Changed meaning of "op2" for ZEND_FREE, ZEND_FE_FREE, ZEND_FAST_CALL, ZEND_FAST_RET.

Previously it was an instruction number.
Now it's an index in op_array->try_cacth_array[].

1 files changed, 14 insertions, 9 deletions

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cc0193bfcd..42bd60b620 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1476,6 +1476,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_TRAITS_SPEC_HANDLER(ZEND_
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	uint32_t op_num = EG(opline_before_exception) - EX(func)->op_array.opcodes;
+	uint32_t last_try_catch = EX(func)->op_array.last_try_catch;
 	int i;
 	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0;
 	int in_finally = 0;
@@ -1487,14 +1488,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		if ((exc_opline->opcode == ZEND_FREE || exc_opline->opcode == ZEND_FE_FREE)
 			&& exc_opline->extended_value & ZEND_FREE_ON_RETURN) {
 			/* exceptions thrown because of loop var destruction on return/break/...
-			 * are logically thrown at the end of the foreach loop, so adjust the
-			 * op_num.
+			 * are logically thrown at the end of the foreach loop,
+			 * so don't check the inner exception regions
 			 */
-			op_num = EX(func)->op_array.brk_cont_array[exc_opline->op2.num].brk;
+			last_try_catch = exc_opline->op2.num;
 		}
 	}
 
-	for (i = 0; i < EX(func)->op_array.last_try_catch; i++) {
+	for (i = 0; i < last_try_catch; i++) {
 		if (EX(func)->op_array.try_catch_array[i].try_op > op_num) {
 			/* further blocks will not be relevant... */
 			break;
@@ -1633,7 +1634,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPC
 		const zend_op *fast_ret = EX(func)->op_array.opcodes + fast_call->u2.lineno;
 		ZEND_VM_SET_OPCODE(fast_ret + 1);
 		if (fast_ret->extended_value & ZEND_FAST_CALL_FROM_FINALLY) {
-			fast_call->u2.lineno = fast_ret->op2.opline_num;
+			fast_call->u2.lineno = EX(func)->op_array.try_catch_array[fast_ret->op2.num].finally_op - 2;
 		}
 		ZEND_VM_CONTINUE();
 	} else {
@@ -1641,15 +1642,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_RET_SPEC_HANDLER(ZEND_OPC
 		USE_OPLINE
 
 		if (opline->extended_value == ZEND_FAST_RET_TO_FINALLY) {
-			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
-			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
+			uint32_t finally_op = EX(func)->op_array.try_catch_array[opline->op2.num].finally_op;
+
+			cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, finally_op);
+			ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[finally_op]);
 			ZEND_VM_CONTINUE();
 		} else {
 			EG(exception) = Z_OBJ_P(fast_call);
 			Z_OBJ_P(fast_call) = NULL;
 			if (opline->extended_value == ZEND_FAST_RET_TO_CATCH) {
-				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, opline->op2.opline_num);
-				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[opline->op2.opline_num]);
+				uint32_t catch_op = EX(func)->op_array.try_catch_array[opline->op2.num].catch_op;
+
+				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, catch_op);
+				ZEND_VM_SET_OPCODE(&EX(func)->op_array.opcodes[catch_op]);
 				ZEND_VM_CONTINUE();
 			} else {
 				cleanup_live_vars(execute_data, opline - EX(func)->op_array.opcodes, 0);