Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #74084 (Out of bound read - zend_mm_alloc_small)

Conflicts:
	Zend/zend_operators.c

diff --cc Zend/zend_operators.c
index f2213c1a682b48994ea50662822df79af58de8ae,3a8929b83f9ffef543890ffc426f903acbf2740b..418d2f03ea1b80803d28cc0db8a78c76fc3b5d9a
--- 1/Zend/zend_operators.c
--- 2/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@@ -951,8 -926,13 +951,13 @@@ ZEND_API int ZEND_FASTCALL add_function
                                } else if (!converted) {
                                        ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_ADD, add_function);
  
-                                       zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
-                                       zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       if (EXPECTED(op1 != op2)) {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
 -                                              zendi_convert_scalar_to_number(op2, op2_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++                                              zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       } else {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               op2 = op1;
+                                       }
                                        converted = 1;
                                } else {
                                        zend_throw_error(NULL, "Unsupported operand types");
@@@ -993,8 -984,13 +998,13 @@@ ZEND_API int ZEND_FASTCALL sub_function
                                } else if (!converted) {
                                        ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_SUB, sub_function);
  
-                                       zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
-                                       zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       if (EXPECTED(op1 != op2)) {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
 -                                              zendi_convert_scalar_to_number(op2, op2_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++                                              zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       } else {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               op2 = op1;
+                                       }
                                        converted = 1;
                                } else {
                                        zend_throw_error(NULL, "Unsupported operand types");
@@@ -1040,8 -1036,13 +1050,13 @@@ ZEND_API int ZEND_FASTCALL mul_function
                                } else if (!converted) {
                                        ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_MUL, mul_function);
  
-                                       zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
-                                       zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       if (EXPECTED(op1 != op2)) {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
 -                                              zendi_convert_scalar_to_number(op2, op2_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++                                              zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       } else {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               op2 = op1;
+                                       }
                                        converted = 1;
                                } else {
                                        zend_throw_error(NULL, "Unsupported operand types");
@@@ -1118,17 -1119,27 +1133,27 @@@ ZEND_API int ZEND_FASTCALL pow_function
                                } else if (!converted) {
                                        ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_POW, pow_function);
  
-                                       if (Z_TYPE_P(op1) == IS_ARRAY) {
-                                               ZVAL_LONG(result, 0);
-                                               return SUCCESS;
-                                       } else {
-                                               zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
-                                       }
-                                       if (Z_TYPE_P(op2) == IS_ARRAY) {
-                                               ZVAL_LONG(result, 1L);
-                                               return SUCCESS;
+                                       if (EXPECTED(op1 != op2)) {
+                                               if (Z_TYPE_P(op1) == IS_ARRAY) {
+                                                       ZVAL_LONG(result, 0);
+                                                       return SUCCESS;
+                                               } else {
 -                                                      zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                                      zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               }
+                                               if (Z_TYPE_P(op2) == IS_ARRAY) {
+                                                       ZVAL_LONG(result, 1L);
+                                                       return SUCCESS;
+                                               } else {
 -                                                      zendi_convert_scalar_to_number(op2, op2_copy, result);
++                                                      zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                               }
                                        } else {
-                                               zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                               if (Z_TYPE_P(op1) == IS_ARRAY) {
+                                                       ZVAL_LONG(result, 0);
+                                                       return SUCCESS;
+                                               } else {
 -                                                      zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                                      zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               }
+                                               op2 = op1;
                                        }
                                        converted = 1;
                                } else {
@@@ -1192,9 -1203,13 +1217,14 @@@ ZEND_API int ZEND_FASTCALL div_function
                                        op2 = Z_REFVAL_P(op2);
                                } else if (!converted) {
                                        ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV, div_function);
-                                       zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
-                                       zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
 +
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
 -                                              zendi_convert_scalar_to_number(op2, op2_copy, result);
+                                       if (EXPECTED(op1 != op2)) {
 -                                              zendi_convert_scalar_to_number(op1, op1_copy, result);
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++                                              zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+                                       } else {
++                                              zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+                                               op2 = op1;
+                                       }
                                        converted = 1;
                                } else {
                                        zend_throw_error(NULL, "Unsupported operand types");