Merge branch 'PHP-7.3'

* PHP-7.3:
  Fixed bug #77263 (Segfault when using 2 RecursiveFilterIterator)

diff --cc Zend/zend_vm_def.h
index 22844ccc621467e510b4878f77515378194508d0,5071be0fb17bea5939246d361fa34a32514e8993..d94fe6843542dcd10ec7cb8a9893012e194812f1
--- 1/Zend/zend_vm_def.h
--- 2/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@@ -3522,7 -3099,11 +3522,11 @@@ ZEND_VM_HOT_OBJ_HANDLER(112, ZEND_INIT_
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((OP1_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }

diff --cc Zend/zend_vm_execute.h
index d24636c0f8117a52ce6a058b4b3b8ea70fc07ba1,2ed807f1ac5e9d29e561a5eeadc037571a7d0b1c..c298f5a0689397bb6a368bef36983e4f0e4866af
--- 1/Zend/zend_vm_execute.h
--- 2/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@@ -5465,7 -5148,11 +5465,11 @@@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -7748,7 -7329,11 +7752,11 @@@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -11419,7 -10429,11 +11427,11 @@@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -15419,7 -14161,11 +15431,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -16990,7 -15775,11 +17006,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -19303,7 -17656,11 +19323,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -36467,7 -32105,11 +36491,11 @@@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -38513,7 -33840,11 +38541,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -41204,7 -36219,11 +41236,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -47186,7 -41244,11 +47222,11 @@@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -51430,7 -45011,11 +51470,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }
@@@ -58357,7 -50813,11 +58401,11 @@@ static ZEND_OPCODE_HANDLER_RET ZEND_FAS
                    EXPECTED(obj == orig_obj)) {
                        CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
                }
 -              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
+               if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+                       /* Reset "object" to trigger reference counting */
+                       object = NULL;
+               }
 +              if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
                        init_func_run_time_cache(&fbc->op_array);
                }
        }