Fix last known nasty bugs in Zend. It'll be cool if there are no new ones :)

2 files changed, 36 insertions, 11 deletions

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index e358e0b9db..281f28ae49 100644
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -202,7 +202,7 @@ unticked_statement:
 	|	T_REQUIRE expr ';'			{ do_require(&$2 CLS_CC); }
 	|	T_USE use_filename ';'		{ use_filename($2.u.constant.value.str.val, $2.u.constant.value.str.len CLS_CC); zval_dtor(&$2.u.constant); }
 	|	T_UNSET '(' r_cvar ')' ';' { do_unset(&$3 CLS_CC); }
-	|	T_FOREACH '(' w_expr T_AS { do_foreach_begin(&$1, &$3, &$2, &$4 CLS_CC); } w_cvar foreach_optional_arg ')' { do_foreach_cont(&$6, &$7, &$4 CLS_CC); } foreach_statement { do_foreach_end(&$1, &$2 CLS_CC); }
+	|	T_FOREACH '(' expr T_AS { do_foreach_begin(&$1, &$3, &$2, &$4 CLS_CC); } w_cvar foreach_optional_arg ')' { do_foreach_cont(&$6, &$7, &$4 CLS_CC); } foreach_statement { do_foreach_end(&$1, &$2 CLS_CC); }
 	|	T_DECLARE { do_declare_begin(CLS_C); } '(' declare_list ')' declare_statement { do_declare_end(CLS_C); }
 	|	';'		/* empty statement */
 ;
@@ -561,10 +561,12 @@ expr:
 	|	expr_without_variable	{ $$ = $1; }
 ;
 
+/*
 w_expr:
 		w_cvar					{ $$ = $1; }
 	|	expr_without_variable	{ $$ = $1; }
 ;
+*/
 
 
 r_cvar:
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 04800e399e..020d894127 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -17,6 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
+#define ZEND_INTENSIVE_DEBUGGING 0
 
 #include <stdio.h>
 #include <signal.h>
@@ -939,6 +940,33 @@ static void call_overloaded_function(int arg_count, zval *return_value ELS_DC)
 }
 
 
+#if ZEND_INTENSIVE_DEBUGGING
+
+#define CHECK_SYMBOL_TABLES()														\
+	zend_hash_apply(&EG(symbol_table), (int (*)()) zend_check_symbol);				\
+	if (&EG(symbol_table)!=EG(active_symbol_table)) {								\
+		zend_hash_apply(EG(active_symbol_table), (int (*)()) zend_check_symbol);	\
+	}
+
+static int zend_check_symbol(zval **pz)
+{
+	if ((*pz)->type>9) {
+		fprintf(stderr, "Warning!  %x has invalid type!\n", *pz);
+	} else if ((*pz)->type==IS_ARRAY) {
+		zend_hash_apply((*pz)->value.ht, (int (*)()) zend_check_symbol);
+	} else if ((*pz)->type==IS_OBJECT) {
+		zend_hash_apply((*pz)->value.obj.properties, (int (*)()) zend_check_symbol);
+	}
+
+	return 0;
+}
+
+
+#else
+#define CHECK_SYMBOL_TABLES()
+#endif
+
+
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2)) && !(defined(ZTS) && (WINNT|WIN32))
 #	define do_alloca(p) alloca(p)
 #	define free_alloca(p)
@@ -947,8 +975,9 @@ static void call_overloaded_function(int arg_count, zval *return_value ELS_DC)
 #	define free_alloca(p)	efree(p)
 #endif
 
-#define NEXT_OPCODE()	\
-	opline++;			\
+#define NEXT_OPCODE()		\
+	CHECK_SYMBOL_TABLES()	\
+	opline++;				\
 	continue;
 
 typedef struct _object_info {
@@ -2096,7 +2125,6 @@ send_by_ref:
 				NEXT_OPCODE();
 			case ZEND_FE_RESET: {
 					zval *array_ptr;
-					zval **array_ptr_ptr;
 					HashTable *fe_ht;
 					
 					if ((opline->op1.op_type == IS_CONST) || (opline->op1.op_type == IS_TMP_VAR)) {
@@ -2112,12 +2140,7 @@ send_by_ref:
 							array_ptr->refcount++;
 						}
 					} else {
-						array_ptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_R);
-						if (!PZVAL_IS_REF(*array_ptr_ptr)){
-							SEPARATE_ZVAL(array_ptr_ptr);
-						}
-						array_ptr = *array_ptr_ptr;
-						array_ptr->is_ref = 1;
+						array_ptr = get_zval_ptr(&opline->op1, Ts, &EG(free_op1), BP_VAR_R);
 						array_ptr->refcount++;
 					}
 					PZVAL_LOCK(array_ptr);
@@ -2144,7 +2167,7 @@ send_by_ref:
 
 					fe_ht = HASH_OF(array);
 
-					if (! fe_ht) {
+					if (!fe_ht) {
 						zend_error(E_WARNING, "Invalid argument supplied for foreach()");
 						opline = op_array->opcodes+opline->op2.u.opline_num;
 						continue;