From 5546f8be5605f94e174d8a4faee40e1ddec79a03 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 17 Mar 2016 15:16:47 +0800
Subject: [PATCH] Fixed bug #71841 (EG(error_zval) is not handled well)

---
 NEWS                     |   3 +
 Zend/tests/bug71841.phpt |  23 ++
 Zend/zend_vm_def.h       |  51 ++-
 Zend/zend_vm_execute.h   | 669 ++++++++++++++++++++++++++-------------
 4 files changed, 507 insertions(+), 239 deletions(-)
 create mode 100644 Zend/tests/bug71841.phpt

diff --git a/NEWS b/NEWS
index c839954848..5ffad7624a 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016, PHP 5.6.21
 
+- Core: 
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+
 - Standard:
   . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
 
diff --git a/Zend/tests/bug71841.phpt b/Zend/tests/bug71841.phpt
new file mode 100644
index 0000000000..f66761b3c9
--- /dev/null
+++ b/Zend/tests/bug71841.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 2b8087e4b7..2e81f82e49 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -364,13 +364,20 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -625,13 +632,20 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -731,13 +745,16 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 9427fb7ae5..df47bea982 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14540,13 +14540,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -14800,13 +14807,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -14906,13 +14920,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -17053,13 +17070,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -17314,13 +17338,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -17420,13 +17451,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -19153,13 +19187,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -19414,13 +19455,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -19520,13 +19568,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -21359,13 +21410,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -22789,13 +22847,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -23049,13 +23114,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -23155,13 +23227,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -24751,13 +24826,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -25010,13 +25092,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -25116,13 +25205,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -26164,13 +26256,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -26424,13 +26523,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -26530,13 +26636,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -27486,13 +27595,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -27746,13 +27862,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -27852,13 +27975,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -28809,13 +28935,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29240,13 +29373,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29499,13 +29639,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -29605,13 +29752,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -32075,13 +32225,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -32334,13 +32491,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -32440,13 +32604,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -34359,13 +34526,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -34619,13 +34793,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -34725,13 +34906,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -36322,13 +36506,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -36582,13 +36773,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -36688,13 +36886,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -38390,13 +38591,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39671,13 +39879,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39930,13 +40145,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -40036,13 +40258,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
-- 
2.40.0