From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date: Wed, 11 Dec 2013 07:50:53 +0000 (+0100)
Subject: Merge branch 'PHP-5.4' into PHP-5.5
X-Git-Tag: POST_64BIT_BRANCH_MERGE^2~109^2~18^2~335^2^2^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bec62af14145c4c636716fc54465fc2f8c5d00b4;p=php

Merge branch 'PHP-5.4' into PHP-5.5
---

bec62af14145c4c636716fc54465fc2f8c5d00b4
diff --cc Zend/zend_operators.h
index 6e52de0698,815ef27340..815cf582b6
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@@ -632,18 -588,19 +632,22 @@@ static zend_always_inline int fast_add_
  			"fstpl	(%0)\n"
  			"1:"
  			: 
 -			: "r"(result),
 -			  "r"(op1),
 -			  "r"(op2)
 -			: "rax");
 +			: "r"(&result->value),
 +			  "r"(&op1->value),
 +			  "r"(&op2->value),
 +			  "n"(IS_LONG),
 +			  "n"(IS_DOUBLE),
 +			  "n"(ZVAL_OFFSETOF_TYPE)
 +			: "rax","cc");
  #else
- 			Z_LVAL_P(result) = Z_LVAL_P(op1) + Z_LVAL_P(op2);
+ 			/*
+ 			 * 'result' may alias with op1 or op2, so we need to
+ 			 * ensure that 'result' is not updated until after we
+ 			 * have read the values of op1 and op2.
+ 			 */
  
  			if (UNEXPECTED((Z_LVAL_P(op1) & LONG_SIGN_MASK) == (Z_LVAL_P(op2) & LONG_SIGN_MASK)
- 				&& (Z_LVAL_P(op1) & LONG_SIGN_MASK) != (Z_LVAL_P(result) & LONG_SIGN_MASK))) {
+ 				&& (Z_LVAL_P(op1) & LONG_SIGN_MASK) != ((Z_LVAL_P(op1) + Z_LVAL_P(op2)) & LONG_SIGN_MASK))) {
  				Z_DVAL_P(result) = (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2);
  				Z_TYPE_P(result) = IS_DOUBLE;
  			} else {