Fixed bug #70089 (segfault at ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER ())

diff --git a/NEWS b/NEWS
index 940f6e35ab3c4ae654210c83760002a78e82f3b3..b4c48db7222d371e84591ff2564d3581a91d6f5c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@
 23 Jul 2015, PHP 7.0.0 Beta 2
 
 - Core:
+  . Fixed bug #70089 (segfault at ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER ()).
+    (Laruence)
   . Fixed bug #70057 (Build failure on 32-bit Mac OS X 10.6.8: recursive
     inlining). (Laruence)
   . Fixed bug #70012 (Exception lost with nested finally block). (Laruence)

diff --git a/Zend/tests/bug70089.phpt b/Zend/tests/bug70089.phpt
new file mode 100644 (file)
index 0000000..260975f
--- /dev/null
+++ b/Zend/tests/bug70089.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #70089 (segfault in PHP 7 at ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER ())
+--FILE--
+<?php
+function dummy($a) {
+}
+
+try {
+       chr(0)[0][] = 1;
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+try {
+       unset(chr(0)[0][0]);
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+eval("function runtimetest(&\$a) {} ");
+try {
+       runtimetest(chr(0)[0]);
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+
+try {
+       ++chr(0)[0];
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+?>
+--EXPECTF--
+string(36) "Cannot use string offset as an array"
+string(27) "Cannot unset string offsets"
+string(41) "Only variables can be passed by reference"
+string(64) "Cannot increment/decrement overloaded objects nor string offsets"

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 27841eb119087c5ff4edb6dcb5006f06c45353ff..2d1bd5e3d0875dff86e63a8083775049aadf4f9a 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -91,12 +91,14 @@ static const zend_internal_function zend_pass_function = {
 #define READY_TO_DESTROY(zv) \
        (zv && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1)
 
-#define EXTRACT_ZVAL_PTR(zv) do {                                              \
-               zval *__zv = (zv);                                                              \
-               if (Z_TYPE_P(__zv) == IS_INDIRECT) {                    \
-                       ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));            \
-               }                                                                                               \
-       } while (0)
+#define EXTRACT_ZVAL_PTR(zv, check_null) do {          \
+       zval *__zv = (zv);                                                              \
+       if (Z_TYPE_P(__zv) == IS_INDIRECT) {                    \
+               if (!(check_null) || Z_INDIRECT_P(__zv)) {      \
+                       ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));    \
+               }                                                                                       \
+       }                                                                                               \
+} while (0)
 
 #define FREE_OP(should_free) \
        if (should_free) { \

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 7d74e8378f478033d5063a51b3828d80d467f772..bbeb2fa158f20a507c481acc708c01cae5f9fff2 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1657,7 +1657,7 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMPVAR|UNUSED|CV)
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR(BP_VAR_R), OP2_TYPE);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -1679,7 +1679,7 @@ ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMPVAR|UNUSED|CV)
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR(BP_VAR_R), OP2_TYPE);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -1722,7 +1722,7 @@ ZEND_VM_HANDLER(93, ZEND_FETCH_DIM_FUNC_ARG, CONST|TMP|VAR|CV, CONST|TMPVAR|UNUS
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR(BP_VAR_R), OP2_TYPE);
                if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
                FREE_OP2();
                FREE_OP1_VAR_PTR();
@@ -1758,7 +1758,7 @@ ZEND_VM_HANDLER(96, ZEND_FETCH_DIM_UNSET, VAR|CV, CONST|TMPVAR|CV)
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, GET_OP2_ZVAL_PTR(BP_VAR_R), OP2_TYPE);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -1862,7 +1862,7 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMPVAR|CV)
        zend_fetch_property_address(EX_VAR(opline->result.var), container, OP1_TYPE, property, OP2_TYPE, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -1892,7 +1892,7 @@ ZEND_VM_HANDLER(88, ZEND_FETCH_OBJ_RW, VAR|UNUSED|CV, CONST|TMPVAR|CV)
        zend_fetch_property_address(EX_VAR(opline->result.var), container, OP1_TYPE, property, OP2_TYPE, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2004,7 +2004,7 @@ ZEND_VM_HANDLER(94, ZEND_FETCH_OBJ_FUNC_ARG, CONST|TMP|VAR|UNUSED|CV, CONST|TMPV
                zend_fetch_property_address(EX_VAR(opline->result.var), container, OP1_TYPE, property, OP2_TYPE, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                FREE_OP2();
                if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
                FREE_OP1_VAR_PTR();
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2038,7 +2038,7 @@ ZEND_VM_HANDLER(97, ZEND_FETCH_OBJ_UNSET, VAR|UNUSED|CV, CONST|TMPVAR|CV)
        zend_fetch_property_address(EX_VAR(opline->result.var), container, OP1_TYPE, property, OP2_TYPE, ((OP2_TYPE == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
        FREE_OP2();
        if (OP1_TYPE == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 8dba75dec573fe2cfee8a38a6bb7d64b1dc9f4dc..0259a3c8fae712dde1ebaf2238747117685c64e3 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5133,7 +5133,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CONST_
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -5329,7 +5329,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CONST, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -7559,7 +7559,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CONST_
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -8913,7 +8913,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CONST_
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -9109,7 +9109,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CONST, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -10714,7 +10714,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CONST_
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
                zval_ptr_dtor_nogc(free_op2);
 
@@ -10912,7 +10912,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CONST_
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CONST, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                zval_ptr_dtor_nogc(free_op2);
                if (IS_CONST == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -12608,7 +12608,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_CO
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -12732,7 +12732,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_TMP_CO
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_TMP_VAR, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -13487,7 +13487,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_UN
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -13890,7 +13890,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_CV
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -14014,7 +14014,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_TMP_CV
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_TMP_VAR, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -14403,7 +14403,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_TMP_TM
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
                zval_ptr_dtor_nogc(free_op2);
 
@@ -14528,7 +14528,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_TMP_TM
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_TMP_VAR, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                zval_ptr_dtor_nogc(free_op2);
                if (IS_TMP_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -16975,7 +16975,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HAN
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -16997,7 +16997,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HA
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17026,7 +17026,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CO
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
@@ -17062,7 +17062,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17165,7 +17165,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HAN
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17195,7 +17195,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17234,7 +17234,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CO
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -17268,7 +17268,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -18886,7 +18886,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HA
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -18908,7 +18908,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_H
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -18937,7 +18937,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UN
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
@@ -20136,7 +20136,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLE
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20158,7 +20158,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDL
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20187,7 +20187,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
@@ -20223,7 +20223,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HA
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20326,7 +20326,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLE
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20356,7 +20356,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDL
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20395,7 +20395,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -20429,7 +20429,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -21775,7 +21775,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_TMPVAR_HA
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -21797,7 +21797,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_VAR_TMPVAR_H
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -21826,7 +21826,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TM
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
                zval_ptr_dtor_nogc(free_op2);
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
@@ -21862,7 +21862,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMPVA
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -21966,7 +21966,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_TMPVAR_HA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -21996,7 +21996,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_VAR_TMPVAR_H
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -22035,7 +22035,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TM
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                zval_ptr_dtor_nogc(free_op2);
                if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
                if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -22069,7 +22069,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMPVA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_VAR, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_VAR == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
        if (free_op1) {zval_ptr_dtor_nogc(free_op1);};
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -23339,7 +23339,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -23369,7 +23369,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -23480,7 +23480,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -23514,7 +23514,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CO
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -25706,7 +25706,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HAN
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -25736,7 +25736,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -25847,7 +25847,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -25881,7 +25881,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -27177,7 +27177,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMPVAR
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -27207,7 +27207,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMPVA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -27319,7 +27319,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                zval_ptr_dtor_nogc(free_op2);
                if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -27353,7 +27353,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TM
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_UNUSED, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_UNUSED == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -30983,7 +30983,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_CONST_HAND
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31005,7 +31005,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HAN
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31048,7 +31048,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CON
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -31084,7 +31084,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, EX_CONSTANT(opline->op2), IS_CONST);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31187,7 +31187,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HAND
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31217,7 +31217,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HAN
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31328,7 +31328,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CON
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -31362,7 +31362,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CONST, ((IS_CONST == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -34137,7 +34137,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HAN
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -34159,7 +34159,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HA
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -34188,7 +34188,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNU
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, NULL, IS_UNUSED);
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -36020,7 +36020,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36042,7 +36042,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLE
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36085,7 +36085,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
 
 
@@ -36121,7 +36121,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HAN
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var), IS_CV);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36224,7 +36224,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36254,7 +36254,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLE
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36365,7 +36365,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
 
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -36399,7 +36399,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HAN
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, IS_CV, ((IS_CV == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
 
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -38661,7 +38661,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_TMPVAR_HAN
        zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -38683,7 +38683,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_RW_SPEC_CV_TMPVAR_HA
        zend_fetch_dimension_address_RW(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -38726,7 +38726,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP
                }
                zend_fetch_dimension_address_W(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
                }
                zval_ptr_dtor_nogc(free_op2);
 
@@ -38762,7 +38762,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_UNSET_SPEC_CV_TMPVAR
        zend_fetch_dimension_address_UNSET(EX_VAR(opline->result.var), container, _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2), (IS_TMP_VAR|IS_VAR));
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 1);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -38866,7 +38866,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_TMPVAR_HAN
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -38896,7 +38896,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_RW_SPEC_CV_TMPVAR_HA
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_RW);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -39008,7 +39008,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP
                zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_W);
                zval_ptr_dtor_nogc(free_op2);
                if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+                       EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
                }
 
                ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -39042,7 +39042,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMPVAR
        zend_fetch_property_address(EX_VAR(opline->result.var), container, IS_CV, property, (IS_TMP_VAR|IS_VAR), (((IS_TMP_VAR|IS_VAR) == IS_CONST) ? CACHE_ADDR(Z_CACHE_SLOT_P(property)) : NULL), BP_VAR_UNSET);
        zval_ptr_dtor_nogc(free_op2);
        if (IS_CV == IS_VAR && READY_TO_DESTROY(free_op1)) {
-               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var));
+               EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var), 0);
        }
 
        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();