Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  Fixed bug #69732 (can induce segmentation fault with basic php code).

Conflicts:
	Zend/zend_vm_execute.h

diff --cc NEWS
index f961ed7d3bae275df9ba7fe3881b1ee81e70e607,0463d11dcbf86ca4b151af9c3648dbce486adbaf..070438572b5f2ada62d2cb2a838f907241bda037
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,21 -1,18 +1,23 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2015, PHP 5.5.26
 +?? Jul 2015, PHP 5.6.11
 +
 +11 Jun 2015, PHP 5.6.10
  
  - Core:
 -  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
 -    in extension trait). (jbboehr at gmail dot com)
    . Fixed bug #66048 (temp. directory is cached during multiple requests).
      (Julien)
 +  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
 +    in extension trait). (jbboehr at gmail dot com)
 +  . Fixed bug #69599 (Strange generator+exception+variadic crash). (Nikita)
    . Fixed bug #69628 (complex GLOB_BRACE fails on Windows).
      (Christoph M. Becker)
 +  . Fixed POST data processing slowdown due to small input buffer size
 +    on Windows. (Jorge Oliveira, Anatol)
    . Fixed bug #69703 (Use __builtin_clzl on PowerPC).
      (dja at axtens dot net, Kalle)
+   . Fixed bug #69732 (can induce segmentation fault with basic php code).
+     (Dmitry)
  
  - GD:
    . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi)

diff --cc Zend/zend_vm_def.h
index 7c029ada3f7dbca2210e60f7da0138160f3e28a2,94b65e4939b0407d806f56b5e01368f9838c33e0..c7b2d2a93473881021bc6c0164273a9cfaf6fb72
--- 1/Zend/zend_vm_def.h
--- 2/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@@ -1753,7 -1762,9 +1753,9 @@@ ZEND_VM_HANDLER(38, ZEND_ASSIGN, VAR|CV
                }
        }
  
-       FREE_OP1_VAR_PTR();
+       if (OP1_TYPE == IS_VAR && OP1_FREE) {
 -              zval_ptr_dtor(&value);
++              zval_ptr_dtor_nogc(&value);
+       }
  
        /* zend_assign_to_variable() always takes care of op2, never free it! */
        FREE_OP2_IF_VAR();

diff --cc Zend/zend_vm_execute.h
index 1f5e55f40df8bf80477ff5dc13589a7c14e434f1,0b2b24c46eff02c820ca026b2831f9f63c3ff2f3..0de6b4ab57d8a2529a39cc3d9cb8ad618dbc050c
--- 1/Zend/zend_vm_execute.h
--- 2/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@@ -15692,7 -15307,9 +15692,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
-       if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+       if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -              zval_ptr_dtor(&value);
++              zval_ptr_dtor_nogc(&value);
+       }
  
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -18043,7 -17664,9 +18045,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
-       if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+       if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -              zval_ptr_dtor(&value);
++              zval_ptr_dtor_nogc(&value);
+       }
  
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -20303,10 -19927,12 +20307,12 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
-       if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+       if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -              zval_ptr_dtor(&value);
++              zval_ptr_dtor_nogc(&value);
+       }
  
        /* zend_assign_to_variable() always takes care of op2, never free it! */
 -      if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
 +      zval_ptr_dtor_nogc(&free_op2.var);
  
        CHECK_EXCEPTION();
        ZEND_VM_NEXT_OPCODE();
@@@ -23772,7 -23401,9 +23778,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
-       if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+       if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -              zval_ptr_dtor(&value);
++              zval_ptr_dtor_nogc(&value);
+       }
  
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -33211,6 -32836,10 +33219,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
 -              zval_ptr_dtor(&value);
+       if (IS_CV == IS_VAR && 0) {
++              zval_ptr_dtor_nogc(&value);
+       }
+ 
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
        CHECK_EXCEPTION();
@@@ -35331,6 -34960,10 +35343,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
 -              zval_ptr_dtor(&value);
+       if (IS_CV == IS_VAR && 0) {
++              zval_ptr_dtor_nogc(&value);
+       }
+ 
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
        CHECK_EXCEPTION();
@@@ -37452,8 -37087,12 +37468,12 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
 -              zval_ptr_dtor(&value);
+       if (IS_CV == IS_VAR && 0) {
++              zval_ptr_dtor_nogc(&value);
+       }
+ 
        /* zend_assign_to_variable() always takes care of op2, never free it! */
 -      if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
 +      zval_ptr_dtor_nogc(&free_op2.var);
  
        CHECK_EXCEPTION();
        ZEND_VM_NEXT_OPCODE();
@@@ -40632,6 -40276,10 +40652,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
                }
        }
  
 -              zval_ptr_dtor(&value);
+       if (IS_CV == IS_VAR && 0) {
++              zval_ptr_dtor_nogc(&value);
+       }
+ 
        /* zend_assign_to_variable() always takes care of op2, never free it! */
  
        CHECK_EXCEPTION();