- Fixed a leak when doing inheritance. The parent class name wasn't being freed.

- Fixed a stack leak. Functions that had late argument binding were set up as
  INIT_FCALL_BY_NAME but were using DO_FCALL and not the corresponding
  DO_FCALL_BY_NAME.

3 files changed, 13 insertions, 11 deletions

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index 0a9cbd03f0..5b9bb2a60d 100644
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -413,15 +413,15 @@ expr_without_variable:
 	|	expr '?' { do_begin_qm_op(&$1, &$2 CLS_CC); }
 		expr ':' { do_qm_true(&$4, &$2, &$5 CLS_CC); }
 		expr	 { do_qm_false(&$$, &$7, &$2, &$5 CLS_CC); }
-	|	T_STRING	'(' { do_extended_fcall_begin(CLS_C); do_begin_function_call(&$1 CLS_CC); }
+	|	T_STRING	'(' { do_extended_fcall_begin(CLS_C); $2.u.opline_num = do_begin_function_call(&$1 CLS_CC); }
 				function_call_parameter_list
-				')' { do_end_function_call(&$1, &$$, &$4, 0 CLS_CC); do_extended_fcall_end(CLS_C); }
+				')' { do_end_function_call(&$1, &$$, &$4, 0, $2.u.opline_num CLS_CC); do_extended_fcall_end(CLS_C); }
 	|	r_cvar '(' { do_extended_fcall_begin(CLS_C); do_begin_dynamic_function_call(&$1 CLS_CC); } 
 				function_call_parameter_list 
-				')' { do_end_function_call(&$1, &$$, &$4, 0 CLS_CC); do_extended_fcall_end(CLS_C);}
+				')' { do_end_function_call(&$1, &$$, &$4, 0, 1 CLS_CC); do_extended_fcall_end(CLS_C);}
 	|	T_STRING T_PAAMAYIM_NEKUDOTAYIM T_STRING '(' { do_extended_fcall_begin(CLS_C); do_begin_class_member_function_call(&$1, &$3 CLS_CC); } 
 											function_call_parameter_list 
-											')' { do_end_function_call(&$3, &$$, &$6, 1 CLS_CC); do_extended_fcall_end(CLS_C);}
+											')' { do_end_function_call(&$3, &$$, &$6, 1, 1 CLS_CC); do_extended_fcall_end(CLS_C);}
 	|	internal_functions_in_yacc { $$ = $1; }
 	|	T_INT_CAST expr 		{ do_cast(&$$, &$2, IS_LONG CLS_CC); }
 	|	T_DOUBLE_CAST expr 	{ do_cast(&$$, &$2, IS_DOUBLE CLS_CC); }
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index d7fcc0002d..9cf6551e52 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -683,7 +683,7 @@ void do_receive_arg(int op, znode *var, znode *offset, znode *initialization, un
 }
 
 
-void do_begin_function_call(znode *function_name CLS_DC)
+int do_begin_function_call(znode *function_name CLS_DC)
 {
 	zend_function *function;
 	
@@ -693,7 +693,7 @@ void do_begin_function_call(znode *function_name CLS_DC)
 
 		zval_copy_ctor(&tmp.u.constant);
 		do_begin_dynamic_function_call(&tmp CLS_CC);
-		return;
+		return 1; // Dynamic
 	}
 	
 	switch (function->type) {
@@ -710,6 +710,7 @@ void do_begin_function_call(znode *function_name CLS_DC)
 			}
 			break;
 	}
+	return 0;
 }
 
 
@@ -748,12 +749,12 @@ void do_begin_class_member_function_call(znode *class_name, znode *function_name
 }
 
 
-void do_end_function_call(znode *function_name, znode *result, znode *argument_list, int is_method CLS_DC)
+void do_end_function_call(znode *function_name, znode *result, znode *argument_list, int is_method, int is_dynamic_fcall CLS_DC)
 {
 	zend_op *opline = get_next_op(CG(active_op_array) CLS_CC);
 	ELS_FETCH();
 	
-	if (function_name->op_type==IS_CONST && !is_method) {
+	if (function_name->op_type==IS_CONST && !is_method && !is_dynamic_fcall) {
 		opline->opcode = ZEND_DO_FCALL;
 	} else {
 		opline->opcode = ZEND_DO_FCALL_BY_NAME;
@@ -1330,6 +1331,7 @@ void do_begin_class_declaration(znode *class_name, znode *parent_class_name CLS_
 		full_class_name[0] = ':';
 		full_class_name++;
 		memcpy(full_class_name, CG(class_entry).name, CG(class_entry).name_length);
+		zval_dtor(&parent_class_name->u.constant);
 		full_class_name += CG(class_entry).name_length;
 		full_class_name[0] = 0;
 		opline->extended_value = ZEND_DECLARE_INHERITED_CLASS;
@@ -1437,7 +1439,7 @@ void do_end_new_object(znode *result, znode *class_name, znode *new_token, znode
 	if (class_name->op_type == IS_CONST) {
 		zval_copy_ctor(&class_name->u.constant);
 	}
-	do_end_function_call(class_name, &ctor_result, argument_list, 1 CLS_CC);
+	do_end_function_call(class_name, &ctor_result, argument_list, 1, 0 CLS_CC);
 	do_free(&ctor_result CLS_CC);
 
 	CG(active_op_array)->opcodes[new_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array));
diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index 903aeb4527..c820ad8824 100644
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -260,10 +260,10 @@ void do_add_variable(znode *result, znode *op1, znode *op2 CLS_DC);
 void do_begin_function_declaration(znode *function_token, znode *function_name, int is_method CLS_DC);
 void do_end_function_declaration(znode *function_token CLS_DC);
 void do_receive_arg(int op, znode *var, znode *offset, znode *initialization, unsigned char pass_type CLS_DC);
-void do_begin_function_call(znode *function_name CLS_DC);
+int do_begin_function_call(znode *function_name CLS_DC);
 void do_begin_dynamic_function_call(znode *function_name CLS_DC);
 void do_begin_class_member_function_call(znode *class_name, znode *function_name CLS_DC);
-void do_end_function_call(znode *function_name, znode *result, znode *argument_list, int is_method CLS_DC);
+void do_end_function_call(znode *function_name, znode *result, znode *argument_list, int is_method, int is_dynamic_fcall CLS_DC);
 void do_return(znode *expr CLS_DC);
 ZEND_API int do_bind_function_or_class(zend_op *opline, HashTable *function_table, HashTable *class_table, int allow_failure);
 void do_early_binding(CLS_D);