.phpt b/Zend/tests/list/list_reference_002.phpt
new file mode 100644 (file)
index 0000000..32aad68
--- /dev/null
+++ b/Zend/tests/list/list_reference_002.phpt
@@ -0,0 +1,20 @@
+--TEST--
+"Reference Unpacking - New Reference" list()
+--FILE--
+<?php
+$arr = array(new stdclass);
+list(&$a, &$b) = $arr;
+var_dump($a, $b);
+var_dump($arr);
+?>
+--EXPECTF--
+object(stdClass)#%d (0) {
+}
+NULL
+array(2) {
+  [0]=>
+  &object(stdClass)#%d (0) {
+  }
+  [1]=>
+  &NULL
+}

diff --git a/Zend/tests/list/list_reference_003.phpt b/Zend/tests/list/list_reference_003.phpt
new file mode 100644 (file)
index 0000000..9c90340
--- /dev/null
+++ b/Zend/tests/list/list_reference_003.phpt
@@ -0,0 +1,73 @@
+--TEST--
+"Reference Unpacking - From Functions" list()
+--FILE--
+<?php
+$arr = [1, 2];
+function no_ref($a) {
+    return $a;
+}
+
+function no_ref_by_ref(&$a) {
+    return $a;
+}
+
+function &ref_return(&$a) {
+    return $a;
+}
+
+function &ref_return_global() {
+    global $arr;
+    return $arr;
+}
+
+$a = [1, 2];
+[&$var] = no_ref($a);
+var_dump($var);
+var_dump($a);
+
+$a = [1, 2];
+[&$var] = no_ref_by_ref($a);
+var_dump($var);
+var_dump($a);
+
+$a = [1, 2];
+[&$var] = ref_return($a);
+var_dump($var);
+var_dump($a);
+
+[,&$var] = ref_return_global();
+var_dump($var);
+var_dump($arr);
+?>
+--EXPECTF--
+Notice: Attempting to set reference to non referenceable value in %s on line %d
+int(1)
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+
+Notice: Attempting to set reference to non referenceable value in %s on line %d
+int(1)
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+int(1)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  int(2)
+}
+int(2)
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  &int(2)
+}

diff --git a/Zend/tests/list/list_reference_004.phpt b/Zend/tests/list/list_reference_004.phpt
new file mode 100644 (file)
index 0000000..fc9955e
--- /dev/null
+++ b/Zend/tests/list/list_reference_004.phpt
@@ -0,0 +1,28 @@
+--TEST--
+"Reference Unpacking - Foreach" list()
+--FILE--
+<?php
+$coords = array(array(1, 2), array(3, 4));
+foreach ($coords as [&$x, $y]) {
+    $x++;
+    $y++;
+}
+var_dump($coords);
+?>
+--EXPECTF--
+array(2) {
+  [0]=>
+  array(2) {
+    [0]=>
+    int(2)
+    [1]=>
+    int(2)
+  }
+  [1]=>
+  array(2) {
+    [0]=>
+    &int(4)
+    [1]=>
+    int(4)
+  }
+}

diff --git a/Zend/tests/list/list_reference_005.phpt b/Zend/tests/list/list_reference_005.phpt
new file mode 100644 (file)
index 0000000..397f901
--- /dev/null
+++ b/Zend/tests/list/list_reference_005.phpt
@@ -0,0 +1,73 @@
+--TEST--
+"Reference Unpacking - Class Property and Methods" list()
+--FILE--
+<?php
+class A {
+    public $a = [['hello']];
+    public $b = ['world'];
+
+    public function getVar() {
+        return $this->a;
+    }
+
+    public function &getVarRef() {
+        return $this->a;
+    }
+}
+
+class B {
+    static $a = [['world']];
+}
+
+$a = new A();
+[&$var] = $a->a;
+[&$var_too] = $a->b;
+var_dump($a->a);
+var_dump($a->b);
+
+$a = new A();
+[&$var] = $a->getVar();
+var_dump($a->a);
+
+$a = new A();
+[&$var] = $a->getVarRef();
+var_dump($a->a);
+
+[&$var] = B::$a;
+var_dump(B::$a);
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    string(5) "hello"
+  }
+}
+array(1) {
+  [0]=>
+  &string(5) "world"
+}
+
+Notice: Attempting to set reference to non referenceable value in %s on line %d
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    string(5) "hello"
+  }
+}
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    string(5) "hello"
+  }
+}
+array(1) {
+  [0]=>
+  &array(1) {
+    [0]=>
+    string(5) "world"
+  }
+}

diff --git a/Zend/tests/list/list_reference_006.phpt b/Zend/tests/list/list_reference_006.phpt
new file mode 100644 (file)
index 0000000..f85edf0
--- /dev/null
+++ b/Zend/tests/list/list_reference_006.phpt
@@ -0,0 +1,58 @@
+--TEST--
+"Reference Unpacking - Class ArrayAccess No Reference" list()
+--FILE--
+<?php
+class StorageNoRef implements ArrayAccess {
+    private $s = [];
+    function __construct(array $a) { $this->s = $a; }
+    function offsetSet ($k, $v) { $this->s[$k] = $v; }
+    function offsetGet ($k) { return $this->s[$k]; }
+    function offsetExists ($k) { return isset($this->s[$k]); }
+    function offsetUnset ($k) { unset($this->s[$k]); }
+}
+
+$a = new StorageNoRef([1, 2]);
+list(&$one, $two) = $a;
+var_dump($a);
+
+$a = new StorageNoRef([1, 2]);
+list(,,list($var)) = $a;
+var_dump($a);
+
+$a = new StorageNoRef(['one' => 1, 'two' => 2]);
+['one' => &$one, 'two' => $two] = $a;
+var_dump($a);
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded element of %s has no effect in %s on line %d
+object(StorageNoRef)#1 (1) {
+  ["s":"StorageNoRef":private]=>
+  array(2) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+  }
+}
+
+Notice: Undefined offset: 2 in %s on line %d
+object(StorageNoRef)#2 (1) {
+  ["s":"StorageNoRef":private]=>
+  array(2) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+  }
+}
+
+Notice: Indirect modification of overloaded element of %s has no effect in %s on line %d
+object(StorageNoRef)#1 (1) {
+  ["s":"StorageNoRef":private]=>
+  array(2) {
+    ["one"]=>
+    int(1)
+    ["two"]=>
+    int(2)
+  }
+}

diff --git a/Zend/tests/list/list_reference_007.phpt b/Zend/tests/list/list_reference_007.phpt
new file mode 100644 (file)
index 0000000..51f1cac
--- /dev/null
+++ b/Zend/tests/list/list_reference_007.phpt
@@ -0,0 +1,75 @@
+--TEST--
+"Reference Unpacking - Class ArrayAccess With Reference" list()
+--FILE--
+<?php
+
+class StorageRef implements ArrayAccess {
+    private $s = [];
+    function __construct(array $a) { $this->s = $a; }
+    function offsetSet ($k, $v) { $this->s[$k] = $v; }
+    function &offsetGet ($k) { return $this->s[$k]; }
+    function offsetExists ($k) { return isset($this->s[$k]); }
+    function offsetUnset ($k) { unset($this->s[$k]); }
+}
+
+$a = new StorageRef([1, 2]);
+list(&$one, $two) = $a;
+var_dump($a);
+
+$a = new StorageRef([1, 2]);
+list(,,list($var)) = $a;
+var_dump($a);
+
+$a = new StorageRef([1, 2]);
+list(,,list(&$var)) = $a;
+var_dump($a);
+
+$a = new StorageRef(['one' => 1, 'two' => 2]);
+['one' => &$one, 'two' => $two] = $a;
+var_dump($a);
+
+?>
+--EXPECTF--
+object(StorageRef)#1 (1) {
+  ["s":"StorageRef":private]=>
+  array(2) {
+    [0]=>
+    &int(1)
+    [1]=>
+    int(2)
+  }
+}
+object(StorageRef)#2 (1) {
+  ["s":"StorageRef":private]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    NULL
+  }
+}
+object(StorageRef)#1 (1) {
+  ["s":"StorageRef":private]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    array(1) {
+      [0]=>
+      &NULL
+    }
+  }
+}
+object(StorageRef)#2 (1) {
+  ["s":"StorageRef":private]=>
+  array(2) {
+    ["one"]=>
+    &int(1)
+    ["two"]=>
+    int(2)
+  }
+}

diff --git a/Zend/tests/list/list_reference_008.phpt b/Zend/tests/list/list_reference_008.phpt
new file mode 100644 (file)
index 0000000..9c754a6
--- /dev/null
+++ b/Zend/tests/list/list_reference_008.phpt
@@ -0,0 +1,68 @@
+--TEST--
+"Reference Unpacking - Oddities" list()
+--FILE--
+<?php
+$a = 1;
+$b =& $a;
+$arr = [&$a, &$b];
+list(&$a, &$b) = $arr;
+var_dump($a, $b, $arr);
+$b++;
+var_dump($a, $b, $arr);
+unset($a, $b, $arr);
+
+/*
+ * $a is first set as a reference to the 0'th elem, '1'
+ * $a is then set to the value of the 1'st elem, '2'
+ * $arr would look like, [2,2]
+ * Increment $a, and it should be [3, 2]
+ */
+$arr = [1, 2];
+list(&$a, $a) = $arr;
+var_dump($a);
+$a++;
+var_dump($arr);
+unset($a, $arr);
+
+/*
+ * We do not allow references to the same variable of rhs.
+ */
+$a = [1, 2];
+$ref =& $a;
+list(&$a, &$b) = $a;
+var_dump($a, $b);
+$a++; $b++;
+var_dump($ref);
+?>
+--EXPECTF--
+int(1)
+int(1)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  &int(1)
+}
+int(2)
+int(2)
+array(2) {
+  [0]=>
+  &int(2)
+  [1]=>
+  &int(2)
+}
+int(2)
+array(2) {
+  [0]=>
+  &int(3)
+  [1]=>
+  int(2)
+}
+int(1)
+int(2)
+array(2) {
+  [0]=>
+  &int(2)
+  [1]=>
+  &int(3)
+}

diff --git a/Zend/tests/list/list_reference_009.phpt b/Zend/tests/list/list_reference_009.phpt
new file mode 100644 (file)
index 0000000..f0adc1f
--- /dev/null
+++ b/Zend/tests/list/list_reference_009.phpt
@@ -0,0 +1,47 @@
+--TEST--
+"Reference Unpacking - VM Safety" list()
+--FILE--
+<?php
+$ary = [[0, 1]];
+[[
+    0 => &$a,
+    ($ary["foo"] = 1) => &$b
+]] = $ary;
+
+var_dump($ary, $a, $b);
+unset($ary, $a, $b);
+
+$ary = [[0, 1]];
+[
+    0 => &$a,
+    ($ary["foo"] = 1) => &$b
+] = $ary[0];
+var_dump($ary, $a, $b);
+?>
+--EXPECTF--
+array(2) {
+  [0]=>
+  array(2) {
+    [0]=>
+    &int(0)
+    [1]=>
+    &int(1)
+  }
+  ["foo"]=>
+  int(1)
+}
+int(0)
+int(1)
+array(2) {
+  [0]=>
+  array(2) {
+    [0]=>
+    &int(0)
+    [1]=>
+    &int(1)
+  }
+  ["foo"]=>
+  int(1)
+}
+int(0)
+int(1)

diff --git a/Zend/tests/list/list_reference_010.phpt b/Zend/tests/list/list_reference_010.phpt
new file mode 100644 (file)
index 0000000..8ceb344
--- /dev/null
+++ b/Zend/tests/list/list_reference_010.phpt
@@ -0,0 +1,8 @@
+--TEST--
+"Reference Unpacking - Compile Error (scalar)" list()
+--FILE--
+<?php
+list(&$foo) = [42];
+?>
+--EXPECTF--
+Fatal error: Cannot assign reference to non referencable value in %s on line %d

diff --git a/Zend/tests/list/list_reference_011.phpt b/Zend/tests/list/list_reference_011.phpt
new file mode 100644 (file)
index 0000000..405f34f
--- /dev/null
+++ b/Zend/tests/list/list_reference_011.phpt
@@ -0,0 +1,9 @@
+--TEST--
+"Reference Unpacking - Compile Error (const)" list()
+--FILE--
+<?php
+const FOO = 10;
+[&$f] = FOO;
+?>
+--EXPECTF--
+Fatal error: Cannot assign reference to non referencable value in %s on line %d

diff --git a/Zend/tests/list_009.phpt b/Zend/tests/list_009.phpt
deleted file mode 100644 (file)
index c28ca80..0000000
--- a/Zend/tests/list_009.phpt
+++ /dev/null
@@ -1,14 +0,0 @@
---TEST--
-list with by-reference assignment should fail
---FILE--
-<?php
-
-$a = [1];
-[&$foo] = $a;
-$foo = 2;
-
-var_dump($a);
-
-?>
---EXPECTF--
-Fatal error: [] and list() assignments cannot be by reference in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 19b8fbceee8317db47d8c2a9a43fcd2713be120c..a032188e11fc2e7ca7ec8f244fc246190f8c17c9 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -771,7 +771,8 @@ void zend_do_free(znode *op1) /* {{{ */
                        }
                } else {
                        while (opline >= CG(active_op_array)->opcodes) {
-                               if (opline->opcode == ZEND_FETCH_LIST &&
+                               if ((opline->opcode == ZEND_FETCH_LIST_R ||
+                     opline->opcode == ZEND_FETCH_LIST_W) &&
                                    opline->op1_type == IS_VAR &&
                                    opline->op1.var == op1->u.op.var) {
                                        zend_emit_op(NULL, ZEND_FREE, op1, NULL);
@@ -2078,7 +2079,8 @@ static void zend_check_live_ranges(zend_op *opline) /* {{{ */
                               opline->opcode == ZEND_ROPE_ADD ||
                               opline->opcode == ZEND_ROPE_END ||
                               opline->opcode == ZEND_END_SILENCE ||
-                              opline->opcode == ZEND_FETCH_LIST ||
+                              opline->opcode == ZEND_FETCH_LIST_R ||
+                              opline->opcode == ZEND_FETCH_LIST_W ||
                               opline->opcode == ZEND_VERIFY_RETURN_TYPE ||
                               opline->opcode == ZEND_BIND_LEXICAL) {
                        /* these opcodes are handled separately */
@@ -2656,18 +2658,13 @@ static void zend_separate_if_call_and_write(znode *node, zend_ast *ast, uint32_t
 
 void zend_delayed_compile_var(znode *result, zend_ast *ast, uint32_t type);
 void zend_compile_assign(znode *result, zend_ast *ast);
-static void zend_compile_list_assign(znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style);
 
 static inline void zend_emit_assign_znode(zend_ast *var_ast, znode *value_node) /* {{{ */
 {
        znode dummy_node;
-       if (var_ast->kind == ZEND_AST_ARRAY) {
-               zend_compile_list_assign(&dummy_node, var_ast, value_node, var_ast->attr);
-       } else {
-               zend_ast *assign_ast = zend_ast_create(ZEND_AST_ASSIGN, var_ast,
-                       zend_ast_create_znode(value_node));
-               zend_compile_assign(&dummy_node, assign_ast);
-       }
+       zend_ast *assign_ast = zend_ast_create(ZEND_AST_ASSIGN, var_ast,
+               zend_ast_create_znode(value_node));
+       zend_compile_assign(&dummy_node, assign_ast);
        zend_do_free(&dummy_node);
 }
 /* }}} */
@@ -2793,6 +2790,30 @@ static void zend_verify_list_assign_target(zend_ast *var_ast, zend_bool old_styl
 }
 /* }}} */
 
+static inline void zend_emit_assign_ref_znode(zend_ast *var_ast, znode *value_node);
+
+/* Propagate refs used on leaf elements to the surrounding list() structures. */
+static zend_bool zend_propagate_list_refs(zend_ast *ast) { /* {{{ */
+       zend_ast_list *list = zend_ast_get_list(ast);
+       zend_bool has_refs = 0;
+       uint32_t i;
+
+       for (i = 0; i < list->children; ++i) {
+               zend_ast *elem_ast = list->child[i];
+
+               if (elem_ast) {
+                       zend_ast *var_ast = elem_ast->child[0];
+                       if (var_ast->kind == ZEND_AST_ARRAY) {
+                               elem_ast->attr = zend_propagate_list_refs(var_ast);
+                       }
+                       has_refs |= elem_ast->attr;
+               }
+       }
+
+       return has_refs;
+}
+/* }}} */
+
 static void zend_compile_list_assign(
                znode *result, zend_ast *ast, znode *expr_node, zend_bool old_style) /* {{{ */
 {
@@ -2820,10 +2841,6 @@ static void zend_compile_list_assign(
                        }
                }
 
-               if (elem_ast->attr) {
-                       zend_error(E_COMPILE_ERROR, "[] and list() assignments cannot be by reference");
-               }
-
                var_ast = elem_ast->child[0];
                key_ast = elem_ast->child[1];
                has_elems = 1;
@@ -2851,15 +2868,30 @@ static void zend_compile_list_assign(
 
                zend_verify_list_assign_target(var_ast, old_style);
 
-               zend_emit_op(&fetch_result, ZEND_FETCH_LIST, expr_node, &dim_node);
-               zend_emit_assign_znode(var_ast, &fetch_result);
+               zend_emit_op(&fetch_result,
+                       elem_ast->attr ? ZEND_FETCH_LIST_W : ZEND_FETCH_LIST_R, expr_node, &dim_node);
+
+               if (var_ast->kind == ZEND_AST_ARRAY) {
+                       if (elem_ast->attr) {
+                               zend_emit_op(&fetch_result, ZEND_MAKE_REF, &fetch_result, NULL);
+                       }
+                       zend_compile_list_assign(NULL, var_ast, &fetch_result, var_ast->attr);
+               } else if (elem_ast->attr) {
+                       zend_emit_assign_ref_znode(var_ast, &fetch_result);
+               } else {
+                       zend_emit_assign_znode(var_ast, &fetch_result);
+               }
        }
 
        if (has_elems == 0) {
                zend_error_noreturn(E_COMPILE_ERROR, "Cannot use empty list");
        }
 
-       *result = *expr_node;
+       if (result) {
+               *result = *expr_node;
+       } else {
+               zend_do_free(expr_node);
+       }
 }
 /* }}} */
 
@@ -3005,17 +3037,32 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
                        zend_emit_op_data(&expr_node);
                        return;
                case ZEND_AST_ARRAY:
-                       if (zend_list_has_assign_to_self(var_ast, expr_ast)) {
-                               /* list($a, $b) = $a should evaluate the right $a first */
-                               znode cv_node;
+                       if (zend_propagate_list_refs(var_ast)) {
+                               if (!zend_is_variable(expr_ast)) {
+                                       zend_error_noreturn(E_COMPILE_ERROR,
+                                               "Cannot assign reference to non referencable value");
+                               }
 
-                               if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
-                                       zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
-                               } else {
-                                       zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+                               zend_compile_var(&expr_node, expr_ast, BP_VAR_W);
+                               /* MAKE_REF is usually not necessary for CVs. However, if there are
+                                * self-assignments, this forces the RHS to evaluate first. */
+                               if (expr_node.op_type != IS_CV
+                                               || zend_list_has_assign_to_self(var_ast, expr_ast)) {
+                                       zend_emit_op(&expr_node, ZEND_MAKE_REF, &expr_node, NULL);
                                }
                        } else {
-                               zend_compile_expr(&expr_node, expr_ast);
+                               if (zend_list_has_assign_to_self(var_ast, expr_ast)) {
+                                       /* list($a, $b) = $a should evaluate the right $a first */
+                                       znode cv_node;
+
+                                       if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
+                                               zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
+                                       } else {
+                                               zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+                                       }
+                               } else {
+                                       zend_compile_expr(&expr_node, expr_ast);
+                               }
                        }
 
                        zend_compile_list_assign(result, var_ast, &expr_node, var_ast->attr);
@@ -4755,6 +4802,10 @@ void zend_compile_foreach(zend_ast *ast) /* {{{ */
                value_ast = value_ast->child[0];
        }
 
+       if (value_ast->kind == ZEND_AST_ARRAY && zend_propagate_list_refs(value_ast)) {
+               by_ref = 1;
+       }
+
        if (by_ref && is_variable) {
                zend_compile_var(&expr_node, expr_ast, BP_VAR_W);
        } else {
@@ -4776,13 +4827,15 @@ void zend_compile_foreach(zend_ast *ast) /* {{{ */
        if (is_this_fetch(value_ast)) {
                zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
        } else if (value_ast->kind == ZEND_AST_VAR &&
-           zend_try_compile_cv(&value_node, value_ast) == SUCCESS) {
+               zend_try_compile_cv(&value_node, value_ast) == SUCCESS) {
                SET_NODE(opline->op2, &value_node);
        } else {
                opline->op2_type = IS_VAR;
                opline->op2.var = get_temporary_variable(CG(active_op_array));
                GET_NODE(&value_node, opline->op2);
-               if (by_ref) {
+               if (value_ast->kind == ZEND_AST_ARRAY) {
+                       zend_compile_list_assign(NULL, value_ast, &value_node, value_ast->attr);
+               } else if (by_ref) {
                        zend_emit_assign_ref_znode(value_ast, &value_node);
                } else {
                        zend_emit_assign_znode(value_ast, &value_node);

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 790de425d852ef77bf2db17809b65f524ecd40e6..fcc78f2eb9a0fb751b90ffebce970fd3b9ad8cbc 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1150,6 +1150,7 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
                case ZEND_FETCH_DIM_RW:
                case ZEND_FETCH_DIM_FUNC_ARG:
                case ZEND_FETCH_DIM_UNSET:
+               case ZEND_FETCH_LIST_W:
                        /* TODO: Encode the "reason" into opline->extended_value??? */
                        var = opline->result.var;
                        opline++;
@@ -1192,6 +1193,7 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
                                                case ZEND_FETCH_DIM_RW:
                                                case ZEND_FETCH_DIM_FUNC_ARG:
                                                case ZEND_FETCH_DIM_UNSET:
+                                               case ZEND_FETCH_LIST_W:
                                                case ZEND_ASSIGN_DIM:
                                                        msg = "Cannot use string offset as an array";
                                                        break;
@@ -1857,7 +1859,12 @@ static zend_never_inline void zend_fetch_dimension_address_read_IS(zval *result,
        zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 1, 0 EXECUTE_DATA_CC);
 }
 
-static zend_never_inline void zend_fetch_dimension_address_read_LIST(zval *result, zval *container, zval *dim EXECUTE_DATA_DC)
+static zend_never_inline void zend_fetch_dimension_address_LIST_w(zval *result, zval *container, zval *dim EXECUTE_DATA_DC)
+{
+       zend_fetch_dimension_address(result, container, dim, IS_TMP_VAR, BP_VAR_W EXECUTE_DATA_CC);
+}
+
+static zend_never_inline void zend_fetch_dimension_address_LIST_r(zval *result, zval *container, zval *dim EXECUTE_DATA_DC)
 {
        zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
 }

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 726c8abc166e2061201b6d56573caf2705bbeb2e..71e332ceb296fd3589d105c738366f0138604fee 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2002,7 +2002,7 @@ ZEND_VM_HANDLER(97, ZEND_FETCH_OBJ_UNSET, VAR|UNUSED|THIS|CV, CONST|TMPVAR|CV)
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HANDLER(98, ZEND_FETCH_LIST, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
+ZEND_VM_HANDLER(98, ZEND_FETCH_LIST_R, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 {
        USE_OPLINE
        zend_free_op free_op1, free_op2;
@@ -2010,7 +2010,32 @@ ZEND_VM_HANDLER(98, ZEND_FETCH_LIST, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 
        SAVE_OPLINE();
        container = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R) EXECUTE_DATA_CC);
+       FREE_OP2();
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
+ZEND_VM_HANDLER(198, ZEND_FETCH_LIST_W, VAR|CV, CONST|TMPVAR|CV)
+{
+       USE_OPLINE
+       zend_free_op free_op1, free_op2;
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = GET_OP1_ZVAL_PTR_PTR_UNDEF(BP_VAR_W);
+       dim = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+
+       if (OP1_TYPE == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
+
        FREE_OP2();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 1e5bea29c39abf971f1727980f13d2597fc94c0d..5258da7f0d39c3271386142df4ef47040d380aca 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5206,7 +5206,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
        }
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
 
@@ -5214,7 +5214,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_CONST_HA
 
        SAVE_OPLINE();
        container = RT_CONSTANT(opline, opline->op1);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -7969,7 +7969,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
        }
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
        zend_free_op free_op2;
@@ -7977,7 +7977,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_H
 
        SAVE_OPLINE();
        container = RT_CONSTANT(opline, opline->op1);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
        zval_ptr_dtor_nogc(free_op2);
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -11513,7 +11513,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
        }
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
 
@@ -11521,7 +11521,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CONST_CV_HANDL
 
        SAVE_OPLINE();
        container = RT_CONSTANT(opline, opline->op1);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -14994,7 +14994,7 @@ fetch_obj_is_no_object:
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
        zend_free_op free_op1;
@@ -15002,7 +15002,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_H
 
        SAVE_OPLINE();
        container = _get_zval_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -16687,7 +16687,7 @@ fetch_obj_is_no_object:
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
        zend_free_op free_op1, free_op2;
@@ -16695,7 +16695,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_
 
        SAVE_OPLINE();
        container = _get_zval_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
        zval_ptr_dtor_nogc(free_op2);
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -18888,7 +18888,7 @@ fetch_obj_is_no_object:
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
        zend_free_op free_op1;
@@ -18896,7 +18896,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_TMPVAR_CV_HAND
 
        SAVE_OPLINE();
        container = _get_zval_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -24837,6 +24837,30 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+       zend_free_op free_op1;
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
+       dim = RT_CONSTANT(opline, opline->op2);
+
+       if (IS_VAR == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
+
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
@@ -27267,6 +27291,31 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMPVA
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+       zend_free_op free_op1, free_op2;
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
+       dim = _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC);
+
+       if (IS_VAR == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
+
+       zval_ptr_dtor_nogc(free_op2);
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_OBJ_SPEC_VAR_TMPVAR_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
@@ -31127,6 +31176,30 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HA
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+       zend_free_op free_op1;
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, &free_op1 EXECUTE_DATA_CC);
+       dim = _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC);
+
+       if (IS_VAR == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
+
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_OBJ_SPEC_VAR_CV_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
@@ -42499,7 +42572,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
 
@@ -42507,7 +42580,31 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_CONST_HANDL
 
        SAVE_OPLINE();
        container = _get_zval_ptr_cv_undef(opline->op1.var EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, RT_CONSTANT(opline, opline->op2) EXECUTE_DATA_CC);
+
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_cv_undef_BP_VAR_W(opline->op1.var EXECUTE_DATA_CC);
+       dim = RT_CONSTANT(opline, opline->op2);
+
+       if (IS_CV == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -46526,7 +46623,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
        zend_free_op free_op2;
@@ -46534,7 +46631,32 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_TMPVAR_HAND
 
        SAVE_OPLINE();
        container = _get_zval_ptr_cv_undef(opline->op1.var EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zval_ptr_dtor_nogc(free_op2);
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+       zend_free_op free_op2;
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_cv_undef_BP_VAR_W(opline->op1.var EXECUTE_DATA_CC);
+       dim = _get_zval_ptr_var(opline->op2.var, &free_op2 EXECUTE_DATA_CC);
+
+       if (IS_CV == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
+
        zval_ptr_dtor_nogc(free_op2);
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -52310,7 +52432,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HAN
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        USE_OPLINE
 
@@ -52318,7 +52440,31 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_SPEC_CV_CV_HANDLER(
 
        SAVE_OPLINE();
        container = _get_zval_ptr_cv_undef(opline->op1.var EXECUTE_DATA_CC);
-       zend_fetch_dimension_address_read_LIST(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+       zend_fetch_dimension_address_LIST_r(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC) EXECUTE_DATA_CC);
+
+       ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_LIST_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       USE_OPLINE
+
+       zval *retval, *container, *dim;
+
+       SAVE_OPLINE();
+       retval = EX_VAR(opline->result.var);
+       container = _get_zval_ptr_cv_undef_BP_VAR_W(opline->op1.var EXECUTE_DATA_CC);
+       dim = _get_zval_ptr_cv_undef(opline->op2.var EXECUTE_DATA_CC);
+
+       if (IS_CV == IS_VAR
+               && Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT
+               && UNEXPECTED(!Z_ISREF_P(container))
+       ) {
+               zend_error(E_NOTICE, "Attempting to set reference to non referenceable value");
+               zend_fetch_dimension_address_LIST_r(retval, container, dim EXECUTE_DATA_CC);
+       } else {
+               zend_fetch_dimension_address_LIST_w(retval, container, dim EXECUTE_DATA_CC);
+       }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -56622,31 +56768,31 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        (void*)&&ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CONST_CONST_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CONST_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CONST_CV_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CONST_CV_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_CV_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_TMPVAR_CV_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CV_CONST_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CV_TMPVAR_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CV_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CV_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
-                       (void*)&&ZEND_FETCH_LIST_SPEC_CV_CV_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_R_SPEC_CV_CV_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
@@ -58247,6 +58393,31 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        (void*)&&ZEND_ISSET_ISEMPTY_CV_SPEC_CV_UNUSED_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_VAR_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_VAR_CV_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_CV_CONST_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
+                       (void*)&&ZEND_FETCH_LIST_W_SPEC_CV_CV_LABEL,
+                       (void*)&&ZEND_NULL_LABEL,
                        (void*)&&ZEND_ADD_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV_LABEL,
                        (void*)&&ZEND_ADD_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV_LABEL,
                        (void*)&&ZEND_NULL_LABEL,
@@ -59634,8 +59805,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_CONST):
                                ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CONST_CONST):
-                               ZEND_FETCH_LIST_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CONST_CONST):
+                               ZEND_FETCH_LIST_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_CONST_CONST):
                                ZEND_FAST_CONCAT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -59862,8 +60033,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_TMPVAR):
                                ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CONST_TMPVAR):
-                               ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR):
+                               ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR):
                                ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -60096,8 +60267,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_CV):
                                ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CONST_CV):
-                               ZEND_FETCH_LIST_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CONST_CV):
+                               ZEND_FETCH_LIST_R_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_CONST_CV):
                                ZEND_FAST_CONCAT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -60471,8 +60642,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_CONST):
                                ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_TMPVAR_CONST):
-                               ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST):
+                               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST):
                                ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -60573,8 +60744,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_TMPVAR):
                                ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR):
-                               ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR):
+                               ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR):
                                ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -60738,8 +60909,8 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_CV):
                                ZEND_FETCH_OBJ_IS_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_TMPVAR_CV):
-                               ZEND_FETCH_LIST_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV):
+                               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_FAST_CONCAT_SPEC_TMPVAR_CV):
                                ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -61173,6 +61344,9 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST):
                                ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_VAR_CONST):
+                               ZEND_FETCH_LIST_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
@@ -61371,6 +61545,9 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMPVAR):
                                ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR):
+                               ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_VAR_TMPVAR_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_VAR_TMPVAR_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
@@ -61680,6 +61857,9 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV):
                                ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_VAR_CV):
+                               ZEND_FETCH_LIST_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_VAR_CV_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_VAR_CV_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
@@ -62421,8 +62601,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST):
                                ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CV_CONST):
-                               ZEND_FETCH_LIST_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CV_CONST):
+                               ZEND_FETCH_LIST_R_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_CV_CONST):
+                               ZEND_FETCH_LIST_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_CV_CONST_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_CV_CONST_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -62721,8 +62904,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR):
                                ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CV_TMPVAR):
-                               ZEND_FETCH_LIST_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR):
+                               ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR):
+                               ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_CV_TMPVAR_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_CV_TMPVAR_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -63195,8 +63381,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
                        HYBRID_CASE(ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV):
                                ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
-                       HYBRID_CASE(ZEND_FETCH_LIST_SPEC_CV_CV):
-                               ZEND_FETCH_LIST_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                       HYBRID_CASE(ZEND_FETCH_LIST_R_SPEC_CV_CV):
+                               ZEND_FETCH_LIST_R_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+                               HYBRID_BREAK();
+                       HYBRID_CASE(ZEND_FETCH_LIST_W_SPEC_CV_CV):
+                               ZEND_FETCH_LIST_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
                                HYBRID_BREAK();
                        HYBRID_CASE(ZEND_ASSIGN_OBJ_SPEC_CV_CV_OP_DATA_CONST):
                                ZEND_ASSIGN_OBJ_SPEC_CV_CV_OP_DATA_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -65603,31 +65792,31 @@ void zend_init_opcodes_handlers(void)
                ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CONST_CONST_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CONST_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CONST_CONST_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CONST_TMPVAR_HANDLER,
                ZEND_NULL_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CONST_CV_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CONST_CV_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER,
                ZEND_NULL_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_CV_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_CONST_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CONST_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_TMPVAR_HANDLER,
                ZEND_NULL_HANDLER,
-               ZEND_FETCH_LIST_SPEC_TMPVAR_CV_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_TMPVAR_CV_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CV_CONST_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CV_TMPVAR_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CV_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CV_CONST_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CV_TMPVAR_HANDLER,
                ZEND_NULL_HANDLER,
-               ZEND_FETCH_LIST_SPEC_CV_CV_HANDLER,
+               ZEND_FETCH_LIST_R_SPEC_CV_CV_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
@@ -67228,6 +67417,31 @@ void zend_init_opcodes_handlers(void)
                ZEND_ISSET_ISEMPTY_CV_SPEC_CV_UNUSED_HANDLER,
                ZEND_NULL_HANDLER,
                ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_VAR_CONST_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_VAR_TMPVAR_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_VAR_CV_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_CV_CONST_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_CV_TMPVAR_HANDLER,
+               ZEND_NULL_HANDLER,
+               ZEND_FETCH_LIST_W_SPEC_CV_CV_HANDLER,
+               ZEND_NULL_HANDLER,
                ZEND_ADD_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV_HANDLER,
                ZEND_ADD_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV_HANDLER,
                ZEND_NULL_HANDLER,
@@ -68345,7 +68559,7 @@ void zend_init_opcodes_handlers(void)
                2257 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                2282 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                2307 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-               4921,
+               4946,
                2332,
                2333,
                2334,
@@ -68430,7 +68644,7 @@ void zend_init_opcodes_handlers(void)
                3531 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3556 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3581 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-               4921,
+               4946,
                3606 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3631 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3656 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
@@ -68443,7 +68657,8 @@ void zend_init_opcodes_handlers(void)
                3831 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3856 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
                3881 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-               4921
+               3906 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
+               4946
        };
 #if (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID)
        zend_opcode_handler_funcs = labels;
@@ -68638,7 +68853,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 3906 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 3931 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68646,7 +68861,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 3931 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 3956 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68654,7 +68869,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 3956 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 3981 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68665,17 +68880,17 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 3981 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4006 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                        } else if (op1_info == MAY_BE_LONG && op2_info == MAY_BE_LONG) {
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4006 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4031 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                        } else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4031 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4056 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                        }
                        break;
                case ZEND_MUL:
@@ -68683,7 +68898,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4056 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4081 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68691,7 +68906,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4081 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4106 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68699,7 +68914,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4106 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4131 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68710,7 +68925,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4131 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4156 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68718,7 +68933,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4206 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4231 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68729,7 +68944,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4281 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4306 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68737,7 +68952,7 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4356 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4381 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                                if (op->op1_type > op->op2_type) {
                                        zend_swap_operands(op);
                                }
@@ -68748,12 +68963,12 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4431 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4456 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                        } else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4506 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4531 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                        }
                        break;
                case ZEND_IS_SMALLER_OR_EQUAL:
@@ -68761,75 +68976,75 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4581 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4606 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                        } else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
                                if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
                                        break;
                                }
-                               spec = 4656 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+                               spec = 4681 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
                        }
                        break;
                case ZEND_QM_ASSIGN:
                        if (op1_info == MAY_BE_DOUBLE) {
-                               spec = 4821 | SPEC_RULE_OP1;
+                               spec = 4846 | SPEC_RULE_OP1;
                        } else if (!(op1_info & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE)))) {
-                               spec = 4826 | SPEC_RULE_OP1;
+                               spec = 4851 | SPEC_RULE_OP1;
                        }
                        break;
                case ZEND_PRE_INC:
                        if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-                               spec = 4731 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4756 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        } else if (op1_info == MAY_BE_LONG) {
-                               spec = 4741 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4766 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        } else if (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)) {
-                               spec = 4751 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4776 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        }
                        break;
                case ZEND_PRE_DEC:
                        if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-                               spec = 4761 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4786 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        } else if (op1_info == MAY_BE_LONG) {
-                               spec = 4771 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4796 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        } else if (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)) {
-                               spec = 4781 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
+                               spec = 4806 | SPEC_RULE_OP1 | SPEC_RULE_RETVAL;
                        }
                        break;
                case ZEND_POST_INC:
                        if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-                               spec = 4791 | SPEC_RULE_OP1;
+                               spec = 4816 | SPEC_RULE_OP1;
                        } else if (op1_info == MAY_BE_LONG) {
-                               spec = 4796 | SPEC_RULE_OP1;
+                               spec = 4821 | SPEC_RULE_OP1;
                        } else if (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)) {
-                               spec = 4801 | SPEC_RULE_OP1;
+                               spec = 4826 | SPEC_RULE_OP1;
                        }
                        break;
                case ZEND_POST_DEC:
                        if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-                               spec = 4806 | SPEC_RULE_OP1;
+                               spec = 4831 | SPEC_RULE_OP1;
                        } else if (op1_info == MAY_BE_LONG) {
-                               spec = 4811 | SPEC_RULE_OP1;
+                               spec = 4836 | SPEC_RULE_OP1;
                        } else if (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)) {
-                               spec = 4816 | SPEC_RULE_OP1;
+                               spec = 4841 | SPEC_RULE_OP1;
                        }
                        break;
                case ZEND_SEND_VAR_EX:
                        if ((op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
-                               spec = 4861 | SPEC_RULE_OP1 | SPEC_RULE_QUICK_ARG;
+                               spec = 4886 | SPEC_RULE_OP1 | SPEC_RULE_QUICK_ARG;
                        }
                        break;
                case ZEND_FE_FETCH_R:
                        if (op->op2_type == IS_CV && (op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY) {
-                               spec = 4871 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_RETVAL;
+                               spec = 4896 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_RETVAL;
                        }
                        break;
                case ZEND_FETCH_DIM_R:
                        if (!(op2_info & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
-                               spec = 4831 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+                               spec = 4856 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
                        }
                        break;
                case ZEND_SEND_VAR:
                        if ((op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
-                               spec = 4856 | SPEC_RULE_OP1;
+                               spec = 4881 | SPEC_RULE_OP1;
                        }
                        break;
                default:

diff --git a/Zend/zend_vm_opcodes.c b/Zend/zend_vm_opcodes.c
index ea3f892baa19b0f3f1ba50c5ac61100a5ff3c345..b52a6eea1f7e5762b8d6a210f4f21bc4d1f9ec6e 100644 (file)
--- a/Zend/zend_vm_opcodes.c
+++ b/Zend/zend_vm_opcodes.c
@@ -21,7 +21,7 @@
 #include <stdio.h>
 #include <zend.h>
 
-static const char *zend_vm_opcodes_names[198] = {
+static const char *zend_vm_opcodes_names[199] = {
        "ZEND_NOP",
        "ZEND_ADD",
        "ZEND_SUB",
@@ -120,7 +120,7 @@ static const char *zend_vm_opcodes_names[198] = {
        "ZEND_FETCH_UNSET",
        "ZEND_FETCH_DIM_UNSET",
        "ZEND_FETCH_OBJ_UNSET",
-       "ZEND_FETCH_LIST",
+       "ZEND_FETCH_LIST_R",
        "ZEND_FETCH_CONSTANT",
        NULL,
        "ZEND_EXT_STMT",
@@ -220,9 +220,10 @@ static const char *zend_vm_opcodes_names[198] = {
        "ZEND_FUNC_GET_ARGS",
        "ZEND_UNSET_CV",
        "ZEND_ISSET_ISEMPTY_CV",
+       "ZEND_FETCH_LIST_W",
 };
 
-static uint32_t zend_vm_opcodes_flags[198] = {
+static uint32_t zend_vm_opcodes_flags[199] = {
        0x00000000,
        0x00000707,
        0x00000707,
@@ -421,6 +422,7 @@ static uint32_t zend_vm_opcodes_flags[198] = {
        0x00000103,
        0x00000101,
        0x00020101,
+       0x00000701,
 };
 
 ZEND_API const char* zend_get_opcode_name(zend_uchar opcode) {

diff --git a/Zend/zend_vm_opcodes.h b/Zend/zend_vm_opcodes.h
index f17b40a0ffd49fbc5f8a754473d8a2178fb93237..7956d5fee483c42d673f91c14ad9c3efa401d3fc 100644 (file)
--- a/Zend/zend_vm_opcodes.h
+++ b/Zend/zend_vm_opcodes.h
@@ -172,7 +172,7 @@ END_EXTERN_C()
 #define ZEND_FETCH_UNSET                      95
 #define ZEND_FETCH_DIM_UNSET                  96
 #define ZEND_FETCH_OBJ_UNSET                  97
-#define ZEND_FETCH_LIST                       98
+#define ZEND_FETCH_LIST_R                     98
 #define ZEND_FETCH_CONSTANT                   99
 #define ZEND_EXT_STMT                        101
 #define ZEND_EXT_FCALL_BEGIN                 102
@@ -270,7 +270,8 @@ END_EXTERN_C()
 #define ZEND_FUNC_GET_ARGS                   195
 #define ZEND_UNSET_CV                        196
 #define ZEND_ISSET_ISEMPTY_CV                197
+#define ZEND_FETCH_LIST_W                    198
 
-#define ZEND_VM_LAST_OPCODE                  197
+#define ZEND_VM_LAST_OPCODE                  198
 
 #endif

diff --git a/ext/opcache/Optimizer/block_pass.c b/ext/opcache/Optimizer/block_pass.c
index fcd20c86fe1048524252ad3e6b01eb038c7b3f73..78b5176dd780103267c0a48625e885b175760b37 100644 (file)
--- a/ext/opcache/Optimizer/block_pass.c
+++ b/ext/opcache/Optimizer/block_pass.c
@@ -410,7 +410,8 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
                }
 #endif
 
-                       case ZEND_FETCH_LIST:
+                       case ZEND_FETCH_LIST_R:
+                       case ZEND_FETCH_LIST_W:
                                if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
                                        /* LIST variable will be deleted later by FREE */
                                        Tsource[VAR_NUM(opline->op1.var)] = NULL;

diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
index b778286b7ce41d2d3ae99ef760f8190b18550b43..aa1550f5fbe01315c17f971af0042cacec0dbdfc 100644 (file)
--- a/ext/opcache/Optimizer/sccp.c
+++ b/ext/opcache/Optimizer/sccp.c
@@ -220,6 +220,7 @@ static zend_bool can_replace_op1(
                case ZEND_FETCH_OBJ_RW:
                case ZEND_FETCH_OBJ_UNSET:
                case ZEND_FETCH_OBJ_FUNC_ARG:
+               case ZEND_FETCH_LIST_W:
                case ZEND_UNSET_DIM:
                case ZEND_UNSET_OBJ:
                case ZEND_SEND_REF:
@@ -286,7 +287,7 @@ static zend_bool try_replace_op1(
                } else {
                        // TODO: check the following special cases ???
                        switch (opline->opcode) {
-                               case ZEND_FETCH_LIST:
+                               case ZEND_FETCH_LIST_R:
                                case ZEND_CASE:
                                case ZEND_SWITCH_STRING:
                                case ZEND_SWITCH_LONG:
@@ -1521,11 +1522,11 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
                        break;
                case ZEND_FETCH_DIM_R:
                case ZEND_FETCH_DIM_IS:
-               case ZEND_FETCH_LIST:
+               case ZEND_FETCH_LIST_R:
                        SKIP_IF_TOP(op1);
                        SKIP_IF_TOP(op2);
 
-                       if (ct_eval_fetch_dim(&zv, op1, op2, (opline->opcode != ZEND_FETCH_LIST)) == SUCCESS) {
+                       if (ct_eval_fetch_dim(&zv, op1, op2, (opline->opcode != ZEND_FETCH_LIST_R)) == SUCCESS) {
                                SET_RESULT(result, &zv);
                                zval_ptr_dtor_nogc(&zv);
                                break;

diff --git a/ext/opcache/Optimizer/zend_dfg.c b/ext/opcache/Optimizer/zend_dfg.c
index 49be85c6b87af5e28fb9e86324416bc8f4b7d0b3..2ac060ba7e4b44e2e7ac9648ef36b42cdbbbc78d 100644 (file)
--- a/ext/opcache/Optimizer/zend_dfg.c
+++ b/ext/opcache/Optimizer/zend_dfg.c
@@ -127,6 +127,7 @@ int zend_build_dfg(const zend_op_array *op_array, const zend_cfg *cfg, zend_dfg
                                        case ZEND_FETCH_OBJ_RW:
                                        case ZEND_FETCH_OBJ_FUNC_ARG:
                                        case ZEND_FETCH_OBJ_UNSET:
+                                       case ZEND_FETCH_LIST_W:
                                        case ZEND_VERIFY_RETURN_TYPE:
                                        case ZEND_PRE_INC_OBJ:
                                        case ZEND_PRE_DEC_OBJ:

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index d096e1aa2328004c67fc457067f060e853d3812f..02ac1e14d8b058cb17c72478efc39ce85be97db2 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2994,12 +2994,14 @@ static int zend_update_type_info(const zend_op_array *op_array,
                case ZEND_FETCH_DIM_W:
                case ZEND_FETCH_DIM_UNSET:
                case ZEND_FETCH_DIM_FUNC_ARG:
-               case ZEND_FETCH_LIST:
+               case ZEND_FETCH_LIST_R:
+               case ZEND_FETCH_LIST_W:
                        if (ssa_ops[i].op1_def >= 0) {
                                tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN);
                                if (opline->opcode == ZEND_FETCH_DIM_W ||
                                    opline->opcode == ZEND_FETCH_DIM_RW ||
-                                   opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) {
+                                   opline->opcode == ZEND_FETCH_DIM_FUNC_ARG ||
+                    opline->opcode == ZEND_FETCH_LIST_W) {
                                        if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
                                                if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
                                                        tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
@@ -3046,6 +3048,7 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                                case ZEND_FETCH_DIM_W:
                                                case ZEND_FETCH_DIM_RW:
                                                case ZEND_FETCH_DIM_FUNC_ARG:
+                                               case ZEND_FETCH_LIST_W:
                                                case ZEND_ASSIGN_ADD:
                                                case ZEND_ASSIGN_SUB:
                                                case ZEND_ASSIGN_MUL:
@@ -3116,13 +3119,14 @@ static int zend_update_type_info(const zend_op_array *op_array,
                        }
                        /* FETCH_LIST on a string behaves like FETCH_R on null */
                        tmp = zend_array_element_type(
-                               opline->opcode != ZEND_FETCH_LIST ? t1 : ((t1 & ~MAY_BE_STRING) | MAY_BE_NULL),
+                               opline->opcode != ZEND_FETCH_LIST_R ? t1 : ((t1 & ~MAY_BE_STRING) | MAY_BE_NULL),
                                opline->opcode != ZEND_FETCH_DIM_R && opline->opcode != ZEND_FETCH_DIM_IS
-                                       && opline->opcode != ZEND_FETCH_LIST,
+                                       && opline->opcode != ZEND_FETCH_LIST_R,
                                opline->op2_type == IS_UNUSED);
                        if (opline->opcode == ZEND_FETCH_DIM_W ||
                            opline->opcode == ZEND_FETCH_DIM_RW ||
-                           opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) {
+                           opline->opcode == ZEND_FETCH_DIM_FUNC_ARG ||
+                           opline->opcode == ZEND_FETCH_LIST_W) {
                                if (t1 & (MAY_BE_ERROR|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE|MAY_BE_OBJECT)) {
                                        tmp |= MAY_BE_ERROR;
                                } else if (opline->op2_type == IS_UNUSED) {
@@ -3258,6 +3262,13 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                }
                        }
                        break;
+               case ZEND_MAKE_REF:
+                       tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
+                       UPDATE_SSA_TYPE(tmp, ssa_ops[i].result_def);
+                       if (ssa_ops[i].op1_def >= 0) {
+                               UPDATE_SSA_TYPE(tmp, ssa_ops[i].op1_def);
+                       }
+                       break;
                case ZEND_CATCH:
                case ZEND_INCLUDE_OR_EVAL:
                        /* Forbidden opcodes */
@@ -4007,7 +4018,7 @@ int zend_may_throw(const zend_op *opline, zend_op_array *op_array, zend_ssa *ssa
                                case ZEND_CASE:
                                case ZEND_FE_FETCH_R:
                                case ZEND_FE_FETCH_RW:
-                               case ZEND_FETCH_LIST:
+                               case ZEND_FETCH_LIST_R:
                                case ZEND_QM_ASSIGN:
                                case ZEND_SEND_VAL:
                                case ZEND_SEND_VAL_EX:

diff --git a/ext/opcache/Optimizer/zend_optimizer.c b/ext/opcache/Optimizer/zend_optimizer.c
index 1e5b4a2a7358d908b4a6e1c1a21a5859638c43a2..f63c2c038391e0385e04fe043689bbd12ee53554 100644 (file)
--- a/ext/opcache/Optimizer/zend_optimizer.c
+++ b/ext/opcache/Optimizer/zend_optimizer.c
@@ -269,6 +269,7 @@ int zend_optimizer_update_op1_const(zend_op_array *op_array,
                case ZEND_FETCH_DIM_RW:
                case ZEND_FETCH_DIM_FUNC_ARG:
                case ZEND_FETCH_DIM_UNSET:
+               case ZEND_FETCH_LIST_W:
                case ZEND_ASSIGN_DIM:
                case ZEND_RETURN_BY_REF:
                        return 0;
@@ -307,7 +308,7 @@ int zend_optimizer_update_op1_const(zend_op_array *op_array,
                         * zend_optimizer_replace_by_const() supports this. */
                        return 0;
                case ZEND_CASE:
-               case ZEND_FETCH_LIST:
+               case ZEND_FETCH_LIST_R:
                        return 0;
                case ZEND_CONCAT:
                case ZEND_FAST_CONCAT:
@@ -450,7 +451,8 @@ int zend_optimizer_update_op2_const(zend_op_array *op_array,
                case ZEND_FETCH_DIM_IS:
                case ZEND_FETCH_DIM_FUNC_ARG:
                case ZEND_FETCH_DIM_UNSET:
-               case ZEND_FETCH_LIST:
+               case ZEND_FETCH_LIST_R:
+               case ZEND_FETCH_LIST_W:
                        if (Z_TYPE_P(val) == IS_STRING) {
                                zend_ulong index;
                                if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
@@ -571,6 +573,7 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
                                case ZEND_FETCH_DIM_RW:
                                case ZEND_FETCH_DIM_FUNC_ARG:
                                case ZEND_FETCH_DIM_UNSET:
+                               case ZEND_FETCH_LIST_W:
                                case ZEND_ASSIGN_DIM:
                                case ZEND_SEPARATE:
                                case ZEND_RETURN_BY_REF:
@@ -593,15 +596,15 @@ int zend_optimizer_replace_by_const(zend_op_array *op_array,
                                        break;
                                /* In most cases IS_TMP_VAR operand may be used only once.
                                 * The operands are usually destroyed by the opcode handler.
-                                * ZEND_CASE and ZEND_FETCH_LIST are exceptions, they keeps operand
+                                * ZEND_CASE and ZEND_FETCH_LIST_R are exceptions, they keeps operand
                                 * unchanged, and allows its reuse. these instructions
                                 * usually terminated by ZEND_FREE that finally kills the value.
                                 */
-                               case ZEND_FETCH_LIST: {
+                               case ZEND_FETCH_LIST_R: {
                                        zend_op *m = opline;
 
                                        do {
-                                               if (m->opcode == ZEND_FETCH_LIST &&
+                                               if (m->opcode == ZEND_FETCH_LIST_R &&
                                                        m->op1_type == type &&
                                                        m->op1.var == var) {
                                                        zval v;

diff --git a/ext/opcache/Optimizer/zend_ssa.c b/ext/opcache/Optimizer/zend_ssa.c
index 6dfb13886ee7ba1df11dec554812e8f7940b6029..2bb4f6452f2a3e23f5781acd291226e370a2a1a3 100644 (file)
--- a/ext/opcache/Optimizer/zend_ssa.c
+++ b/ext/opcache/Optimizer/zend_ssa.c
@@ -683,7 +683,7 @@ static int zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags,
                                case ZEND_SEND_REF:
                                case ZEND_SEND_UNPACK:
                                case ZEND_FE_RESET_RW:
-//TODO: ???
+                               case ZEND_MAKE_REF:
                                        if (opline->op1_type == IS_CV) {
                                                ssa_ops[k].op1_def = ssa_vars_count;
                                                var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
@@ -737,6 +737,7 @@ static int zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags,
                                case ZEND_FETCH_OBJ_RW:
                                case ZEND_FETCH_OBJ_FUNC_ARG:
                                case ZEND_FETCH_OBJ_UNSET:
+                               case ZEND_FETCH_LIST_W:
                                        if (opline->op1_type == IS_CV) {
                                                ssa_ops[k].op1_def = ssa_vars_count;
                                                var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;