Imported Upstream version 5.3.0RC1upstream/5.3.0_RC1upstream/5.3.0RC1

1 files changed, 533 insertions, 660 deletions

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 382b472c5..e6096df74 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_execute.c,v 1.716.2.12.2.32 2009/02/15 14:31:17 iliaa Exp $ */
+/* $Id: zend_execute.c,v 1.716.2.12.2.24.2.41 2009/03/18 14:15:28 dmitry Exp $ */
 
 #define ZEND_INTENSIVE_DEBUGGING 0
 
@@ -34,6 +34,7 @@
 #include "zend_ini.h"
 #include "zend_exceptions.h"
 #include "zend_interfaces.h"
+#include "zend_closures.h"
 #include "zend_vm.h"
 
 /* Virtual current working directory support */
@@ -53,9 +54,9 @@ typedef int (*incdec_t)(zval *);
 #define get_obj_zval_ptr_ptr(node, Ts, should_free, type) _get_obj_zval_ptr_ptr(node, Ts, should_free, type TSRMLS_CC)
 
 /* Prototypes */
-static void zend_extension_statement_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
-static void zend_extension_fcall_begin_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
-static void zend_extension_fcall_end_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
+static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
+static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
+static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC);
 
 #define RETURN_VALUE_USED(opline) (!((opline)->result.u.EA.type & EXT_TYPE_UNUSED))
 
@@ -64,33 +65,37 @@ static void zend_extension_fcall_end_handler(zend_extension *extension, zend_op_
 
 #define TEMP_VAR_STACK_LIMIT 2000
 
-static inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free, int unref)
+static zend_always_inline void zend_pzval_unlock_func(zval *z, zend_free_op *should_free, int unref TSRMLS_DC)
 {
-	if (!--z->refcount) {
-		z->refcount = 1;
-		z->is_ref = 0;
+	if (!Z_DELREF_P(z)) {
+		Z_SET_REFCOUNT_P(z, 1);
+		Z_UNSET_ISREF_P(z);
 		should_free->var = z;
 /*		should_free->is_var = 1; */
 	} else {
 		should_free->var = 0;
-		if (unref && z->is_ref && z->refcount == 1) {
-			z->is_ref = 0;
+		if (unref && Z_ISREF_P(z) && Z_REFCOUNT_P(z) == 1) {
+			Z_UNSET_ISREF_P(z);
 		}
+		GC_ZVAL_CHECK_POSSIBLE_ROOT(z);
 	}
 }
 
-static inline void zend_pzval_unlock_free_func(zval *z)
+static zend_always_inline void zend_pzval_unlock_free_func(zval *z TSRMLS_DC)
 {
-	if (!--z->refcount) {
-		zval_dtor(z);
-		safe_free_zval_ptr(z);
+	if (!Z_DELREF_P(z)) {
+		if (z != &EG(uninitialized_zval)) {
+			GC_REMOVE_ZVAL_FROM_BUFFER(z);
+			zval_dtor(z);
+			efree(z);
+		}
 	}
 }
 
-#define PZVAL_UNLOCK(z, f) zend_pzval_unlock_func(z, f, 1)
-#define PZVAL_UNLOCK_EX(z, f, u) zend_pzval_unlock_func(z, f, u)
-#define PZVAL_UNLOCK_FREE(z) zend_pzval_unlock_free_func(z)
-#define PZVAL_LOCK(z) (z)->refcount++
+#define PZVAL_UNLOCK(z, f) zend_pzval_unlock_func(z, f, 1 TSRMLS_CC)
+#define PZVAL_UNLOCK_EX(z, f, u) zend_pzval_unlock_func(z, f, u TSRMLS_CC)
+#define PZVAL_UNLOCK_FREE(z) zend_pzval_unlock_free_func(z TSRMLS_CC)
+#define PZVAL_LOCK(z) Z_ADDREF_P((z))
 #define RETURN_VALUE_UNUSED(pzn)	(((pzn)->u.EA.type & EXT_TYPE_UNUSED))
 #define SELECTIVE_PZVAL_LOCK(pzv, pzn)	if (!RETURN_VALUE_UNUSED(pzn)) { PZVAL_LOCK(pzv); }
 
@@ -102,6 +107,10 @@ static inline void zend_pzval_unlock_free_func(zval *z)
 		(ai).ptr = NULL; \
 	}
 
+#define AI_SET_PTR(ai, val)		\
+	(ai).ptr = (val);			\
+	(ai).ptr_ptr = &((ai).ptr);
+
 #define FREE_OP(should_free) \
 	if (should_free.var) { \
 		if ((zend_uintptr_t)should_free.var & 1L) { \
@@ -128,8 +137,8 @@ static inline void zend_pzval_unlock_free_func(zval *z)
 #define INIT_PZVAL_COPY(z,v) \
 	(z)->value = (v)->value; \
 	Z_TYPE_P(z) = Z_TYPE_P(v); \
-	(z)->refcount = 1; \
-	(z)->is_ref = 0;
+	Z_SET_REFCOUNT_P(z, 1); \
+	Z_UNSET_ISREF_P(z);
 
 #define MAKE_REAL_ZVAL_PTR(val) \
 	do { \
@@ -137,8 +146,8 @@ static inline void zend_pzval_unlock_free_func(zval *z)
 		ALLOC_ZVAL(_tmp); \
 		_tmp->value = (val)->value; \
 		Z_TYPE_P(_tmp) = Z_TYPE_P(val); \
-		_tmp->refcount = 1; \
-		_tmp->is_ref = 0; \
+		Z_SET_REFCOUNT_P(_tmp, 1); \
+		Z_UNSET_ISREF_P(_tmp); \
 		val = _tmp; \
 	} while (0)
 
@@ -147,87 +156,107 @@ static inline void zend_pzval_unlock_free_func(zval *z)
 #define CV_OF(i)     (EG(current_execute_data)->CVs[i])
 #define CV_DEF_OF(i) (EG(active_op_array)->vars[i])
 
-ZEND_API zval** zend_get_compiled_variable_value(zend_execute_data *execute_data_ptr, zend_uint var)
+#define CTOR_CALL_BIT    0x1
+#define CTOR_USED_BIT    0x2
+
+#define IS_CTOR_CALL(ce) (((zend_uintptr_t)(ce)) & CTOR_CALL_BIT)
+#define IS_CTOR_USED(ce) (((zend_uintptr_t)(ce)) & CTOR_USED_BIT)
+
+#define ENCODE_CTOR(ce, used) \
+	((zend_class_entry*)(((zend_uintptr_t)(ce)) | CTOR_CALL_BIT | ((used) ? CTOR_USED_BIT : 0)))
+#define DECODE_CTOR(ce) \
+	((zend_class_entry*)(((zend_uintptr_t)(ce)) & ~(CTOR_CALL_BIT|CTOR_USED_BIT)))
+
+ZEND_API zval** zend_get_compiled_variable_value(const zend_execute_data *execute_data_ptr, zend_uint var)
 {
 	return execute_data_ptr->CVs[var];
 }
 
-static inline void zend_get_cv_address(zend_compiled_variable *cv, zval ***ptr, temp_variable *Ts TSRMLS_DC)
+static zend_always_inline zval *_get_zval_ptr_tmp(const znode *node, const temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
 {
-	zval *new_zval = &EG(uninitialized_zval);
-
-	new_zval->refcount++;
-	zend_hash_quick_update(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, &new_zval, sizeof(zval *), (void **)ptr);
+	return should_free->var = &T(node->u.var).tmp_var;
 }
 
-static inline zval *_get_zval_ptr_tmp(znode *node, temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
+static zval *_get_zval_ptr_var_string_offset(const znode *node, const temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
 {
-	return should_free->var = &T(node->u.var).tmp_var;
+	temp_variable *T = &T(node->u.var);
+	zval *str = T->str_offset.str;
+	zval *ptr;
+
+	/* string offset */
+	ALLOC_ZVAL(ptr);
+	T->str_offset.ptr = ptr;
+	should_free->var = ptr;
+
+	if (T->str_offset.str->type != IS_STRING
+		|| ((int)T->str_offset.offset < 0)
+		|| (T->str_offset.str->value.str.len <= (int)T->str_offset.offset)) {
+		ptr->value.str.val = STR_EMPTY_ALLOC();
+		ptr->value.str.len = 0;
+	} else {
+		ptr->value.str.val = estrndup(str->value.str.val + T->str_offset.offset, 1);
+		ptr->value.str.len = 1;
+	}
+	PZVAL_UNLOCK_FREE(str);
+	Z_SET_REFCOUNT_P(ptr, 1);
+	Z_SET_ISREF_P(ptr);
+	ptr->type = IS_STRING;
+	return ptr;
 }
 
-static inline zval *_get_zval_ptr_var(znode *node, temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
+static zend_always_inline zval *_get_zval_ptr_var(const znode *node, const temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
 {
 	zval *ptr = T(node->u.var).var.ptr;
-	if (ptr) {
+	if (EXPECTED(ptr != NULL)) {
 		PZVAL_UNLOCK(ptr, should_free);
 		return ptr;
 	} else {
-		temp_variable *T = &T(node->u.var);
-		zval *str = T->str_offset.str;
+		return _get_zval_ptr_var_string_offset(node, Ts, should_free TSRMLS_CC);
+	}
+}
 
-		/* string offset */
-		ALLOC_ZVAL(ptr);
-		T->str_offset.ptr = ptr;
-		should_free->var = ptr;
-
-		if (T->str_offset.str->type != IS_STRING
-			|| ((int)T->str_offset.offset < 0)
-			|| (T->str_offset.str->value.str.len <= (int)T->str_offset.offset)) {
-			zend_error(E_NOTICE, "Uninitialized string offset:  %d", T->str_offset.offset);
-			ptr->value.str.val = STR_EMPTY_ALLOC();
-			ptr->value.str.len = 0;
-		} else {
-			char c = str->value.str.val[T->str_offset.offset];
+static zval **_get_zval_cv_lookup(zval ***ptr, zend_uint var, int type TSRMLS_DC)
+{
+	zend_compiled_variable *cv = &CV_DEF_OF(var);
 
-			ptr->value.str.val = estrndup(&c, 1);
-			ptr->value.str.len = 1;
+	if (!EG(active_symbol_table) ||
+	    zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **)ptr)==FAILURE) {
+		switch (type) {
+			case BP_VAR_R:
+			case BP_VAR_UNSET:
+				zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
+				/* break missing intentionally */
+			case BP_VAR_IS:
+				return &EG(uninitialized_zval_ptr);
+				break;
+			case BP_VAR_RW:
+				zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
+				/* break missing intentionally */
+			case BP_VAR_W:
+				Z_ADDREF(EG(uninitialized_zval));
+				if (!EG(active_symbol_table)) {
+					*ptr = (zval**)EG(current_execute_data)->CVs + (EG(active_op_array)->last_var + var);
+					**ptr = &EG(uninitialized_zval);
+				} else {
+					zend_hash_quick_update(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, &EG(uninitialized_zval_ptr), sizeof(zval *), (void **)ptr);
+				}
+				break;
 		}
-		PZVAL_UNLOCK_FREE(str);
-		ptr->refcount=1;
-		ptr->is_ref=1;
-		ptr->type = IS_STRING;
-		return ptr;
 	}
+	return *ptr;
 }
 
-static inline zval *_get_zval_ptr_cv(znode *node, temp_variable *Ts, int type TSRMLS_DC)
+static zend_always_inline zval *_get_zval_ptr_cv(const znode *node, const temp_variable *Ts, int type TSRMLS_DC)
 {
 	zval ***ptr = &CV_OF(node->u.var);
 
-	if (!*ptr) {
-		zend_compiled_variable *cv = &CV_DEF_OF(node->u.var);
-		if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **)ptr)==FAILURE) {
-			switch (type) {
-				case BP_VAR_R:
-				case BP_VAR_UNSET:
-					zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
-					/* break missing intentionally */
-				case BP_VAR_IS:
-					return &EG(uninitialized_zval);
-					break;
-				case BP_VAR_RW:
-					zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
-					/* break missing intentionally */
-				case BP_VAR_W:
-					zend_get_cv_address(cv, ptr, Ts TSRMLS_CC);
-					break;
-			}
-		}
+	if (UNEXPECTED(*ptr == NULL)) {
+		return *_get_zval_cv_lookup(ptr, node->u.var, type TSRMLS_CC);
 	}
 	return **ptr;
 }
 
-static inline zval *_get_zval_ptr(znode *node, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
+static inline zval *_get_zval_ptr(znode *node, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
 {
 /*	should_free->is_var = 0; */
 	switch (node->op_type) {
@@ -255,11 +284,11 @@ static inline zval *_get_zval_ptr(znode *node, temp_variable *Ts, zend_free_op *
 	return NULL;
 }
 
-static inline zval **_get_zval_ptr_ptr_var(znode *node, temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
+static zend_always_inline zval **_get_zval_ptr_ptr_var(const znode *node, const temp_variable *Ts, zend_free_op *should_free TSRMLS_DC)
 {
 	zval** ptr_ptr = T(node->u.var).var.ptr_ptr;
 
-	if (ptr_ptr) {
+	if (EXPECTED(ptr_ptr != NULL)) {
 		PZVAL_UNLOCK(*ptr_ptr, should_free);
 	} else {
 		/* string offset */
@@ -268,34 +297,17 @@ static inline zval **_get_zval_ptr_ptr_var(znode *node, temp_variable *Ts, zend_
 	return ptr_ptr;
 }
 
-static inline zval **_get_zval_ptr_ptr_cv(znode *node, temp_variable *Ts, int type TSRMLS_DC)
+static zend_always_inline zval **_get_zval_ptr_ptr_cv(const znode *node, const temp_variable *Ts, int type TSRMLS_DC)
 {
 	zval ***ptr = &CV_OF(node->u.var);
 
-	if (!*ptr) {
-		zend_compiled_variable *cv = &CV_DEF_OF(node->u.var);
-		if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len+1, cv->hash_value, (void **)ptr)==FAILURE) {
-			switch (type) {
-				case BP_VAR_R:
-				case BP_VAR_UNSET:
-					zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
-					/* break missing intentionally */
-				case BP_VAR_IS:
-					return &EG(uninitialized_zval_ptr);
-					break;
-				case BP_VAR_RW:
-					zend_error(E_NOTICE, "Undefined variable: %s", cv->name);
-					/* break missing intentionally */
-				case BP_VAR_W:
-					zend_get_cv_address(cv, ptr, Ts TSRMLS_CC);
-					break;
-			}
-		}
+	if (UNEXPECTED(*ptr == NULL)) {
+		return _get_zval_cv_lookup(ptr, node->u.var, type TSRMLS_CC);
 	}
 	return *ptr;
 }
 
-static inline zval **_get_zval_ptr_ptr(znode *node, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
+static inline zval **_get_zval_ptr_ptr(const znode *node, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
 {
 	if (node->op_type == IS_CV) {
 		should_free->var = 0;
@@ -308,9 +320,9 @@ static inline zval **_get_zval_ptr_ptr(znode *node, temp_variable *Ts, zend_free
 	}
 }
 
-static inline zval *_get_obj_zval_ptr_unused(TSRMLS_D)
+static zend_always_inline zval *_get_obj_zval_ptr_unused(TSRMLS_D)
 {
-	if (EG(This)) {
+	if (EXPECTED(EG(This) != NULL)) {
 		return EG(This);
 	} else {
 		zend_error_noreturn(E_ERROR, "Using $this when not in object context");
@@ -318,10 +330,10 @@ static inline zval *_get_obj_zval_ptr_unused(TSRMLS_D)
 	}
 }
 
-static inline zval **_get_obj_zval_ptr_ptr(znode *op, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
+static inline zval **_get_obj_zval_ptr_ptr(const znode *op, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
 {
 	if (op->op_type == IS_UNUSED) {
-		if (EG(This)) {
+		if (EXPECTED(EG(This) != NULL)) {
 			/* this should actually never be modified, _ptr_ptr is modified only when
 			   the object is empty */
 			should_free->var = 0;
@@ -333,9 +345,9 @@ static inline zval **_get_obj_zval_ptr_ptr(znode *op, temp_variable *Ts, zend_fr
 	return get_zval_ptr_ptr(op, Ts, should_free, type);
 }
 
-static inline zval **_get_obj_zval_ptr_ptr_unused(TSRMLS_D)
+static zend_always_inline zval **_get_obj_zval_ptr_ptr_unused(TSRMLS_D)
 {
-	if (EG(This)) {
+	if (EXPECTED(EG(This) != NULL)) {
 		return &EG(This);
 	} else {
 		zend_error_noreturn(E_ERROR, "Using $this when not in object context");
@@ -343,10 +355,10 @@ static inline zval **_get_obj_zval_ptr_ptr_unused(TSRMLS_D)
 	}
 }
 
-static inline zval *_get_obj_zval_ptr(znode *op, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
+static inline zval *_get_obj_zval_ptr(znode *op, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC)
 {
 	if (op->op_type == IS_UNUSED) {
-		if (EG(This)) {
+		if (EXPECTED(EG(This) != NULL)) {
 			should_free->var = 0;
 			return EG(This);
 		} else {
@@ -356,77 +368,60 @@ static inline zval *_get_obj_zval_ptr(znode *op, temp_variable *Ts, zend_free_op
 	return get_zval_ptr(op, Ts, should_free, type);
 }
 
-static inline void zend_switch_free(zend_op *opline, temp_variable *Ts TSRMLS_DC)
+static inline void zend_switch_free(temp_variable *T, int extended_value TSRMLS_DC)
 {
-	switch (opline->op1.op_type) {
-		case IS_VAR:
-			if (!T(opline->op1.u.var).var.ptr_ptr) {
-				temp_variable *T = &T(opline->op1.u.var);
-				/* perform the equivalent of equivalent of a
-				 * quick & silent get_zval_ptr, and FREE_OP
-				 */
-				PZVAL_UNLOCK_FREE(T->str_offset.str);
-			} else if (T(opline->op1.u.var).var.ptr) {
-				zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);
-				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) { /* foreach() free */
-					zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);
-				}
-			}
-			break;
-		case IS_TMP_VAR:
-			zendi_zval_dtor(T(opline->op1.u.var).tmp_var);
-			break;
-		EMPTY_SWITCH_DEFAULT_CASE()
+	if (T->var.ptr) {
+		if (extended_value & ZEND_FE_RESET_VARIABLE) { /* foreach() free */
+			Z_DELREF_P(T->var.ptr);
+		}
+		zval_ptr_dtor(&T->var.ptr);
+	} else if (!T->var.ptr_ptr) {
+		/* perform the equivalent of equivalent of a
+		 * quick & silent get_zval_ptr, and FREE_OP
+		 */
+		PZVAL_UNLOCK_FREE(T->str_offset.str);
 	}
 }
 
 static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **value_ptr_ptr TSRMLS_DC)
 {
-	zval *variable_ptr;
-	zval *value_ptr;
-
-	if (!value_ptr_ptr || !variable_ptr_ptr) {
-		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-		return;
-	}
-
-	variable_ptr = *variable_ptr_ptr;
-	value_ptr = *value_ptr_ptr;
+	zval *variable_ptr = *variable_ptr_ptr;
+	zval *value_ptr = *value_ptr_ptr;
 
 	if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) {
 		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
 	} else if (variable_ptr != value_ptr) {
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
-			value_ptr->refcount--;
-			if (value_ptr->refcount>0) {
+			Z_DELREF_P(value_ptr);
+			if (Z_REFCOUNT_P(value_ptr)>0) {
 				ALLOC_ZVAL(*value_ptr_ptr);
 				**value_ptr_ptr = *value_ptr;
 				value_ptr = *value_ptr_ptr;
 				zendi_zval_copy_ctor(*value_ptr);
 			}
-			value_ptr->refcount = 1;
-			value_ptr->is_ref = 1;
+			Z_SET_REFCOUNT_P(value_ptr, 1);
+			Z_SET_ISREF_P(value_ptr);
 		}
 
 		*variable_ptr_ptr = value_ptr;
-		value_ptr->refcount++;
+		Z_ADDREF_P(value_ptr);
 
 		zval_ptr_dtor(&variable_ptr);
-	} else if (!variable_ptr->is_ref) {
+	} else if (!Z_ISREF_P(variable_ptr)) {
 		if (variable_ptr_ptr == value_ptr_ptr) {
 			SEPARATE_ZVAL(variable_ptr_ptr);
 		} else if (variable_ptr==EG(uninitialized_zval_ptr)
-			|| variable_ptr->refcount>2) {
+			|| Z_REFCOUNT_P(variable_ptr)>2) {
 			/* we need to separate */
-			variable_ptr->refcount -= 2;
+			Z_SET_REFCOUNT_P(variable_ptr, Z_REFCOUNT_P(variable_ptr) - 2);
 			ALLOC_ZVAL(*variable_ptr_ptr);
 			**variable_ptr_ptr = *variable_ptr;
 			zval_copy_ctor(*variable_ptr_ptr);
 			*value_ptr_ptr = *variable_ptr_ptr;
-			(*variable_ptr_ptr)->refcount = 2;
+			Z_SET_REFCOUNT_PP(variable_ptr_ptr, 2);
 		}
-		(*variable_ptr_ptr)->is_ref = 1;
+		Z_SET_ISREF_PP(variable_ptr_ptr);
 	}
 }
 
@@ -445,9 +440,9 @@ static inline void make_real_object(zval **object_ptr TSRMLS_DC)
 	}
 }
 
-static inline char * zend_verify_arg_class_kind(zend_arg_info *cur_arg_info, char **class_name, zend_class_entry **pce TSRMLS_DC)
+static inline char * zend_verify_arg_class_kind(const zend_arg_info *cur_arg_info, ulong fetch_type, const char **class_name, zend_class_entry **pce TSRMLS_DC)
 {
-	*pce = zend_fetch_class(cur_arg_info->class_name, cur_arg_info->class_name_len, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD) TSRMLS_CC);
+	*pce = zend_fetch_class(cur_arg_info->class_name, cur_arg_info->class_name_len, (fetch_type | ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD) TSRMLS_CC);
 
 	*class_name = (*pce) ? (*pce)->name: cur_arg_info->class_name;
 	if (*pce && (*pce)->ce_flags & ZEND_ACC_INTERFACE) {
@@ -457,7 +452,7 @@ static inline char * zend_verify_arg_class_kind(zend_arg_info *cur_arg_info, cha
 	}
 }
 
-static inline int zend_verify_arg_error(zend_function *zf, zend_uint arg_num, zend_arg_info *cur_arg_info, char *need_msg, char *need_kind, char *given_msg, char *given_kind TSRMLS_DC)
+static inline int zend_verify_arg_error(const zend_function *zf, zend_uint arg_num, const zend_arg_info *cur_arg_info, const char *need_msg, const char *need_kind, const char *given_msg, char *given_kind TSRMLS_DC)
 {
 	zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
 	char *fname = zf->common.function_name;
@@ -480,7 +475,7 @@ static inline int zend_verify_arg_error(zend_function *zf, zend_uint arg_num, ze
 	return 0;
 }
 
-static inline int zend_verify_arg_type(zend_function *zf, zend_uint arg_num, zval *arg TSRMLS_DC)
+static inline int zend_verify_arg_type(zend_function *zf, zend_uint arg_num, zval *arg, ulong fetch_type TSRMLS_DC)
 {
 	zend_arg_info *cur_arg_info;
 	char *need_msg;
@@ -494,19 +489,19 @@ static inline int zend_verify_arg_type(zend_function *zf, zend_uint arg_num, zva
 	cur_arg_info = &zf->common.arg_info[arg_num-1];
 
 	if (cur_arg_info->class_name) {
-		char *class_name;
+		const char *class_name;
 
 		if (!arg) {
-			need_msg = zend_verify_arg_class_kind(cur_arg_info, &class_name, &ce TSRMLS_CC);
+			need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
 			return zend_verify_arg_error(zf, arg_num, cur_arg_info, need_msg, class_name, "none", "" TSRMLS_CC);
 		}
 		if (Z_TYPE_P(arg) == IS_OBJECT) {
-			need_msg = zend_verify_arg_class_kind(cur_arg_info, &class_name, &ce TSRMLS_CC);
+			need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
 			if (!ce || !instanceof_function(Z_OBJCE_P(arg), ce TSRMLS_CC)) {
 				return zend_verify_arg_error(zf, arg_num, cur_arg_info, need_msg, class_name, "instance of ", Z_OBJCE_P(arg)->name TSRMLS_CC);
 			}
 		} else if (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null) {
-			need_msg = zend_verify_arg_class_kind(cur_arg_info, &class_name, &ce TSRMLS_CC);
+			need_msg = zend_verify_arg_class_kind(cur_arg_info, fetch_type, &class_name, &ce TSRMLS_CC);
 			return zend_verify_arg_error(zf, arg_num, cur_arg_info, need_msg, class_name, zend_zval_type_name(arg), "" TSRMLS_CC);
 		}
 	} else if (cur_arg_info->array_type_hint) {
@@ -520,87 +515,78 @@ static inline int zend_verify_arg_type(zend_function *zf, zend_uint arg_num, zva
 	return 1;
 }
 
+static inline void zend_assign_to_object(znode *result, zval **object_ptr, zval *property_name, znode *value_op, const temp_variable *Ts, int opcode TSRMLS_DC)
 
-static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode *op2, znode *value_op, temp_variable *Ts, int opcode TSRMLS_DC)
 {
 	zval *object;
-	zend_free_op free_op2, free_value;
-	zval *property_name = get_zval_ptr(op2, Ts, &free_op2, BP_VAR_R);
+	zend_free_op free_value;
 	zval *value = get_zval_ptr(value_op, Ts, &free_value, BP_VAR_R);
 	zval **retval = &T(result->u.var).var.ptr;
 
-	if (!object_ptr) {
-		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
-	}
-
-	if (*object_ptr == EG(error_zval_ptr)) {
-		FREE_OP(free_op2);
-		if (!RETURN_VALUE_UNUSED(result)) {
-			*retval = EG(uninitialized_zval_ptr);
-			PZVAL_LOCK(*retval);
+	if (Z_TYPE_P(*object_ptr) != IS_OBJECT) {
+		if (*object_ptr == EG(error_zval_ptr)) {
+			if (!RETURN_VALUE_UNUSED(result)) {
+				*retval = EG(uninitialized_zval_ptr);
+				PZVAL_LOCK(*retval);
+			}
+			FREE_OP(free_value);
+			return;
 		}
-		FREE_OP(free_value);
-		return;
-	}
-
-	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
-	object = *object_ptr;
-
-	if (Z_TYPE_P(object) != IS_OBJECT || (opcode == ZEND_ASSIGN_OBJ && !Z_OBJ_HT_P(object)->write_property)) {
-		zend_error(E_WARNING, "Attempt to assign property of non-object");
-		FREE_OP(free_op2);
-		if (!RETURN_VALUE_UNUSED(result)) {
-			*retval = EG(uninitialized_zval_ptr);
-			PZVAL_LOCK(*retval);
+		if (Z_TYPE_PP(object_ptr) == IS_NULL ||
+		    (Z_TYPE_PP(object_ptr) == IS_BOOL && Z_LVAL_PP(object_ptr) == 0) ||
+		    (Z_TYPE_PP(object_ptr) == IS_STRING && Z_STRLEN_PP(object_ptr) == 0)) {
+			zend_error(E_STRICT, "Creating default object from empty value");
+			SEPARATE_ZVAL_IF_NOT_REF(object_ptr);
+			zval_dtor(*object_ptr);
+			object_init(*object_ptr);
+		} else {
+			zend_error(E_WARNING, "Attempt to assign property of non-object");
+			if (!RETURN_VALUE_UNUSED(result)) {
+				*retval = EG(uninitialized_zval_ptr);
+				PZVAL_LOCK(*retval);
+			}
+			FREE_OP(free_value);
+			return;
 		}
-		FREE_OP(free_value);
-		return;
 	}
 	
 	/* here we are sure we are dealing with an object */
+	object = *object_ptr;
 
 	/* separate our value if necessary */
-	if (EG(ze1_compatibility_mode) && Z_TYPE_P(value) == IS_OBJECT) {
-		zval *orig_value = value;
-		char *class_name;
-		zend_uint class_name_len;
-		int dup;
-		
-		ALLOC_ZVAL(value);
-		*value = *orig_value;
-	 	value->is_ref = 0;
-		value->refcount = 0;
-		dup = zend_get_object_classname(orig_value, &class_name, &class_name_len TSRMLS_CC);
-		if (Z_OBJ_HANDLER_P(value, clone_obj) == NULL) {
-			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s",  class_name);
-		}
-		zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);		
-		value->value.obj = Z_OBJ_HANDLER_P(orig_value, clone_obj)(orig_value TSRMLS_CC);
-		if(!dup)	{
-			efree(class_name);
-		}
-	} else if (value_op->op_type == IS_TMP_VAR) {
+	if (value_op->op_type == IS_TMP_VAR) {
 		zval *orig_value = value;
 
 		ALLOC_ZVAL(value);
 		*value = *orig_value;
-		value->is_ref = 0;
-		value->refcount = 0;
+		Z_UNSET_ISREF_P(value);
+		Z_SET_REFCOUNT_P(value, 0);
 	} else if (value_op->op_type == IS_CONST) {
 		zval *orig_value = value;
 
 		ALLOC_ZVAL(value);
 		*value = *orig_value;
-		value->is_ref = 0;
-		value->refcount = 0;
+		Z_UNSET_ISREF_P(value);
+		Z_SET_REFCOUNT_P(value, 0);
 		zval_copy_ctor(value);
 	}
 
 
-	value->refcount++;
+	Z_ADDREF_P(value);
 	if (opcode == ZEND_ASSIGN_OBJ) {
-		if (IS_TMP_FREE(free_op2)) {
-			MAKE_REAL_ZVAL_PTR(property_name);
+		if (!Z_OBJ_HT_P(object)->write_property) {
+			zend_error(E_WARNING, "Attempt to assign property of non-object");
+			if (!RETURN_VALUE_UNUSED(result)) {
+				*retval = EG(uninitialized_zval_ptr);
+				PZVAL_LOCK(*retval);
+			}
+			if (value_op->op_type == IS_TMP_VAR) {
+				FREE_ZVAL(value);
+			} else if (value_op->op_type == IS_CONST) {
+				zval_ptr_dtor(&value);
+			}
+			FREE_OP(free_value);
+			return;
 		}
 		Z_OBJ_HT_P(object)->write_property(object, property_name, value TSRMLS_CC);
 	} else {
@@ -608,283 +594,148 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
 		if (!Z_OBJ_HT_P(object)->write_dimension) {
 			zend_error_noreturn(E_ERROR, "Cannot use object as array");
 		}
-		if (IS_TMP_FREE(free_op2)) {
-			MAKE_REAL_ZVAL_PTR(property_name);
-		}
 		Z_OBJ_HT_P(object)->write_dimension(object, property_name, value TSRMLS_CC);
 	}
 
-	if (result && !RETURN_VALUE_UNUSED(result) && !EG(exception)) {
-		T(result->u.var).var.ptr = value;
-		T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr; /* this is so that we could use it in FETCH_DIM_R, etc. - see bug #27876 */
+	if (!RETURN_VALUE_UNUSED(result) && !EG(exception)) {
+		AI_SET_PTR(T(result->u.var).var, value);
 		PZVAL_LOCK(value);
 	}
-	if (IS_TMP_FREE(free_op2)) {
-		zval_ptr_dtor(&property_name);
-	} else {
-		FREE_OP(free_op2);
-	}
 	zval_ptr_dtor(&value);
 	FREE_OP_IF_VAR(free_value);
 }
 
-
-static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2, zval *value, int type, temp_variable *Ts TSRMLS_DC)
+static inline int zend_assign_to_string_offset(const temp_variable *T, const zval *value, int value_type TSRMLS_DC)
 {
-	zend_free_op free_op1;
-	zval **variable_ptr_ptr = get_zval_ptr_ptr(op1, Ts, &free_op1, BP_VAR_W);
-	zval *variable_ptr;
-
-	if (!variable_ptr_ptr) {
-		temp_variable *T = &T(op1->u.var);
-
-		if (Z_TYPE_P(T->str_offset.str) == IS_STRING)
-		do {
-			zval tmp;
-			zval *final_value = value;
-
-			if (((int)T->str_offset.offset < 0)) {
-				zend_error(E_WARNING, "Illegal string offset:  %d", T->str_offset.offset);
-				if (!RETURN_VALUE_UNUSED(result)) {
-					T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-					PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
-					AI_USE_PTR(T(result->u.var).var);
-				}
-				FREE_OP_VAR_PTR(free_op1);
-				return;
-			}
-			if (T->str_offset.offset >= Z_STRLEN_P(T->str_offset.str)) {
-				zend_uint i;
+	if (Z_TYPE_P(T->str_offset.str) == IS_STRING) {
 
-				if (Z_STRLEN_P(T->str_offset.str)==0) {
-					STR_FREE(Z_STRVAL_P(T->str_offset.str));
-					Z_STRVAL_P(T->str_offset.str) = (char *) emalloc(T->str_offset.offset+1+1);
-				} else {
-					Z_STRVAL_P(T->str_offset.str) = (char *) erealloc(Z_STRVAL_P(T->str_offset.str), T->str_offset.offset+1+1);
-				}
-				for (i=Z_STRLEN_P(T->str_offset.str); i<T->str_offset.offset; i++) {
-					Z_STRVAL_P(T->str_offset.str)[i] = ' ';
-				}
-				Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset+1] = 0;
-				Z_STRLEN_P(T->str_offset.str) = T->str_offset.offset+1;
-			}
+		if (((int)T->str_offset.offset < 0)) {
+			zend_error(E_WARNING, "Illegal string offset:  %d", T->str_offset.offset);
+			return 0;
+		}
 
-			if (Z_TYPE_P(value)!=IS_STRING) {
-				tmp = *value;
-				if (op2->op_type != IS_TMP_VAR) {
-					zval_copy_ctor(&tmp);
-				}
-				convert_to_string(&tmp);
-				final_value = &tmp;
-			}
+		if (T->str_offset.offset >= Z_STRLEN_P(T->str_offset.str)) {
+			Z_STRVAL_P(T->str_offset.str) = (char *) erealloc(Z_STRVAL_P(T->str_offset.str), T->str_offset.offset+1+1);
+			memset(Z_STRVAL_P(T->str_offset.str) + Z_STRLEN_P(T->str_offset.str),
+			       ' ',
+			       T->str_offset.offset - Z_STRLEN_P(T->str_offset.str));
+			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset+1] = 0;
+			Z_STRLEN_P(T->str_offset.str) = T->str_offset.offset+1;
+		}
 
-			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL_P(final_value)[0];
+		if (Z_TYPE_P(value) != IS_STRING) {
+			zval tmp = *value;
 
-			if (final_value == &tmp) {
-				zval_dtor(final_value);
-			} else if (op2->op_type == IS_TMP_VAR) {
+			if (value_type != IS_TMP_VAR) {
+				zval_copy_ctor(&tmp);
+			}
+			convert_to_string(&tmp);
+			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL(tmp)[0];
+			STR_FREE(Z_STRVAL(tmp));
+		} else {
+			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL_P(value)[0];
+			if (value_type == IS_TMP_VAR) {
 				/* we can safely free final_value here
 				 * because separation is done only
-				 * in case op2->op_type == IS_VAR */
-				STR_FREE(Z_STRVAL_P(final_value));
+				 * in case value_type == IS_VAR */
+				STR_FREE(Z_STRVAL_P(value));
 			}
-			/*
-			 * the value of an assignment to a string offset is undefined
-			T(result->u.var).var = &T->str_offset.str;
-			*/
-		} while (0);
-		/* zval_ptr_dtor(&T->str_offset.str); Nuke this line if it doesn't cause a leak */
-
-		if (!RETURN_VALUE_UNUSED(result)) {
-			T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr;
-			ALLOC_ZVAL(T(result->u.var).var.ptr);
-			INIT_PZVAL(T(result->u.var).var.ptr);
-			ZVAL_STRINGL(T(result->u.var).var.ptr, Z_STRVAL_P(T->str_offset.str)+T->str_offset.offset, 1, 1);
 		}
-		FREE_OP_VAR_PTR(free_op1);
-		return;
+		/*
+		 * the value of an assignment to a string offset is undefined
+		T(result->u.var).var = &T->str_offset.str;
+		*/
 	}
+	return 1;
+}
 
-	variable_ptr = *variable_ptr_ptr;
+static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value, int is_tmp_var TSRMLS_DC)
+{
+	zval *variable_ptr = *variable_ptr_ptr;
+	zval garbage;
 
 	if (variable_ptr == EG(error_zval_ptr)) {
-		if (result && !RETURN_VALUE_UNUSED(result)) {
-			T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-			PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
-			AI_USE_PTR(T(result->u.var).var);
-		}
-		if (type==IS_TMP_VAR) {
+		if (is_tmp_var) {
 			zval_dtor(value);
 		}
-		FREE_OP_VAR_PTR(free_op1);
-		return;
+		return EG(uninitialized_zval_ptr);
 	}
 
 	if (Z_TYPE_P(variable_ptr) == IS_OBJECT && Z_OBJ_HANDLER_P(variable_ptr, set)) {
 		Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr_ptr, value TSRMLS_CC);
-		goto done_setting_var;
+		return variable_ptr;
 	}
 
- 	if (EG(ze1_compatibility_mode) && Z_TYPE_P(value) == IS_OBJECT) {
- 		char *class_name;
- 		zend_uint class_name_len;
- 		int dup;
- 			
- 		dup = zend_get_object_classname(value, &class_name, &class_name_len TSRMLS_CC);
-  
- 		if (Z_OBJ_HANDLER_P(value, clone_obj) == NULL) {
- 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s",  class_name);
- 		} else if (PZVAL_IS_REF(variable_ptr)) {
- 			if (variable_ptr != value) {
- 				zend_uint refcount = variable_ptr->refcount;
- 				zval garbage;
- 
- 				garbage = *variable_ptr;
- 				*variable_ptr = *value;
- 				variable_ptr->refcount = refcount;
- 				variable_ptr->is_ref = 1;
- 				zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);
- 				variable_ptr->value.obj = Z_OBJ_HANDLER_P(value, clone_obj)(value TSRMLS_CC);
- 				zendi_zval_dtor(garbage);
- 			}
- 		} else {
- 			if (variable_ptr != value) {
- 				value->refcount++;
- 				variable_ptr->refcount--;
- 				if (variable_ptr->refcount == 0) {
- 					zendi_zval_dtor(*variable_ptr);
- 				} else {
- 					ALLOC_ZVAL(variable_ptr);
- 					*variable_ptr_ptr = variable_ptr;
- 				}
- 				*variable_ptr = *value;
- 				INIT_PZVAL(variable_ptr);
- 				zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);
- 				variable_ptr->value.obj = Z_OBJ_HANDLER_P(value, clone_obj)(value TSRMLS_CC);
- 				zval_ptr_dtor(&value);
- 			}
- 		}
- 		if (!dup) {
- 			efree(class_name);
- 		}
- 	} else if (PZVAL_IS_REF(variable_ptr)) {
+ 	if (PZVAL_IS_REF(variable_ptr)) {
 		if (variable_ptr!=value) {
-			zend_uint refcount = variable_ptr->refcount;
-			zval garbage;
+			zend_uint refcount = Z_REFCOUNT_P(variable_ptr);
 
 			garbage = *variable_ptr;
 			*variable_ptr = *value;
-			variable_ptr->refcount = refcount;
-			variable_ptr->is_ref = 1;
-			if (type!=IS_TMP_VAR) {
+			Z_SET_REFCOUNT_P(variable_ptr, refcount);
+			Z_SET_ISREF_P(variable_ptr);
+			if (!is_tmp_var) {
 				zendi_zval_copy_ctor(*variable_ptr);
 			}
 			zendi_zval_dtor(garbage);
+			return variable_ptr;
 		}
 	} else {
-		variable_ptr->refcount--;
-		if (variable_ptr->refcount==0) {
-			switch (type) {
-				case IS_CV:
-				case IS_VAR:
-					/* break missing intentionally */
-				case IS_CONST:
-					if (variable_ptr==value) {
-						variable_ptr->refcount++;
-					} else if (PZVAL_IS_REF(value)) {
-						zval tmp;
-
-						tmp = *value;
-						zval_copy_ctor(&tmp);
-						tmp.refcount=1;
-						zendi_zval_dtor(*variable_ptr);
-						*variable_ptr = tmp;
-					} else {
-						value->refcount++;
-						zendi_zval_dtor(*variable_ptr);
-						safe_free_zval_ptr(variable_ptr);
-						*variable_ptr_ptr = value;
-					}
-					break;
-				case IS_TMP_VAR:
-					zendi_zval_dtor(*variable_ptr);
-					value->refcount=1;
+		if (Z_DELREF_P(variable_ptr)==0) {
+			if (!is_tmp_var) {
+				if (variable_ptr==value) {
+					Z_ADDREF_P(variable_ptr);
+				} else if (PZVAL_IS_REF(value)) {
+					garbage = *variable_ptr;
 					*variable_ptr = *value;
-					break;
-					EMPTY_SWITCH_DEFAULT_CASE()
-						}
-		} else { /* we need to split */
-			switch (type) {
-				case IS_CV:
-				case IS_VAR:
-					/* break missing intentionally */
-				case IS_CONST:
-					if (PZVAL_IS_REF(value) && value->refcount > 0) {
-						ALLOC_ZVAL(variable_ptr);
-						*variable_ptr_ptr = variable_ptr;
-						*variable_ptr = *value;
-						zval_copy_ctor(variable_ptr);
-						variable_ptr->refcount=1;
-						break;
+					INIT_PZVAL(variable_ptr);
+					zval_copy_ctor(variable_ptr);
+					zendi_zval_dtor(garbage);
+					return variable_ptr;
+				} else {
+					Z_ADDREF_P(value);
+					*variable_ptr_ptr = value;
+					if (variable_ptr != &EG(uninitialized_zval)) {
+						GC_REMOVE_ZVAL_FROM_BUFFER(variable_ptr);
+						zval_dtor(variable_ptr);
+						efree(variable_ptr);
 					}
+					return value;
+				}
+			} else {
+				garbage = *variable_ptr;
+				*variable_ptr = *value;
+				INIT_PZVAL(variable_ptr);
+				zendi_zval_dtor(garbage);
+				return variable_ptr;
+			}
+		} else { /* we need to split */
+			if (!is_tmp_var) {
+				if (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0) {
+					ALLOC_ZVAL(variable_ptr);
+					*variable_ptr_ptr = variable_ptr;
+					*variable_ptr = *value;
+					zval_copy_ctor(variable_ptr);
+					Z_SET_REFCOUNT_P(variable_ptr, 1);
+				} else {
 					*variable_ptr_ptr = value;
-					value->refcount++;
-					break;
-				case IS_TMP_VAR:
-					ALLOC_ZVAL(*variable_ptr_ptr);
-					value->refcount=1;
-					**variable_ptr_ptr = *value;
-					break;
-					EMPTY_SWITCH_DEFAULT_CASE()
-						}
+					Z_ADDREF_P(value);
+				}
+			} else {
+				ALLOC_ZVAL(*variable_ptr_ptr);
+				Z_SET_REFCOUNT_P(value, 1);
+				**variable_ptr_ptr = *value;
+			}
 		}
-		(*variable_ptr_ptr)->is_ref=0;
+		Z_UNSET_ISREF_PP(variable_ptr_ptr);
 	}
 
-done_setting_var:
-	if (result && !RETURN_VALUE_UNUSED(result)) {
-		T(result->u.var).var.ptr_ptr = variable_ptr_ptr;
-		PZVAL_LOCK(*variable_ptr_ptr);
-		AI_USE_PTR(T(result->u.var).var);
-	}
-	FREE_OP_VAR_PTR(free_op1);
+	return *variable_ptr_ptr;
 }
 
 
-static inline void zend_receive(zval **variable_ptr_ptr, zval *value TSRMLS_DC)
-{
-	zval *variable_ptr = *variable_ptr_ptr;
-
- 	if (EG(ze1_compatibility_mode) && Z_TYPE_P(value) == IS_OBJECT) {
- 		char *class_name;
- 		zend_uint class_name_len;
- 		int dup;
- 
- 		dup = zend_get_object_classname(value, &class_name, &class_name_len TSRMLS_CC);
- 		
-  		if (Z_OBJ_HANDLER_P(value, clone_obj) == NULL) {
- 			zend_error_noreturn(E_ERROR, "Trying to clone an uncloneable object of class %s",  class_name);
- 		} else {
- 			variable_ptr->refcount--;
- 			ALLOC_ZVAL(variable_ptr);
- 			*variable_ptr_ptr = variable_ptr;
- 			*variable_ptr = *value;
- 			INIT_PZVAL(variable_ptr);
- 			zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", class_name);
- 			variable_ptr->value.obj = Z_OBJ_HANDLER_P(value, clone_obj)(value TSRMLS_CC);
- 		}
- 		if (!dup) {
- 			efree(class_name);
- 		}
- 	} else {
- 		variable_ptr->refcount--;
- 		*variable_ptr_ptr = value;
- 		value->refcount++;
- 	}
-}
-
 /* Utility Functions for Extensions */
-static void zend_extension_statement_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
+static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
 {
 	if (extension->statement_handler) {
 		extension->statement_handler(op_array);
@@ -892,7 +743,7 @@ static void zend_extension_statement_handler(zend_extension *extension, zend_op_
 }
 
 
-static void zend_extension_fcall_begin_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
+static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
 {
 	if (extension->fcall_begin_handler) {
 		extension->fcall_begin_handler(op_array);
@@ -900,7 +751,7 @@ static void zend_extension_fcall_begin_handler(zend_extension *extension, zend_o
 }
 
 
-static void zend_extension_fcall_end_handler(zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
+static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC)
 {
 	if (extension->fcall_end_handler) {
 		extension->fcall_end_handler(op_array);
@@ -908,10 +759,13 @@ static void zend_extension_fcall_end_handler(zend_extension *extension, zend_op_
 }
 
 
-static inline HashTable *zend_get_target_symbol_table(zend_op *opline, temp_variable *Ts, int type, zval *variable TSRMLS_DC)
+static inline HashTable *zend_get_target_symbol_table(const zend_op *opline, const temp_variable *Ts, int type, const zval *variable TSRMLS_DC)
 {
 	switch (opline->op2.u.EA.type) {
 		case ZEND_FETCH_LOCAL:
+			if (!EG(active_symbol_table)) {
+				zend_rebuild_symbol_table(TSRMLS_C);
+			}
 			return EG(active_symbol_table);
 			break;
 		case ZEND_FETCH_GLOBAL:
@@ -930,11 +784,12 @@ static inline HashTable *zend_get_target_symbol_table(zend_op *opline, temp_vari
 	return NULL;
 }
 
-static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, zval *dim, int type TSRMLS_DC)
+static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int type TSRMLS_DC)
 {
 	zval **retval;
 	char *offset_key;
 	int offset_key_length;
+	long index;
 
 	switch (dim->type) {
 		case IS_NULL:
@@ -951,154 +806,124 @@ fetch_string_dim:
 			if (zend_symtable_find(ht, offset_key, offset_key_length+1, (void **) &retval) == FAILURE) {
 				switch (type) {
 					case BP_VAR_R:
-						zend_error(E_NOTICE, "Undefined index:  %s", offset_key);
+						zend_error(E_NOTICE, "Undefined index: %s", offset_key);
 						/* break missing intentionally */
 					case BP_VAR_UNSET:
 					case BP_VAR_IS:
 						retval = &EG(uninitialized_zval_ptr);
 						break;
 					case BP_VAR_RW:
-						zend_error(E_NOTICE,"Undefined index:  %s", offset_key);
+						zend_error(E_NOTICE,"Undefined index: %s", offset_key);
 						/* break missing intentionally */
 					case BP_VAR_W: {
 							zval *new_zval = &EG(uninitialized_zval);
 
-							new_zval->refcount++;
+							Z_ADDREF_P(new_zval);
 							zend_symtable_update(ht, offset_key, offset_key_length+1, &new_zval, sizeof(zval *), (void **) &retval);
 						}
 						break;
 				}
 			}
 			break;
+		case IS_DOUBLE: {
+			DVAL_TO_LVAL(Z_DVAL_P(dim), index);
+			goto num_index;
+		}
 		case IS_RESOURCE:
 			zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(dim), Z_LVAL_P(dim));
 			/* Fall Through */
-		case IS_DOUBLE:
 		case IS_BOOL:
-		case IS_LONG: {
-				long index;
-
-				if (Z_TYPE_P(dim) == IS_DOUBLE) {
-					index = (long)Z_DVAL_P(dim);
-				} else {
-					index = Z_LVAL_P(dim);
-				}
-				if (zend_hash_index_find(ht, index, (void **) &retval) == FAILURE) {
-					switch (type) {
-						case BP_VAR_R:
-							zend_error(E_NOTICE,"Undefined offset:  %ld", index);
-							/* break missing intentionally */
-						case BP_VAR_UNSET:
-						case BP_VAR_IS:
-							retval = &EG(uninitialized_zval_ptr);
-							break;
-						case BP_VAR_RW:
-							zend_error(E_NOTICE,"Undefined offset:  %ld", index);
-							/* break missing intentionally */
-						case BP_VAR_W: {
-							zval *new_zval = &EG(uninitialized_zval);
-
-							new_zval->refcount++;
-							zend_hash_index_update(ht, index, &new_zval, sizeof(zval *), (void **) &retval);
-						}
+		case IS_LONG:
+			index = Z_LVAL_P(dim);
+num_index:
+			if (zend_hash_index_find(ht, index, (void **) &retval) == FAILURE) {
+				switch (type) {
+					case BP_VAR_R:
+						zend_error(E_NOTICE,"Undefined offset: %ld", index);
+						/* break missing intentionally */
+					case BP_VAR_UNSET:
+					case BP_VAR_IS:
+						retval = &EG(uninitialized_zval_ptr);
 						break;
+					case BP_VAR_RW:
+						zend_error(E_NOTICE,"Undefined offset: %ld", index);
+						/* break missing intentionally */
+					case BP_VAR_W: {
+						zval *new_zval = &EG(uninitialized_zval);
+
+						Z_ADDREF_P(new_zval);
+						zend_hash_index_update(ht, index, &new_zval, sizeof(zval *), (void **) &retval);
 					}
+					break;
 				}
 			}
 			break;
+
 		default:
 			zend_error(E_WARNING, "Illegal offset type");
-			switch (type) {
-				case BP_VAR_R:
-				case BP_VAR_IS:
-				case BP_VAR_UNSET:
-					retval = &EG(uninitialized_zval_ptr);
-					break;
-				default:
-					retval = &EG(error_zval_ptr);
-					break;
-			}
-			break;
+			return (type == BP_VAR_W || type == BP_VAR_RW) ?
+				&EG(error_zval_ptr) : &EG(uninitialized_zval_ptr);
 	}
 	return retval;
 }
 
 static void zend_fetch_dimension_address(temp_variable *result, zval **container_ptr, zval *dim, int dim_is_tmp_var, int type TSRMLS_DC)
 {
-	zval *container;
-
-	if (!container_ptr) {
-		zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
-	}
-
-	container = *container_ptr;
-
-	if (container == EG(error_zval_ptr)) {
-		if (result) {
-			result->var.ptr_ptr = &EG(error_zval_ptr);
-			PZVAL_LOCK(*result->var.ptr_ptr);
-			if (type == BP_VAR_R || type == BP_VAR_IS) {
-				AI_USE_PTR(result->var);
-			}
-		}
-		return;
-	}
-
-	if (Z_TYPE_P(container)==IS_NULL
-		|| (Z_TYPE_P(container)==IS_BOOL && Z_LVAL_P(container)==0)
-		|| (Z_TYPE_P(container)==IS_STRING && Z_STRLEN_P(container)==0)) {
-		switch (type) {
-			case BP_VAR_RW:
-			case BP_VAR_W:
-				if (!PZVAL_IS_REF(container)) {
-					SEPARATE_ZVAL(container_ptr);
-					container = *container_ptr;
-				}
-				zval_dtor(container);
-				array_init(container);
-				break;
-		}
-	}
+	zval *container = *container_ptr;
+	zval **retval;
 
 	switch (Z_TYPE_P(container)) {
-		zval **retval;
 
 		case IS_ARRAY:
-			if ((type==BP_VAR_W || type==BP_VAR_RW) && container->refcount>1 && !PZVAL_IS_REF(container)) {
+			if (type != BP_VAR_UNSET && Z_REFCOUNT_P(container)>1 && !PZVAL_IS_REF(container)) {
 				SEPARATE_ZVAL(container_ptr);
 				container = *container_ptr;
 			}
+fetch_from_array:
 			if (dim == NULL) {
 				zval *new_zval = &EG(uninitialized_zval);
 
-				new_zval->refcount++;
+				Z_ADDREF_P(new_zval);
 				if (zend_hash_next_index_insert(Z_ARRVAL_P(container), &new_zval, sizeof(zval *), (void **) &retval) == FAILURE) {
 					zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
 					retval = &EG(error_zval_ptr);
-					new_zval->refcount--;
+					Z_DELREF_P(new_zval);
 				}
 			} else {
 				retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, type TSRMLS_CC);
 			}
-			if (result) {
-				result->var.ptr_ptr = retval;
-			  PZVAL_LOCK(*result->var.ptr_ptr);
-			}
+			result->var.ptr_ptr = retval;
+			PZVAL_LOCK(*retval);
+			return;
 			break;
-		case IS_NULL: {
-			/* for read-mode only */
-			if (result) {
+
+		case IS_NULL:
+			if (container == EG(error_zval_ptr)) {
+				result->var.ptr_ptr = &EG(error_zval_ptr);
+				PZVAL_LOCK(EG(error_zval_ptr));
+			} else if (type != BP_VAR_UNSET) {
+convert_to_array:
+				if (!PZVAL_IS_REF(container)) {
+					SEPARATE_ZVAL(container_ptr);
+					container = *container_ptr;
+				}
+				zval_dtor(container);
+				array_init(container);
+				goto fetch_from_array;
+			} else {
+				/* for read-mode only */
 				result->var.ptr_ptr = &EG(uninitialized_zval_ptr);
-				PZVAL_LOCK(*result->var.ptr_ptr);
-			}
-			if (type==BP_VAR_W || type==BP_VAR_RW) {
-				zend_error(E_WARNING, "Cannot use a NULL value as an array");
+				PZVAL_LOCK(EG(uninitialized_zval_ptr));
 			}
+			return;
 			break;
-		}
+
 		case IS_STRING: {
 				zval tmp;
 
+				if (type != BP_VAR_UNSET && Z_STRLEN_P(container)==0) {
+					goto convert_to_array;
+				}
 				if (dim == NULL) {
 					zend_error_noreturn(E_ERROR, "[] operator not supported for strings");
 				}
@@ -1122,29 +947,19 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 					convert_to_long(&tmp);
 					dim = &tmp;
 				}
-				switch (type) {
-					case BP_VAR_R:
-					case BP_VAR_IS:
-					case BP_VAR_UNSET:
-						/* do nothing... */
-						break;
-					default:
-						SEPARATE_ZVAL_IF_NOT_REF(container_ptr);
-						break;
-				}
-				if (result) {
-					container = *container_ptr;
-					result->str_offset.str = container;
-					PZVAL_LOCK(container);
-					result->str_offset.offset = Z_LVAL_P(dim);
-					result->var.ptr_ptr = NULL;
-					if (type == BP_VAR_R || type == BP_VAR_IS) {
-						AI_USE_PTR(result->var);
-					}
+				if (type != BP_VAR_UNSET) {
+					SEPARATE_ZVAL_IF_NOT_REF(container_ptr);
 				}
+				container = *container_ptr;
+				result->str_offset.str = container;
+				PZVAL_LOCK(container);
+				result->str_offset.offset = Z_LVAL_P(dim);
+				result->var.ptr_ptr = NULL;
+				result->var.ptr = NULL;
 				return;
 			}
 			break;
+
 		case IS_OBJECT:
 			if (!Z_OBJ_HT_P(container)->read_dimension) {
 				zend_error_noreturn(E_ERROR, "Cannot use object as array");
@@ -1159,16 +974,15 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 				overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim, type TSRMLS_CC);
 
 				if (overloaded_result) {
-					if (!overloaded_result->is_ref &&
-					    (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
-						if (overloaded_result->refcount > 0) {
+					if (!Z_ISREF_P(overloaded_result)) {
+						if (Z_REFCOUNT_P(overloaded_result) > 0) {
 							zval *tmp = overloaded_result;
 
 							ALLOC_ZVAL(overloaded_result);
 							*overloaded_result = *tmp;
 							zval_copy_ctor(overloaded_result);
-							overloaded_result->is_ref = 0;
-							overloaded_result->refcount = 0;
+							Z_UNSET_ISREF_P(overloaded_result);
+							Z_SET_REFCOUNT_P(overloaded_result, 0);
 						}
 						if (Z_TYPE_P(overloaded_result) != IS_OBJECT) {
 							zend_class_entry *ce = Z_OBJCE_P(container);
@@ -1179,91 +993,165 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 				} else {
 					retval = &EG(error_zval_ptr);
 				}
-				if (result) {
-					result->var.ptr_ptr = retval;
-					AI_USE_PTR(result->var);
-					PZVAL_LOCK(*result->var.ptr_ptr);
-				} else if ((*retval)->refcount == 0) {
-					/* Destroy unused result from offsetGet() magic method */
-					(*retval)->refcount = 1;
-					zval_ptr_dtor(retval);
-				}
+				AI_SET_PTR(result->var, *retval);
+				PZVAL_LOCK(*retval);
 				if (dim_is_tmp_var) {
 					zval_ptr_dtor(&dim);
 				}
-				return;
 			}
+			return;
 			break;
-		default: {
-				switch (type) {
-					case BP_VAR_UNSET:
-						zend_error(E_WARNING, "Cannot unset offset in a non-array variable");
-						/* break missing intentionally */
-					case BP_VAR_R:
-					case BP_VAR_IS:
-						retval = &EG(uninitialized_zval_ptr);
-						break;
-					default:
-						retval = &EG(error_zval_ptr);
-						break;
+
+		case IS_BOOL:
+			if (type != BP_VAR_UNSET && Z_LVAL_P(container)==0) {
+				goto convert_to_array;
+			}
+			/* break missing intentionally */
+
+		default:
+			if (type == BP_VAR_UNSET) {
+				zend_error(E_WARNING, "Cannot unset offset in a non-array variable");
+				AI_SET_PTR(result->var, EG(uninitialized_zval_ptr));
+				PZVAL_LOCK(EG(uninitialized_zval_ptr));
+			} else {
+				zend_error(E_WARNING, "Cannot use a scalar value as an array");
+				result->var.ptr_ptr = &EG(error_zval_ptr);
+				PZVAL_LOCK(EG(error_zval_ptr));
+			}
+			break;
+	}
+}
+
+static void zend_fetch_dimension_address_read(temp_variable *result, zval **container_ptr, zval *dim, int dim_is_tmp_var, int type TSRMLS_DC)
+{
+	zval *container = *container_ptr;
+	zval **retval;
+
+	switch (Z_TYPE_P(container)) {
+
+		case IS_ARRAY:
+			retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, type TSRMLS_CC);
+			if (result) {
+				AI_SET_PTR(result->var, *retval);
+				PZVAL_LOCK(*retval);
+			}
+			return;
+			break;
+
+		case IS_NULL:
+			if (result) {
+				AI_SET_PTR(result->var, EG(uninitialized_zval_ptr));
+				PZVAL_LOCK(EG(uninitialized_zval_ptr));
+			}
+			return;
+			break;
+
+		case IS_STRING: {
+				zval tmp;
+
+				if (Z_TYPE_P(dim) != IS_LONG) {
+					switch(Z_TYPE_P(dim)) {
+						/* case IS_LONG: */
+						case IS_STRING:
+						case IS_DOUBLE:
+						case IS_NULL:
+						case IS_BOOL:
+							/* do nothing */
+							break;
+						default:
+							zend_error(E_WARNING, "Illegal offset type");
+							break;
+					}
+
+					tmp = *dim;
+					zval_copy_ctor(&tmp);
+					convert_to_long(&tmp);
+					dim = &tmp;
 				}
 				if (result) {
-					result->var.ptr_ptr = retval;
-					PZVAL_LOCK(*result->var.ptr_ptr);
+					if (Z_LVAL_P(dim) < 0 || Z_STRLEN_P(container) <= Z_LVAL_P(dim)) {
+						zend_error(E_NOTICE, "Uninitialized string offset: %ld", Z_LVAL_P(dim));
+					}
+					result->str_offset.str = container;
+					PZVAL_LOCK(container);
+					result->str_offset.offset = Z_LVAL_P(dim);
+					result->var.ptr_ptr = NULL;
+					result->var.ptr = NULL;
 				}
-				if (type==BP_VAR_W || type==BP_VAR_RW) {
-					zend_error(E_WARNING, "Cannot use a scalar value as an array");
+				return;
+			}
+			break;
+
+		case IS_OBJECT:
+			if (!Z_OBJ_HT_P(container)->read_dimension) {
+				zend_error_noreturn(E_ERROR, "Cannot use object as array");
+			} else {
+				zval *overloaded_result;
+
+				if (dim_is_tmp_var) {
+					zval *orig = dim;
+					MAKE_REAL_ZVAL_PTR(dim);
+					ZVAL_NULL(orig);
+				}
+				overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim, type TSRMLS_CC);
+
+				if (overloaded_result) {
+					if (result) {
+						AI_SET_PTR(result->var, overloaded_result);
+						PZVAL_LOCK(overloaded_result);
+					} else if (Z_REFCOUNT_P(overloaded_result) == 0) {
+						/* Destroy unused result from offsetGet() magic method */
+						Z_SET_REFCOUNT_P(overloaded_result, 1);
+						zval_ptr_dtor(&overloaded_result);
+					}
+				} else if (result) {
+					AI_SET_PTR(result->var, EG(uninitialized_zval_ptr));
+					PZVAL_LOCK(EG(uninitialized_zval_ptr));
+				}
+				if (dim_is_tmp_var) {
+					zval_ptr_dtor(&dim);
 				}
 			}
+			return;
+			break;
+
+		default:
+			if (result) {
+				AI_SET_PTR(result->var, EG(uninitialized_zval_ptr));
+				PZVAL_LOCK(EG(uninitialized_zval_ptr));
+			}
+			return;
 			break;
-	}
-	if (result && (type == BP_VAR_R || type == BP_VAR_IS)) {
-		AI_USE_PTR(result->var);
 	}
 }
 
 static void zend_fetch_property_address(temp_variable *result, zval **container_ptr, zval *prop_ptr, int type TSRMLS_DC)
 {
-	zval *container;
+	zval *container = *container_ptr;;
 
-	if (!container_ptr) {
-		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
-	}
-
-	container = *container_ptr;
-	if (container == EG(error_zval_ptr)) {
-		if (result) {
+	if (Z_TYPE_P(container) != IS_OBJECT) {
+		if (container == EG(error_zval_ptr)) {
 			result->var.ptr_ptr = &EG(error_zval_ptr);
 			PZVAL_LOCK(*result->var.ptr_ptr);
+			return;
 		}
-		return;
-	}
-	/* this should modify object only if it's empty */
-	if (Z_TYPE_P(container) == IS_NULL
-		|| (Z_TYPE_P(container) == IS_BOOL && Z_LVAL_P(container)==0)
-		|| (Z_TYPE_P(container) == IS_STRING && Z_STRLEN_P(container)==0)) {
-		switch (type) {
-			case BP_VAR_RW:
-			case BP_VAR_W:
-				if (!PZVAL_IS_REF(container)) {
-					SEPARATE_ZVAL(container_ptr);
-					container = *container_ptr;
-				}
-				object_init(container);
-				break;
-		}
-	}
 
-	if (Z_TYPE_P(container) != IS_OBJECT) {
-		if (result) {
-			if (type == BP_VAR_R || type == BP_VAR_IS) {
-				result->var.ptr_ptr = &EG(uninitialized_zval_ptr);
-			} else {
-				result->var.ptr_ptr = &EG(error_zval_ptr);
+		/* this should modify object only if it's empty */
+		if (type != BP_VAR_UNSET &&
+		    ((Z_TYPE_P(container) == IS_NULL ||
+		     (Z_TYPE_P(container) == IS_BOOL && Z_LVAL_P(container)==0) ||
+		     (Z_TYPE_P(container) == IS_STRING && Z_STRLEN_P(container)==0)))) {
+			if (!PZVAL_IS_REF(container)) {
+				SEPARATE_ZVAL(container_ptr);
+				container = *container_ptr;
 			}
-			PZVAL_LOCK(*result->var.ptr_ptr);
+			object_init(container);
+		} else {
+			zend_error(E_WARNING, "Attempt to modify property of non-object");
+			result->var.ptr_ptr = &EG(error_zval_ptr);
+			PZVAL_LOCK(EG(error_zval_ptr));
+			return;
 		}
-		return;
 	}
 
 	if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) {
@@ -1273,34 +1161,28 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 
 			if (Z_OBJ_HT_P(container)->read_property &&
 				(ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC)) != NULL) {
-				if (result) {
-					result->var.ptr = ptr;
-					result->var.ptr_ptr = &result->var.ptr;
-				}
+				AI_SET_PTR(result->var, ptr);
+				PZVAL_LOCK(ptr);
 			} else {
-				zend_error(E_ERROR, "Cannot access undefined property for object with overloaded property access");
+				zend_error_noreturn(E_ERROR, "Cannot access undefined property for object with overloaded property access");
 			}
-		} else if (result) {
+		} else {
 			result->var.ptr_ptr = ptr_ptr;
+			PZVAL_LOCK(*ptr_ptr);
 		}
 	} else if (Z_OBJ_HT_P(container)->read_property) {
-		if (result) {
-			result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC);
-			result->var.ptr_ptr = &result->var.ptr;
-		}
+		zval *ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC);
+
+		AI_SET_PTR(result->var, ptr);
+		PZVAL_LOCK(ptr);
 	} else {
 		zend_error(E_WARNING, "This object doesn't support property references");
-		if (result) {
-			result->var.ptr_ptr = &EG(error_zval_ptr);
-		}
-	}
-
-	if (result) {
-		PZVAL_LOCK(*result->var.ptr_ptr);
+		result->var.ptr_ptr = &EG(error_zval_ptr);
+		PZVAL_LOCK(EG(error_zval_ptr));
 	}
 }
 
-static inline zend_brk_cont_element* zend_brk_cont(zval *nest_levels_zval, int array_offset, zend_op_array *op_array, temp_variable *Ts TSRMLS_DC)
+static inline zend_brk_cont_element* zend_brk_cont(const zval *nest_levels_zval, int array_offset, const zend_op_array *op_array, const temp_variable *Ts TSRMLS_DC)
 {
 	zval tmp;
 	int nest_levels, original_nest_levels;
@@ -1325,10 +1207,14 @@ static inline zend_brk_cont_element* zend_brk_cont(zval *nest_levels_zval, int a
 
 			switch (brk_opline->opcode) {
 				case ZEND_SWITCH_FREE:
-					zend_switch_free(brk_opline, Ts TSRMLS_CC);
+					if (brk_opline->op1.u.EA.type != EXT_TYPE_FREE_ON_RETURN) {
+						zend_switch_free(&T(brk_opline->op1.u.var), brk_opline->extended_value TSRMLS_CC);
+					}
 					break;
 				case ZEND_FREE:
-					zendi_zval_dtor(T(brk_opline->op1.u.var).tmp_var);
+					if (brk_opline->op1.u.EA.type != EXT_TYPE_FREE_ON_RETURN) {
+						zendi_zval_dtor(T(brk_opline->op1.u.var).tmp_var);
+					}
 					break;
 			}
 		}
@@ -1383,31 +1269,18 @@ ZEND_API void execute_internal(zend_execute_data *execute_data_ptr, int return_v
 	EX(opline) = new_op
 
 #define ZEND_VM_JMP(new_op) \
-     CHECK_SYMBOL_TABLES() \
- 	   EX(opline) = EG(exception)?EX(opline)+1:new_op; \
-     ZEND_VM_CONTINUE()
+	CHECK_SYMBOL_TABLES() \
+	if (EXPECTED(!EG(exception))) { \
+		EX(opline) = new_op; \
+	} \
+	ZEND_VM_CONTINUE()
 
 #define ZEND_VM_INC_OPCODE() \
-	if (!EG(exception)) { \
-		CHECK_SYMBOL_TABLES() \
-		EX(opline)++; \
-	}
-
-#define ZEND_VM_RETURN_FROM_EXECUTE_LOOP() \
-	free_alloca(EX(CVs)); \
-	if (EX(op_array)->T < TEMP_VAR_STACK_LIMIT) { \
-		free_alloca(EX(Ts)); \
-	} else { \
-		efree(EX(Ts)); \
-	} \
-	EG(in_execution) = EX(original_in_execution); \
-	EG(current_execute_data) = EX(prev_execute_data); \
-	EG(opline_ptr) = NULL; \
-	ZEND_VM_RETURN()
+	EX(opline)++
 
 #include "zend_vm_execute.h"
 
-ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, opcode_handler_t handler)
+ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
 {
 	if (opcode != ZEND_USER_OPCODE) {
 		zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
@@ -1417,16 +1290,16 @@ ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, opcode_handler_t ha
 	return FAILURE;
 }
 
-ZEND_API opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
+ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
 {
 	return zend_user_opcode_handlers[opcode];
 }
 
-ZEND_API zval *zend_get_zval_ptr(znode *node, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC) {
+ZEND_API zval *zend_get_zval_ptr(znode *node, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC) {
 	return get_zval_ptr(node, Ts, should_free, type);
 }
 
-ZEND_API zval **zend_get_zval_ptr_ptr(znode *node, temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC) {
+ZEND_API zval **zend_get_zval_ptr_ptr(const znode *node, const temp_variable *Ts, zend_free_op *should_free, int type TSRMLS_DC) {
 	return get_zval_ptr_ptr(node, Ts, should_free, type);
 }