php · marcosmarcolin · Dec 16, 2022 · Dec 17, 2022 · Dec 19, 2022 · Dec 20, 2022
diff --git a/NEWS b/NEWS
@@ -98,6 +98,8 @@ PHP                                                                        NEWS
     ACK delays. (David Carlier)
   . Added DONTFRAGMENT support for path MTU discovery purpose. (David Carlier)
   . Added AF_DIVERT for raw socket for divert ports. (David Carlier)
+  . Added SOL_UPDLITE, UDPLITE_RECV_CSCOV and UDPLITE_SEND_CSCOV for updlite
+    protocol support. (David Carlier)
 
 - Standard:
   . E_NOTICEs emitted by unserialize() have been promoted to E_WARNING. (timwolla)

diff --git a/UPGRADING b/UPGRADING
@@ -141,6 +141,9 @@ PHP 8.3 UPGRADE NOTES
   . IP_PMTUDISC_INTERFACE (Linux only).
   . IP_PMTUDISC_OMIT (Linux only).
   . AF_DIVERT (FreeBSD only).
+  . SOL_UDPLITE.
+  . UDPLITE_RECV_CSCOV.
+  . UDPLITE_SEND_CSCOV.
 
 ========================================
 11. Changes to INI File Handling

@@ -2569,12 +2569,26 @@ static zend_always_inline zend_result _zend_update_type_info(
 				} else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
 					/* The return value must also satisfy the property type */
 					if (prop_info) {
-						tmp &= zend_fetch_prop_type(script, prop_info, NULL);
+						t1 = zend_fetch_prop_type(script, prop_info, NULL);
+						if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
+						 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
+							/* DOUBLE may be auto-converted to LONG */
+							tmp |= MAY_BE_LONG;
+							tmp &= ~MAY_BE_DOUBLE;
+						}
+						tmp &= t1;
 					}
 				} else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
 					/* The return value must also satisfy the property type */
 					if (prop_info) {
-						tmp &= zend_fetch_prop_type(script, prop_info, NULL);
+						t1 = zend_fetch_prop_type(script, prop_info, NULL);
+						if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
+						 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
+							/* DOUBLE may be auto-converted to LONG */
+							tmp |= MAY_BE_LONG;
+							tmp &= ~MAY_BE_DOUBLE;
+						}
+						tmp &= t1;
 					}
 				} else {
 					if (tmp & MAY_BE_REF) {

diff --git a/Zend/tests/036.phpt b/Zend/tests/036.phpt
@@ -11,4 +11,4 @@ try {
 
 ?>
 --EXPECT--
-Illegal offset type
+Cannot access offset of type object on array
diff --git a/Zend/tests/038.phpt b/Zend/tests/038.phpt
@@ -11,4 +11,4 @@ try {
 
 ?>
 --EXPECT--
-Illegal offset type
+Cannot access offset of type object on array
diff --git a/Zend/tests/assign_dim_obj_null_return.phpt b/Zend/tests/assign_dim_obj_null_return.phpt
@@ -72,12 +72,12 @@ test();
 ?>
 --EXPECT--
 Cannot add element to the array as the next element is already occupied
-Illegal offset type
-Illegal offset type
+Cannot access offset of type array on array
+Cannot access offset of type object on array
 Cannot use a scalar value as an array
 Cannot add element to the array as the next element is already occupied
-Illegal offset type
-Illegal offset type
+Cannot access offset of type array on array
+Cannot access offset of type object on array
 Cannot use a scalar value as an array
 Attempt to assign property "foo" on true
 Attempt to assign property "foo" on true
diff --git a/Zend/tests/bug79790.phpt b/Zend/tests/bug79790.phpt
@@ -8,7 +8,7 @@ function b($a = array()[array ()]) {
 }
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Illegal offset type in %s:%d
+Fatal error: Uncaught TypeError: Cannot access offset of type array on array in %s:%d
 Stack trace:
 #0 %s(%d): b()
 #1 {main}

diff --git a/Zend/tests/bug79947.phpt b/Zend/tests/bug79947.phpt
@@ -12,6 +12,6 @@ try {
 var_dump($array);
 ?>
 --EXPECT--
-Illegal offset type
+Cannot access offset of type array on array
 array(0) {
 }
diff --git a/Zend/tests/bug80781.phpt b/Zend/tests/bug80781.phpt
@@ -25,7 +25,7 @@ if (isset($array[$data]) or getPlugin($data)) {
 
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Illegal offset type in isset or empty in %s:%d
+Fatal error: Uncaught TypeError: Cannot access offset of type array in isset or empty in %s:%d
 Stack trace:
 #0 {main}
   thrown in %s on line %d
diff --git a/Zend/tests/constant_expressions_invalid_offset_type_error.phpt b/Zend/tests/constant_expressions_invalid_offset_type_error.phpt
@@ -8,7 +8,7 @@ const C2 = [C1, [] => 1];
 
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Illegal offset type in %s:%d
+Fatal error: Uncaught TypeError: Cannot access offset of type array on array in %s:%d
 Stack trace:
 #0 {main}
   thrown in %s on line %d
diff --git a/Zend/tests/fibers/get-return-after-bailout.phpt b/Zend/tests/fibers/get-return-after-bailout.phpt
@@ -1,5 +1,12 @@
 --TEST--
 Fiber::getReturn() after bailout
+--SKIPIF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+?>
 --FILE--
 <?php
 

diff --git a/Zend/tests/fibers/gh10437.phpt b/Zend/tests/fibers/gh10437.phpt
@@ -0,0 +1,18 @@
+--TEST--
+GH-10437 (Segfault/assertion when using fibers in shutdown function after bailout)
+--FILE--
+<?php
+
+register_shutdown_function(function (): void {
+    var_dump(Fiber::getCurrent());
+});
+
+$fiber = new Fiber(function (): never {
+    trigger_error('Bailout in fiber', E_USER_ERROR);
+});
+$fiber->start();
+
+?>
+--EXPECTF--
+Fatal error: Bailout in fiber in %sgh10437.php on line %d
+NULL
diff --git a/Zend/tests/generators/gh9801.phpt b/Zend/tests/generators/gh9801.phpt
@@ -2,6 +2,13 @@
 Bug GH-9801 (Crash when memory limit is exceeded during generator initialization)
 --INI--
 memory_limit=16m
+--SKIPIF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+?>
 --FILE--
 <?php
 

diff --git a/Zend/tests/gh9916-012.phpt b/Zend/tests/gh9916-012.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug GH-9916 012 (Entering shutdown sequence with a fiber suspended in a Generator emits an unavoidable fatal error or crashes)
+--FILE--
+<?php
+
+$gen = (function() {
+    yield from (function() { yield; })();
+})();
+$fiber = new Fiber(function() use ($gen) {
+    $gen->current();
+});
+$fiber->start();
+
+?>
+==DONE==
+--EXPECT--
+==DONE==
diff --git a/Zend/tests/illegal_offset_unset_isset_empty.phpt b/Zend/tests/illegal_offset_unset_isset_empty.phpt
@@ -22,6 +22,6 @@ try {
 
 ?>
 --EXPECT--
-Illegal offset type in unset
-Illegal offset type in isset or empty
-Illegal offset type in isset or empty
+Cannot access offset of type array on unset
+Cannot access offset of type array in isset or empty
+Cannot access offset of type array in isset or empty
diff --git a/Zend/tests/init_array_illegal_offset_type.phpt b/Zend/tests/init_array_illegal_offset_type.phpt
@@ -12,4 +12,4 @@ try {
 }
 ?>
 --EXPECT--
-Illegal offset type
+Cannot access offset of type object on array
diff --git a/Zend/tests/isset_array.phpt b/Zend/tests/isset_array.phpt
@@ -46,5 +46,5 @@ bool(false)
 
 Warning: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
 bool(false)
-Illegal offset type in isset or empty
-Illegal offset type in isset or empty
+Cannot access offset of type array in isset or empty
+Cannot access offset of type object in isset or empty
diff --git a/Zend/tests/offset_array.phpt b/Zend/tests/offset_array.phpt
@@ -30,6 +30,14 @@ try {
     echo $e->getMessage(), "\n";
 }
 
+try{
+    $k = [];
+    $arr = ['foo'];
+    $arr[$k];
+}catch (Error $e){
+    echo $e->getMessage(), "\n";
+}
+
 echo "Done\n";
 ?>
 --EXPECTF--
@@ -48,6 +56,7 @@ int(1)
 
 Warning: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
 int(%d)
-Illegal offset type
-Illegal offset type
+Cannot access offset of type object on array
+Cannot access offset of type array on array
+Cannot access offset of type array on array
 Done
@@ -2046,6 +2046,21 @@ ZEND_API zend_result add_next_index_reference(zval *arg, zend_reference *ref) /*
 }
 /* }}} */
 
+void zend_illegal_empty_or_isset_offset(const zval *offset)
+{
+	zend_type_error("Cannot access offset of type %s in isset or empty", zend_get_type_by_const(Z_TYPE_P(offset)));
+}
+
+void zend_illegal_unset_offset(const zval *offset)
+{
+	zend_type_error("Cannot access offset of type %s on unset", zend_get_type_by_const(Z_TYPE_P(offset)));
+}
+
+void zend_illegal_array_offset(const zval *offset)
+{
+	zend_type_error("Cannot access offset of type %s on array", zend_get_type_by_const(Z_TYPE_P(offset)));
+}
+
 ZEND_API zend_result array_set_zval_key(HashTable *ht, zval *key, zval *value) /* {{{ */
 {
 	zval *result;

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
@@ -8752,6 +8752,7 @@ static bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 				default:
 					zend_error_noreturn(E_COMPILE_ERROR, "Illegal offset type");
 					break;
+
 			}
 		} else if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), value)) {
 			zval_ptr_dtor_nogc(value);

@@ -1455,11 +1455,6 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_object_as_array(v
 	zend_throw_error(NULL, "Cannot use object as array");
 }
 
-static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_offset(void)
-{
-	zend_type_error("Illegal offset type");
-}
-
 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_string_offset(const zval *offset)
 {
 	zend_type_error("Cannot access offset of type %s on string", zend_zval_type_name(offset));
@@ -2329,7 +2324,7 @@ static zend_never_inline zend_uchar slow_index_convert(HashTable *ht, const zval
 			value->lval = 1;
 			return IS_LONG;
 		default:
-			zend_illegal_offset();
+			zend_illegal_array_offset(dim);
 			return IS_NULL;
 	}
 }
@@ -2403,7 +2398,7 @@ static zend_never_inline zend_uchar slow_index_convert_w(HashTable *ht, const zv
 			value->lval = 1;
 			return IS_LONG;
 		default:
-			zend_illegal_offset();
+			zend_illegal_array_offset(dim);
 			return IS_NULL;
 	}
 }
@@ -2985,7 +2980,7 @@ static zend_never_inline bool ZEND_FASTCALL zend_array_key_exists_fast(HashTable
 		str = ZSTR_EMPTY_ALLOC();
 		goto str_key;
 	} else {
-		zend_illegal_offset();
+		zend_illegal_array_offset(key);
 		return 0;
 	}
 }

diff --git a/Zend/zend_fibers.c b/Zend/zend_fibers.c
@@ -645,6 +645,7 @@ static zend_always_inline zend_fiber_transfer zend_fiber_switch_to(
 
 	/* Forward bailout into current fiber. */
 	if (UNEXPECTED(transfer.flags & ZEND_FIBER_TRANSFER_FLAG_BAILOUT)) {
+		EG(active_fiber) = NULL;
 		zend_bailout();
 	}
 

diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
@@ -223,6 +223,14 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	uint32_t op_num, try_catch_offset;
 	int i;
 
+	/* Generator is running in a suspended fiber.
+	 * Will be dtor during fiber dtor */
+	if (zend_generator_get_current(generator)->flags & ZEND_GENERATOR_IN_FIBER) {
+		/* Prevent finally blocks from yielding */
+		generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
+		return;
+	}
+
 	/* leave yield from mode to properly allow finally execution */
 	if (UNEXPECTED(Z_TYPE(generator->values) != IS_UNDEF)) {
 		zval_ptr_dtor(&generator->values);

@@ -6055,7 +6055,7 @@ ZEND_VM_C_LABEL(num_index):
 			str = ZSTR_EMPTY_ALLOC();
 			ZEND_VM_C_GOTO(str_index);
 		} else {
-			zend_illegal_offset();
+			zend_illegal_array_offset(offset);
 			zval_ptr_dtor_nogc(expr_ptr);
 		}
 		FREE_OP2();
@@ -6571,7 +6571,7 @@ ZEND_VM_C_LABEL(num_index_dim):
 				key = ZSTR_EMPTY_ALLOC();
 				ZEND_VM_C_GOTO(str_index_dim);
 			} else {
-				zend_type_error("Illegal offset type in unset");
+				zend_illegal_unset_offset(offset);
 			}
 			break;
 		} else if (Z_ISREF_P(container)) {