Fixed bug #33318 (throw 1; results in Invalid opcode 108/1/8)

diff --git a/NEWS b/NEWS
index 9faa8dca992b51ecc9e1bb5913eafa4d7ec13fa4..934104396251029e29e269ff83760381056293c3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PHP                                                                        NEWS
 - Fixed PECL bug #3714 (beginTransaction doesn't work if you're in
   auto-commit mode). (Wez)
 - Fixed bug #33340 (CLI Crash when calling php:function from XSLT). (Rob)
+- Fixed bug #33318 (throw 1; results in Invalid opcode 108/1/8). (Dmitry)
 - Fixed bug #33312 (ReflectionParameter methods do not work correctly).
   (Dmitry)
 - Fixed bug #33212 ([GCC 4]: 'zend_error_noreturn' aliased to external symbol

diff --git a/Zend/tests/bug33318.phpt b/Zend/tests/bug33318.phpt
new file mode 100755 (executable)
index 0000000..dc1afbb
--- /dev/null
+++ b/Zend/tests/bug33318.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #33318 (throw 1; results in Invalid opcode 108/1/8)
+--FILE--
+<?php
+throw 1;
+?>
+--EXPECTF--
+Fatal error: Can only throw objects in %sbug33318.php on line 2
\ No newline at end of file

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 09434f88e74eee764a797013d25b73af3442a450..419098a6a354913d1ca6cfce8f29d552dc2523cb 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1734,9 +1734,6 @@ ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST|TMP|VAR|CV)
        zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(calling_scope));
 
        if (OP2_TYPE == IS_CONST) {
-#ifndef ZEND_VM_SPEC
-               free_op2.var = NULL;
-#endif
                function_name_strval = opline->op2.u.constant.value.str.val;
                function_name_strlen = opline->op2.u.constant.value.str.len;
        } else {
@@ -1756,7 +1753,9 @@ ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST|TMP|VAR|CV)
        }
 
        efree(lcname);
-       FREE_OP2();
+       if (OP2_TYPE != IS_CONST) {
+               FREE_OP2();
+       }
 
        EX(calling_scope) = function->common.scope;
        EX(object) = NULL;
@@ -2045,7 +2044,7 @@ ZEND_VM_C_LABEL(return_by_value):
        ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
 }
 
-ZEND_VM_HANDLER(108, ZEND_THROW, VAR|CV, ANY)
+ZEND_VM_HANDLER(108, ZEND_THROW, CONST|TMP|VAR|CV, ANY)
 {
        zend_op *opline = EX(opline);
        zval *value;
@@ -3380,13 +3379,11 @@ ZEND_VM_HANDLER(148, ZEND_ISSET_ISEMPTY_PROP_OBJ, VAR|UNUSED|CV, CONST|TMP|VAR|C
 
 ZEND_VM_HANDLER(79, ZEND_EXIT, CONST|TMP|VAR|UNUSED|CV, ANY)
 {
-       zend_op *opline = EX(opline);
-
        if (OP1_TYPE != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                zend_free_op free_op1;
+               zval *ptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
 
-               ptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 89053d3dac20e31541cde681a7be3664ee337dbc..d91900a6f0e69c0b7bf8856318d075ce7b85adf5 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -659,14 +659,11 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_function *function;
        char *function_name_strval, *lcname;
        int function_name_strlen;
-       zend_free_op free_op2;
+       
 
        zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(calling_scope));
 
        if (IS_CONST == IS_CONST) {
-#if 0
-               free_op2.var = NULL;
-#endif
                function_name_strval = opline->op2.u.constant.value.str.val;
                function_name_strlen = opline->op2.u.constant.value.str.len;
        } else {
@@ -686,6 +683,9 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        efree(lcname);
+       if (IS_CONST != IS_CONST) {
+
+       }
 
        EX(calling_scope) = function->common.scope;
        EX(object) = NULL;
@@ -861,9 +861,6 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(calling_scope));
 
        if (IS_TMP_VAR == IS_CONST) {
-#if 0
-               free_op2.var = NULL;
-#endif
                function_name_strval = opline->op2.u.constant.value.str.val;
                function_name_strlen = opline->op2.u.constant.value.str.len;
        } else {
@@ -883,7 +880,9 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        efree(lcname);
-       zval_dtor(free_op2.var);
+       if (IS_TMP_VAR != IS_CONST) {
+               zval_dtor(free_op2.var);
+       }
 
        EX(calling_scope) = function->common.scope;
        EX(object) = NULL;
@@ -1016,9 +1015,6 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(calling_scope));
 
        if (IS_VAR == IS_CONST) {
-#if 0
-               free_op2.var = NULL;
-#endif
                function_name_strval = opline->op2.u.constant.value.str.val;
                function_name_strlen = opline->op2.u.constant.value.str.len;
        } else {
@@ -1038,7 +1034,9 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        efree(lcname);
-       if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
+       if (IS_VAR != IS_CONST) {
+               if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
+       }
 
        EX(calling_scope) = function->common.scope;
        EX(object) = NULL;
@@ -1248,14 +1246,11 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_function *function;
        char *function_name_strval, *lcname;
        int function_name_strlen;
-       zend_free_op free_op2;
+       
 
        zend_ptr_stack_3_push(&EG(arg_types_stack), EX(fbc), EX(object), EX(calling_scope));
 
        if (IS_CV == IS_CONST) {
-#if 0
-               free_op2.var = NULL;
-#endif
                function_name_strval = opline->op2.u.constant.value.str.val;
                function_name_strlen = opline->op2.u.constant.value.str.len;
        } else {
@@ -1275,6 +1270,9 @@ static int ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        efree(lcname);
+       if (IS_CV != IS_CONST) {
+
+       }
 
        EX(calling_scope) = function->common.scope;
        EX(object) = NULL;
@@ -1665,6 +1663,30 @@ return_by_value:
        ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
 }
 
+static int ZEND_THROW_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       zend_op *opline = EX(opline);
+       zval *value;
+       zval *exception;
+       
+
+       value = &opline->op1.u.constant;
+
+       if (value->type != IS_OBJECT) {
+               zend_error_noreturn(E_ERROR, "Can only throw objects");
+       }
+       /* Not sure if a complete copy is what we want here */
+       ALLOC_ZVAL(exception);
+       INIT_PZVAL_COPY(exception, value);
+       if (!0) {
+               zval_copy_ctor(exception);
+       }
+
+       zend_throw_exception_object(exception TSRMLS_CC);
+
+       ZEND_VM_NEXT_OPCODE();
+}
+
 static int ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        zend_op *opline = EX(opline);
@@ -2140,13 +2162,11 @@ static int ZEND_ISSET_ISEMPTY_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 static int ZEND_EXIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
-       zend_op *opline = EX(opline);
-
        if (IS_CONST != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                
+               zval *ptr = &opline->op1.u.constant;
 
-               ptr = &opline->op1.u.constant;
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {
@@ -4042,6 +4062,30 @@ return_by_value:
        ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
 }
 
+static int ZEND_THROW_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+       zend_op *opline = EX(opline);
+       zval *value;
+       zval *exception;
+       zend_free_op free_op1;
+
+       value = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
+
+       if (value->type != IS_OBJECT) {
+               zend_error_noreturn(E_ERROR, "Can only throw objects");
+       }
+       /* Not sure if a complete copy is what we want here */
+       ALLOC_ZVAL(exception);
+       INIT_PZVAL_COPY(exception, value);
+       if (!1) {
+               zval_copy_ctor(exception);
+       }
+
+       zend_throw_exception_object(exception TSRMLS_CC);
+
+       ZEND_VM_NEXT_OPCODE();
+}
+
 static int ZEND_SEND_VAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        zend_op *opline = EX(opline);
@@ -4525,13 +4569,11 @@ static int ZEND_ISSET_ISEMPTY_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 static int ZEND_EXIT_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
-       zend_op *opline = EX(opline);
-
        if (IS_TMP_VAR != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                zend_free_op free_op1;
+               zval *ptr = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
 
-               ptr = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {
@@ -7676,13 +7718,11 @@ static int ZEND_ISSET_ISEMPTY_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 static int ZEND_EXIT_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
-       zend_op *opline = EX(opline);
-
        if (IS_VAR != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                zend_free_op free_op1;
+               zval *ptr = _get_zval_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
 
-               ptr = _get_zval_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {
@@ -13891,13 +13931,11 @@ static int ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 static int ZEND_EXIT_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
-       zend_op *opline = EX(opline);
-
        if (IS_UNUSED != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                
+               zval *ptr = NULL;
 
-               ptr = NULL;
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {
@@ -19544,13 +19582,11 @@ static int ZEND_ISSET_ISEMPTY_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 static int ZEND_EXIT_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
-       zend_op *opline = EX(opline);
-
        if (IS_CV != IS_UNUSED) {
-               zval *ptr;
+               zend_op *opline = EX(opline);
                
+               zval *ptr = _get_zval_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-               ptr = _get_zval_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC);
                if (Z_TYPE_P(ptr) == IS_LONG) {
                        EG(exit_status) = Z_LVAL_P(ptr);
                } else {
@@ -28376,16 +28412,16 @@ void zend_init_opcodes_handlers()
        ZEND_CATCH_SPEC_HANDLER,
        ZEND_CATCH_SPEC_HANDLER,
        ZEND_CATCH_SPEC_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
-       ZEND_NULL_HANDLER,
+       ZEND_THROW_SPEC_CONST_HANDLER,
+       ZEND_THROW_SPEC_CONST_HANDLER,
+       ZEND_THROW_SPEC_CONST_HANDLER,
+       ZEND_THROW_SPEC_CONST_HANDLER,
+       ZEND_THROW_SPEC_CONST_HANDLER,
+       ZEND_THROW_SPEC_TMP_HANDLER,
+       ZEND_THROW_SPEC_TMP_HANDLER,
+       ZEND_THROW_SPEC_TMP_HANDLER,
+       ZEND_THROW_SPEC_TMP_HANDLER,
+       ZEND_THROW_SPEC_TMP_HANDLER,
        ZEND_THROW_SPEC_VAR_HANDLER,
        ZEND_THROW_SPEC_VAR_HANDLER,
        ZEND_THROW_SPEC_VAR_HANDLER,