Defer user error handlers to a VM safepoint to prevent mid-opcode reentry

Zend/tests/ArrayAccess/bug41209.phpt

@@ -42,5 +42,6 @@ echo "Done\n";
 Fatal error: Uncaught ErrorException: Undefined variable $id in %s:%d
 Stack trace:
 #0 %s(%d): env::errorHandler(2, 'Undefined varia...', '%s', %d)
-#1 {main}
+#1 %s(%d): cache->offsetExists(NULL)
+#2 {main}
   thrown in %s on line %d

Zend/tests/bitwise_not_precision_exception.phpt

@@ -12,4 +12,5 @@ try {
 }
 ?>
 --EXPECT--
+int(-1)
 The float INF is not representable as an int, cast occurred

Zend/tests/bug63206.phpt

@@ -22,8 +22,10 @@ set_error_handler(function() {
 $triggerNotice1++;
 $triggerNotice2++;
 ?>
---EXPECT--
+--EXPECTF--
 Second handler
-Internal handler
+
+Warning: Undefined variable $triggerInternalNotice in %s on line %d
 Second handler
-Internal handler
+
+Warning: Undefined variable $triggerInternalNotice in %s on line %d

Zend/tests/bug70662.phpt

@@ -14,5 +14,5 @@ var_dump($a);
 --EXPECT--
 array(1) {
   ["b"]=>
-  int(2)
+  int(1)
 }

Zend/tests/bug70785.phpt

@@ -7,19 +7,32 @@ set_error_handler(function($no, $msg) {
     throw new Exception($msg);
 });
 
-try {
+function smart_branch() {
     if ($a === null) { // ZEND_VM_SMART_BRANCH
-        undefined_function('Null');
+        return 'branch';
     }
-} catch (Exception $e) {
+    return 'no branch';
 }
 
-try  {
+function next_opcode() {
     $c === 3; // ZEND_VM_NEXT_OPCODE
-    undefined_function();
+    return 'done';
+}
+
+try {
+    smart_branch();
 } catch (Exception $e) {
+    echo $e->getMessage(), PHP_EOL;
 }
+
+try {
+    next_opcode();
+} catch (Exception $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+echo "okey\n";
 ?>
-okey
 --EXPECT--
+Undefined variable $a
+Undefined variable $c
 okey

Zend/tests/bug72101.phpt

@@ -79,9 +79,10 @@ $foo->bar($a, $b, $c);
 Fatal error: Uncaught Error: Class "DoesNotExists" not found in %s:%d
 Stack trace:
 #0 %s(%d): {closure:%s:%d}(2, 'MethodCallbackB...', '%s', 8)
-#1 %sbug72101.php(%d): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#2 %sbug72101.php(%d): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#3 %sbug72101.php(%d): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#4 %sbug72101.php(%d): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
-#5 {main}
+#1 %sbug72101.php(%d): MethodCallbackByReference->callback(0, 0, 0)
+#2 %sbug72101.php(%d): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(%d): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#4 %sbug72101.php(%d): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#5 %sbug72101.php(%d): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
+#6 {main}
   thrown in %sbug72101.php on line %d

Zend/tests/bug76534.phpt

@@ -10,8 +10,12 @@ $x = "foo";
 $y = &$x["2bar"];
 ?>
 --EXPECTF--
-Fatal error: Uncaught Exception: Illegal string offset "2bar" in %s:%d
+Fatal error: Uncaught Error: Cannot create references to/from string offsets in %s:%d
+Stack trace:
+#0 {main}
+
+Next Exception: Illegal string offset "2bar" in %s:%d
 Stack trace:
 #0 %s(%d): {closure:%s:%d}(2, 'Illegal string ...', '%s', 7)
 #1 {main}
-  thrown in %sbug76534.php on line %d
+  thrown in %s on line %d

Zend/tests/bug78598.phpt

@@ -25,7 +25,31 @@ var_dump($my_var);
 
 ?>
 --EXPECT--
-int(0)
-int(0)
-int(0)
-int(0)
+array(1) {
+  [0]=>
+  string(3) "xyz"
+}
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    array(1) {
+      [0]=>
+      string(3) "xyz"
+    }
+  }
+}
+array(1) {
+  ["foo"]=>
+  string(3) "xyz"
+}
+array(1) {
+  ["foo"]=>
+  array(1) {
+    ["bar"]=>
+    array(1) {
+      ["baz"]=>
+      string(3) "xyz"
+    }
+  }
+}

Zend/tests/bug79784.phpt

@@ -15,6 +15,18 @@ var_dump($a);
 
 ?>
 --EXPECT--
-NULL
-NULL
-NULL
+array(1) {
+  [""]=>
+  string(1) "x"
+}
+array(1) {
+  [""]=>
+  string(1) "x"
+}
+array(1) {
+  [""]=>
+  array(1) {
+    [""]=>
+    string(1) "x"
+  }
+}

Zend/tests/bug79793.phpt

@@ -18,15 +18,15 @@ var_dump($ary);
 
 ?>
 --EXPECT--
-Undefined array key "foobar"
 array(1) {
   ["foobar"]=>
   int(1)
 }
-Undefined array key "foobarbaz"
+Undefined array key "foobar"
 array(2) {
   ["foobar"]=>
   int(1)
   ["foobarbaz"]=>
   int(1)
 }
+Undefined array key "foobarbaz"

Zend/tests/closures/closure_031.phpt

@@ -15,5 +15,5 @@ try {
 }
 ?>
 --EXPECT--
-Warning: Undefined property: Closure::$a
 NULL
+Warning: Undefined property: Closure::$a

Zend/tests/compound_assign_failure.phpt

@@ -22,14 +22,16 @@ try {
 
 set_error_handler(function($type, $msg) { throw new Exception($msg); });
 
+function concat(&$a, $b) { $a .= $b; }
+
 try {
     $a = [];
-    $a .= "foo";
+    concat($a, "foo");
 } catch (Throwable $e) { var_dump($a); }
 
 try {
     $a = "foo";
-    $a .= [];
+    concat($a, []);
 } catch (Throwable $e) { var_dump($a); }
 
 $x = new stdClass;
@@ -202,9 +204,8 @@ var_dump($x);
 int(1)
 int(1)
 int(1)
-array(0) {
-}
-string(3) "foo"
+string(8) "Arrayfoo"
+string(8) "fooArray"
 object(stdClass)#%d (0) {
 }
 int(1)

Zend/tests/concat/bug81705.phpt

@@ -15,5 +15,5 @@ $my_var .= $GLOBALS["arr"];
 var_dump($my_var);
 ?>
 --EXPECT--
-error
-string(6) "aArray"
+string(6) "aArray"
+error

Zend/tests/dynamic_prop_deprecation_002.phpt

@@ -15,4 +15,3 @@ try {
 ?>
 --EXPECT--
 Err: Creation of dynamic property class@anonymous::$y is deprecated
-Exception: Cannot create dynamic property class@anonymous::$y

Zend/tests/exception_in_nested_rope.phpt

@@ -15,4 +15,9 @@ try {
 ?>
 --EXPECTF--
 Deprecated: Using ${expr} (variable variables) in strings is deprecated, use {${expr}} instead in %s on line %d
-Exception
+
+Fatal error: Uncaught Exception in %s:%d
+Stack trace:
+#0 %s(%d): {closure:%s:%d}(2, 'Undefined varia...', '%s', %d)
+#1 {main}
+  thrown in %s on line %d

Zend/tests/exception_in_rope_end.phpt

@@ -13,5 +13,9 @@ try {
 }
 
 ?>
---EXPECT--
-Exception
+--EXPECTF--
+Fatal error: Uncaught Exception in %s:%d
+Stack trace:
+#0 %s(%d): {closure:%s:%d}(2, 'Undefined varia...', '%s', %d)
+#1 {main}
+  thrown in %s on line %d

Zend/tests/exceptions/exception_before_fatal.phpt

@@ -61,4 +61,4 @@ string(23) "Undefined variable $foo"
 string(23) "Undefined variable $foo"
 string(23) "Undefined variable $foo"
 string(23) "Undefined variable $foo"
-string(23) "Undefined variable $foo"
+string(23) "Undefined variable $foo"

Zend/tests/falsetoarray_002.phpt

@@ -11,5 +11,13 @@ $a[0][$d]='b';
 var_dump($a);
 ?>
 --EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [""]=>
+    string(1) "b"
+  }
+}
 Err: Automatic conversion of false to array is deprecated
-string(0) ""
+Err: Undefined variable $d
+Err: Using null as an array offset is deprecated, use an empty string instead

Zend/tests/falsetoarray_003.phpt

@@ -11,6 +11,6 @@ $a=[];
 ?>
 DONE
 --EXPECTF--
+DONE
 Err: The float %f is not representable as an int, cast occurred
 Err: Undefined array key %i
-DONE

Zend/tests/first_class_callable/constexpr/error_static_call_trait_method_002.phpt

@@ -28,4 +28,13 @@ try {
 
 ?>
 --EXPECT--
+object(Closure)#2 (2) {
+  ["function"]=>
+  string(13) "Foo::myMethod"
+  ["parameter"]=>
+  array(1) {
+    ["$foo"]=>
+    string(10) "<required>"
+  }
+}
 Caught: Calling static trait method Foo::myMethod is deprecated, it should only be called on a class using the trait

Zend/tests/get_class_basic.phpt

@@ -54,6 +54,7 @@ $f1->testNull();
 echo "Done\n";
 ?>
 --EXPECTF--
+string(3) "foo"
 Calling get_class() without arguments is deprecated
 
 Deprecated: Calling get_class() without arguments is deprecated in %s on line %d

Zend/tests/gh16792.phpt

@@ -0,0 +1,16 @@
+--TEST--
+GH-16792 (Assertion failure when an error handler mutates $GLOBALS during a by-ref sort)
+--FILE--
+<?php
+set_error_handler(function() {
+    $GLOBALS['x'] = $GLOBALS['y'];
+});
+function x(&$s) {
+    $s[0] = 1;
+}
+x($y);
+arsort($y, $fusion);
+echo "ok\n";
+?>
+--EXPECT--
+ok

Zend/tests/gh17416.phpt

@@ -0,0 +1,30 @@
+--TEST--
+GH-17416 (Assertion failure when a throwing error handler runs while an array is unset during foreach)
+--FILE--
+<?php
+function Error2Exception($errno, $errstr, $errfile, $errline) {
+    throw new Exception($errstr, $errno);
+}
+set_error_handler('Error2Exception');
+function bar(array &$a): ?bool {
+    foreach ($a as $key => $val) {
+        if ($val === 2) {
+            unset($a[$fusion]);
+        }
+    }
+}
+function foo($a, bool $b): bool {
+    do {
+        $res = bar($a);
+    } while ($res === null && $n !== $n2);
+}
+foo([2, 'a' => 5], false);
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: Undefined variable $fusion in %s:%d
+Stack trace:
+#0 %s(%d): Error2Exception(2, 'Undefined varia...', '%s', %d)
+#1 %s(%d): bar(Array)
+#2 %s(%d): foo(Array, false)
+#3 {main}
+  thrown in %s on line %d

Zend/tests/gh21245.phpt

@@ -0,0 +1,21 @@
+--TEST--
+GH-21245 (Use-after-free in ASSIGN_DIM when the error handler grows the array holding a typed-property reference)
+--FILE--
+<?php
+class Test {
+    public string $x;
+}
+$a = [];
+set_error_handler(function() use (&$a) {
+    $a['b'] = 2;
+});
+$test = new Test;
+$test->x = "";
+$a[0] =& $test->x;
+var_dump($a[0] = $v);
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot assign null to reference held by property Test::$x of type string in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/gh22419.phpt

@@ -0,0 +1,19 @@
+--TEST--
+GH-22419 (UAF/refcount assertion in array-offset concat when the error handler replaces the LHS)
+--FILE--
+<?php
+for ($i = 0; $i < 2; $i++) {
+    $a = [[1], [2]];
+    set_error_handler(function() use (&$a) {
+        $a = "changed";
+    });
+    try {
+        $a[1] .= 1234;
+    } catch (Throwable $e) {
+    }
+    restore_error_handler();
+}
+echo "ok\n";
+?>
+--EXPECT--
+ok