fix merge

9 files changed, 134 insertions, 137 deletions

diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
index 250db365cd..5c718cefd4 100644
--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -282,8 +282,9 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
    Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	if(zend_read_property(i_get_exception_base(object), (object), name, sizeof(name) - 1, 1, &value) != &EG(uninitialized_zval) \
-		&& Z_TYPE(value) != type) { \
+	ZVAL_UNDEF(&value); \
+	pvalue = zend_read_property(i_get_exception_base(object), (object), name, sizeof(name) - 1, 1, &value); \
+	if(Z_TYPE_P(pvalue) != IS_UNDEF && Z_TYPE_P(pvalue) != type) { \
 		zval tmp; \
 		ZVAL_STRINGL(&tmp, name, sizeof(name) - 1); \
 		Z_OBJ_HANDLER_P(object, unset_property)(object, &tmp, NULL); \
@@ -292,7 +293,7 @@ ZEND_METHOD(exception, __construct)
 
 ZEND_METHOD(exception, __wakeup)
 {
-	zval value;
+	zval value, *pvalue;
 	zval *object = getThis();
 	CHECK_EXC_TYPE("message", IS_STRING);
 	CHECK_EXC_TYPE("string", IS_STRING);
@@ -711,7 +712,7 @@ ZEND_METHOD(exception, __toString)
 	exception = getThis();
 	ZVAL_STRINGL(&fname, "gettraceasstring", sizeof("gettraceasstring")-1);
 
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT) {
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), zend_ce_throwable)) {
 		zend_string *prev_str = str;
 		zend_string *message = zval_get_string(GET_PROPERTY(exception, "message"));
 		zend_string *file = zval_get_string(GET_PROPERTY(exception, "file"));
diff --git a/ext/date/tests/bug53437_var5.phpt b/ext/date/tests/bug53437_var5.phpt
index e9b3a3cd82..e95fcdae96 100644
--- a/ext/date/tests/bug53437_var5.phpt
+++ b/ext/date/tests/bug53437_var5.phpt
@@ -14,17 +14,17 @@ var_dump($di);
 --EXPECTF--
 object(DateInterval)#%d (15) {
   ["y"]=>
-  int(-1)
+  int(2)
   ["m"]=>
-  int(-1)
+  int(0)
   ["d"]=>
-  int(-1)
+  int(0)
   ["h"]=>
-  int(-1)
+  int(6)
   ["i"]=>
-  int(-1)
+  int(8)
   ["s"]=>
-  int(-1)
+  int(0)
   ["weekday"]=>
   int(10)
   ["weekday_behavior"]=>
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 0c273a26b4..f6a38fb991 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1710,7 +1710,7 @@ SPL_METHOD(Array, unserialize)
 	size_t buf_len;
 	const unsigned char *p, *s;
 	php_unserialize_data_t var_hash;
-	zval members, zflags;
+	zval *members, *zflags;
 	HashTable *aht;
 	zend_long flags;
 
@@ -1737,15 +1737,15 @@ SPL_METHOD(Array, unserialize)
 	}
 	++p;
 
-	if (!php_var_unserialize(&zflags, &p, s + buf_len, &var_hash) || Z_TYPE(zflags) != IS_LONG) {
+	zflags = var_tmp_var(&var_hash);
+	if (!php_var_unserialize(zflags, &p, s + buf_len, &var_hash) || Z_TYPE_P(zflags) != IS_LONG) {
 		goto outexcept;
 	}
 
-	var_push_dtor(&var_hash, &zflags);
 	--p; /* for ';' */
-	flags = Z_LVAL(zflags);
+	flags = Z_LVAL_P(zflags);
 	/* flags needs to be verified and we also need to verify whether the next
-	 * thing we get is ';'. After that we require an 'm' or somethign else
+	 * thing we get is ';'. After that we require an 'm' or something else
 	 * where 'm' stands for members and anything else should be an array. If
 	 * neither 'a' or 'm' follows we have an error. */
 
@@ -1777,19 +1777,15 @@ SPL_METHOD(Array, unserialize)
 	}
 	++p;
 
-	ZVAL_UNDEF(&members);
-	if (!php_var_unserialize(&members, &p, s + buf_len, &var_hash) || Z_TYPE(members) != IS_ARRAY) {
-		zval_ptr_dtor(&members);
+	members = var_tmp_var(&var_hash);
+	if (!php_var_unserialize(members, &p, s + buf_len, &var_hash) || Z_TYPE_P(members) != IS_ARRAY) {
 		goto outexcept;
 	}
 
-	var_push_dtor(&var_hash, &members);
 	/* copy members */
-	object_properties_load(&intern->std, Z_ARRVAL(members));
-	zval_ptr_dtor(&members);
+	object_properties_load(&intern->std, Z_ARRVAL_P(members));
 
 	/* done reading $serialized */
-
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 	return;
 
diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c
index a0d6bf887e..210bcdff6e 100644
--- a/ext/spl/spl_dllist.c
+++ b/ext/spl/spl_dllist.c
@@ -1178,7 +1178,7 @@ SPL_METHOD(SplDoublyLinkedList, serialize)
 SPL_METHOD(SplDoublyLinkedList, unserialize)
 {
 	spl_dllist_object *intern = Z_SPLDLLIST_P(getThis());
-	zval flags, elem;
+	zval *flags, *elem;
 	char *buf;
 	size_t buf_len;
 	const unsigned char *p, *s;
@@ -1196,27 +1196,22 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
 
 	/* flags */
-	if (!php_var_unserialize(&flags, &p, s + buf_len, &var_hash)) {
+	flags = var_tmp_var(&var_hash);
+	if (!php_var_unserialize(flags, &p, s + buf_len, &var_hash) || Z_TYPE_P(flags) != IS_LONG) {
 		goto error;
 	}
 
-	if (Z_TYPE(flags) != IS_LONG) {
-		zval_ptr_dtor(&flags);
-		goto error;
-	}
-
-	intern->flags = (int)Z_LVAL(flags);
-	zval_ptr_dtor(&flags);
+	intern->flags = (int)Z_LVAL_P(flags);
 
 	/* elements */
 	while(*p == ':') {
 		++p;
-		if (!php_var_unserialize(&elem, &p, s + buf_len, &var_hash)) {
+		elem = var_tmp_var(&var_hash);
+		if (!php_var_unserialize(elem, &p, s + buf_len, &var_hash)) {
 			goto error;
 		}
 
-		spl_ptr_llist_push(intern->llist, &elem);
-		zval_ptr_dtor(&elem);
+		spl_ptr_llist_push(intern->llist, elem);
 	}
 
 	if (*p != '\0') {
diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 315c0f8bcd..2796d3d93a 100644
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -780,7 +780,8 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	size_t buf_len;
 	const unsigned char *p, *s;
 	php_unserialize_data_t var_hash;
-	zval entry, pmembers, pcount, inf;
+	zval entry, inf;
+	zval *pcount, *pmembers;
 	spl_SplObjectStorageElement *element;
 	zend_long count;
 
@@ -801,17 +802,13 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	}
 	++p;
 
-	if (!php_var_unserialize(&pcount, &p, s + buf_len, &var_hash)) {
-		goto outexcept;
-	}
-	if (Z_TYPE(pcount) != IS_LONG) {
-		zval_ptr_dtor(&pcount);
+	pcount = var_tmp_var(&var_hash);
+	if (!php_var_unserialize(pcount, &p, s + buf_len, &var_hash) || Z_TYPE_P(pcount) != IS_LONG) {
 		goto outexcept;
 	}
 
-	var_push_dtor(&var_hash, &pcount);
 	--p; /* for ';' */
-	count = Z_LVAL(pcount);
+	count = Z_LVAL_P(pcount);
 
 	while (count-- > 0) {
 		spl_SplObjectStorageElement *pelement;
@@ -824,7 +821,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		if(*p != 'O' && *p != 'C' && *p != 'r') {
 			goto outexcept;
 		}
-		/* sore reference to allow cross-references between different elements */
+		/* store reference to allow cross-references between different elements */
 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
 			goto outexcept;
 		}
@@ -838,6 +835,8 @@ SPL_METHOD(SplObjectStorage, unserialize)
 				zval_ptr_dtor(&entry);
 				goto outexcept;
 			}
+		} else {
+			ZVAL_UNDEF(&inf);
 		}
 
 		hash = spl_object_storage_get_hash(intern, getThis(), &entry);
@@ -856,7 +855,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 				var_push_dtor(&var_hash, &pelement->obj);
 			}
 		}
-		element = spl_object_storage_attach(intern, getThis(), &entry, &inf);
+		element = spl_object_storage_attach(intern, getThis(), &entry, Z_ISUNDEF(inf)?NULL:&inf);
 		var_replace(&var_hash, &entry, &element->obj);
 		var_replace(&var_hash, &inf, &element->inf);
 		zval_ptr_dtor(&entry);
@@ -874,19 +873,16 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	}
 	++p;
 
-	ZVAL_UNDEF(&pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash) || Z_TYPE(pmembers) != IS_ARRAY) {
-		zval_ptr_dtor(&pmembers);
+	pmembers = var_tmp_var(&var_hash);
+	if (!php_var_unserialize(pmembers, &p, s + buf_len, &var_hash) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		goto outexcept;
 	}
 
-	var_push_dtor(&var_hash, &pmembers);
 	/* copy members */
 	if (!intern->std.properties) {
 		rebuild_object_properties(&intern->std);
 	}
-	zend_hash_copy(intern->std.properties, Z_ARRVAL(pmembers), (copy_ctor_func_t) zval_add_ref);
-	zval_ptr_dtor(&pmembers);
+	zend_hash_copy(intern->std.properties, Z_ARRVAL_P(pmembers), (copy_ctor_func_t) zval_add_ref);
 
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 	return;
diff --git a/ext/standard/php_var.h b/ext/standard/php_var.h
index cdf7661bcd..8f1b2d8bc4 100644
--- a/ext/standard/php_var.h
+++ b/ext/standard/php_var.h
@@ -117,7 +117,7 @@ do { \
 
 PHPAPI void var_replace(php_unserialize_data_t *var_hash, zval *ozval, zval *nzval);
 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hash, zval *val);
-PHPAPI void var_push_dtor_no_addref(php_unserialize_data_t *var_hashx, zval *rval);
+PHPAPI zval *var_tmp_var(php_unserialize_data_t *var_hashx);
 PHPAPI void var_destroy(php_unserialize_data_t *var_hash);
 
 #endif /* PHP_VAR_H */
diff --git a/ext/standard/tests/serialize/bug69793.phpt b/ext/standard/tests/serialize/bug69793.phpt
index 134b4dd696..91b1c6b7a0 100644
--- a/ext/standard/tests/serialize/bug69793.phpt
+++ b/ext/standard/tests/serialize/bug69793.phpt
@@ -12,6 +12,6 @@ Notice: Undefined property: Exception::$message in %s/bug69793.php on line %d
 Notice: Undefined property: Exception::$file in %s/bug69793.php on line %d
 
 Notice: Undefined property: Exception::$previous in %s/bug69793.php on line %d
-string(53) "exception 'Exception' in :1337
+string(41) "Exception in :1337
 Stack trace:
 #0 {main}"
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index b3aa1c567b..1dc4e69f18 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.13.7.5 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -66,33 +66,37 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval *rval)
 
 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval *rval)
 {
-	var_dtor_entries *var_hash;
-
-	if (!var_hashx || !*var_hashx) {
-		return;
-	}
-
-	var_hash = (*var_hashx)->last_dtor;
-#if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
-#endif
-
-	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
-		var_hash = emalloc(sizeof(var_dtor_entries));
-		var_hash->used_slots = 0;
-		var_hash->next = 0;
-
-		if (!(*var_hashx)->first_dtor) {
-			(*var_hashx)->first_dtor = var_hash;
-		} else {
-			((var_dtor_entries *) (*var_hashx)->last_dtor)->next = var_hash;
-		}
-
-		(*var_hashx)->last_dtor = var_hash;
-	}
+	zval *tmp_var = var_tmp_var(var_hashx);
+    if (!tmp_var) {
+        return;
+    }
+	ZVAL_COPY(tmp_var, rval);
+}
 
-	ZVAL_COPY(&var_hash->data[var_hash->used_slots], rval);
-	var_hash->used_slots++;
+PHPAPI zval *var_tmp_var(php_unserialize_data_t *var_hashx)
+{
+    var_dtor_entries *var_hash;
+
+    if (!var_hashx || !*var_hashx) {
+        return NULL;
+    }
+
+    var_hash = (*var_hashx)->last_dtor;
+    if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
+        var_hash = emalloc(sizeof(var_dtor_entries));
+        var_hash->used_slots = 0;
+        var_hash->next = 0;
+
+        if (!(*var_hashx)->first_dtor) {
+            (*var_hashx)->first_dtor = var_hash;
+        } else {
+            ((var_dtor_entries *) (*var_hashx)->last_dtor)->next = var_hash;
+        }
+
+        (*var_hashx)->last_dtor = var_hash;
+    }
+    ZVAL_UNDEF(&var_hash->data[var_hash->used_slots]);
+    return &var_hash->data[var_hash->used_slots++];
 }
 
 //???
@@ -259,7 +263,7 @@ static inline int unserialize_allowed_class(zend_string *class_name, HashTable *
 #define YYMARKER marker
 
 
-#line 267 "ext/standard/var_unserializer.re"
+#line 271 "ext/standard/var_unserializer.re"
 
 
 
@@ -524,7 +528,7 @@ PHPAPI int php_var_unserialize_ex(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
-#line 528 "ext/standard/var_unserializer.c"
+#line 532 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -584,9 +588,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 875 "ext/standard/var_unserializer.re"
+#line 879 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 590 "ext/standard/var_unserializer.c"
+#line 594 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -629,13 +633,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 869 "ext/standard/var_unserializer.re"
+#line 873 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 639 "ext/standard/var_unserializer.c"
+#line 643 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -661,11 +665,12 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych != ':') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 724 "ext/standard/var_unserializer.re"
+#line 728 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	zend_long elements;
@@ -810,7 +815,7 @@ yy20:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 814 "ext/standard/var_unserializer.c"
+#line 819 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -835,7 +840,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 716 "ext/standard/var_unserializer.re"
+#line 720 "ext/standard/var_unserializer.re"
 	{
 
 //???	INIT_PZVAL(rval);
@@ -843,7 +848,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 847 "ext/standard/var_unserializer.c"
+#line 852 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -864,7 +869,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 695 "ext/standard/var_unserializer.re"
+#line 699 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -885,7 +890,7 @@ yy34:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 889 "ext/standard/var_unserializer.c"
+#line 894 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -906,7 +911,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 667 "ext/standard/var_unserializer.re"
+#line 671 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	zend_string *str;
@@ -934,7 +939,7 @@ yy41:
 	ZVAL_STR(rval, str);
 	return 1;
 }
-#line 938 "ext/standard/var_unserializer.c"
+#line 943 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -955,7 +960,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 640 "ext/standard/var_unserializer.re"
+#line 644 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -982,7 +987,7 @@ yy48:
 	ZVAL_STRINGL(rval, str, len);
 	return 1;
 }
-#line 986 "ext/standard/var_unserializer.c"
+#line 991 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1070,7 +1075,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 631 "ext/standard/var_unserializer.re"
+#line 635 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 use_double:
@@ -1079,7 +1084,7 @@ use_double:
 	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1083 "ext/standard/var_unserializer.c"
+#line 1088 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1138,7 +1143,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 615 "ext/standard/var_unserializer.re"
+#line 619 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 
@@ -1154,7 +1159,7 @@ yy73:
 
 	return 1;
 }
-#line 1158 "ext/standard/var_unserializer.c"
+#line 1163 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1181,7 +1186,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 589 "ext/standard/var_unserializer.re"
+#line 593 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1207,7 +1212,7 @@ yy79:
 	ZVAL_LONG(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1211 "ext/standard/var_unserializer.c"
+#line 1216 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1215,22 +1220,22 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 583 "ext/standard/var_unserializer.re"
+#line 587 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_BOOL(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1225 "ext/standard/var_unserializer.c"
+#line 1230 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 577 "ext/standard/var_unserializer.re"
+#line 581 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_NULL(rval);
 	return 1;
 }
-#line 1234 "ext/standard/var_unserializer.c"
+#line 1239 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1253,7 +1258,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 554 "ext/standard/var_unserializer.re"
+#line 558 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1276,7 +1281,7 @@ yy91:
 
 	return 1;
 }
-#line 1280 "ext/standard/var_unserializer.c"
+#line 1285 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1299,7 +1304,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 532 "ext/standard/var_unserializer.re"
+#line 536 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1321,9 +1326,9 @@ yy97:
 
 	return 1;
 }
-#line 1325 "ext/standard/var_unserializer.c"
+#line 1330 "ext/standard/var_unserializer.c"
 }
-#line 877 "ext/standard/var_unserializer.re"
+#line 881 "ext/standard/var_unserializer.re"
 
 
 	return 0;
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 0b0917a60a..23ea6548e5 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -64,33 +64,37 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval *rval)
 
 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval *rval)
 {
-	var_dtor_entries *var_hash;
-
-	if (!var_hashx || !*var_hashx) {
-		return;
-	}
-
-	var_hash = (*var_hashx)->last_dtor;
-#if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
-#endif
-
-	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
-		var_hash = emalloc(sizeof(var_dtor_entries));
-		var_hash->used_slots = 0;
-		var_hash->next = 0;
-
-		if (!(*var_hashx)->first_dtor) {
-			(*var_hashx)->first_dtor = var_hash;
-		} else {
-			((var_dtor_entries *) (*var_hashx)->last_dtor)->next = var_hash;
-		}
-
-		(*var_hashx)->last_dtor = var_hash;
-	}
+	zval *tmp_var = var_tmp_var(var_hashx);
+    if (!tmp_var) {
+        return;
+    }
+	ZVAL_COPY(tmp_var, rval);
+}
 
-	ZVAL_COPY(&var_hash->data[var_hash->used_slots], rval);
-	var_hash->used_slots++;
+PHPAPI zval *var_tmp_var(php_unserialize_data_t *var_hashx)
+{
+    var_dtor_entries *var_hash;
+
+    if (!var_hashx || !*var_hashx) {
+        return NULL;
+    }
+
+    var_hash = (*var_hashx)->last_dtor;
+    if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
+        var_hash = emalloc(sizeof(var_dtor_entries));
+        var_hash->used_slots = 0;
+        var_hash->next = 0;
+
+        if (!(*var_hashx)->first_dtor) {
+            (*var_hashx)->first_dtor = var_hash;
+        } else {
+            ((var_dtor_entries *) (*var_hashx)->last_dtor)->next = var_hash;
+        }
+
+        (*var_hashx)->last_dtor = var_hash;
+    }
+    ZVAL_UNDEF(&var_hash->data[var_hash->used_slots]);
+    return &var_hash->data[var_hash->used_slots++];
 }
 
 //???