[POC] Support calling global functions from constant expressions

NEWS

@@ -10,7 +10,7 @@ PHP                                                                        NEWS
     (Nikita)
   . Fixed bug #49555 (Fatal error "Function must be a string" message should be
     renamed). (Nikita)
-  . Fixed bug #70839 (Convertion optional argument to variadic forbidden by LSP
+  . Fixed bug #70839 (Converting optional argument to variadic forbidden by LSP
     checks). (Nikita)
 
 - CURL:
@@ -19,7 +19,7 @@ PHP                                                                        NEWS
 - Date:
   . Fixed bug #65547 (Default value for sunrise/sunset zenith still wrong).
     (cmb)
-  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
+  . Fixed bug #69044 (discrepancy between time and microtime). (krakjoe)
 
 - DOM:
   . Add property DOMXPath::$registerNodeNamespaces and constructor argument
@@ -57,7 +57,7 @@ PHP                                                                        NEWS
   . Fixed #60594 (mysqlnd exposes 160 lines of stats in phpinfo). (PeeHaa)
 
 - OpCache:
-  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with 
+  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with
     non-ascii characters). (mhagstrand)
 
 - PCRE:
@@ -79,8 +79,10 @@ PHP                                                                        NEWS
   . Fixed bug #77805 (phpdbg build fails when readline is shared). (krakjoe)
 
 - Reflection:
-  . Fixed bug #78697 (ReflectionClass::implementsInterface - inaccurate error 
+  . Fixed bug #78697 (ReflectionClass::implementsInterface - inaccurate error
     message with traits). (villfa)
+  . Implement ReflectionProperty::hasDefaultValue and
+    Reflection::getDefaultValue (beberlei)
 
 - Session:
   . Fixed bug #78624 (session_gc return value for user defined session
@@ -113,10 +115,13 @@ PHP                                                                        NEWS
   . Fixed bug #76874 (xml_parser_free() should never leak memory). (Nikita)
 
 - XMLWriter:
-  . Changed functions to accept/return XMKWriter objects instead of resources.
+  . Changed functions to accept/return XMLWriter objects instead of resources.
     (cmb)
 
 - Zip:
   . Fixed bug #72374 (remove_path strips first char of filename). (tyage)
+  . Add ZipArchive::setMtimeName and ZipArchive::setMtimeIndex methods. (Remi)
+  . Add ZipArchive::setProgressCallback method (since libzip 1.3.0). (Remi)
+  . Add ZipArchive::setCancelCallback method (since libzip 1.6.0). (Remi)
 
 <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>>

UPGRADING

@@ -217,8 +217,8 @@ PHP 8.0 UPGRADE NOTES
   . A non-string pattern argument to mb_ereg_replace() will now be interpreted
     as a string instead of an ASCII codepoint. The previous behavior may be
     restored with an explicit call to chr().
-  . The needle argument for mb_strpos(), mb_strrpos(), mb_stripos(), mb_strripos(), mb_strstr() and mb_stristr()
-    can now be empty.
+  . The needle argument for mb_strpos(), mb_strrpos(), mb_stripos(), mb_strripos(),
+    mb_strstr(), mb_stristr(), mb_strrchr() and mb_strrichr() can now be empty.
   . The $is_hex parameter, which was not used internally, has been removed from
     mb_decode_numericentity().
   . The legacy behaviour of passing the encoding as the third argument instead of an offset for the mb_strrpos
@@ -286,7 +286,8 @@ PHP 8.0 UPGRADE NOTES
     string. Previously non-string needles were interpreted as an ASCII code
     point. An explicit call to chr() can be used to restore the previous
     behavior.
-  . The needle argument for strpos(), strrpos(), stripos(), strripos(), strstr() and stristr() can now be empty.
+  . The needle argument for strpos(), strrpos(), stripos(), strripos(), strstr(),
+    stristr() and strrchr() can now be empty.
   . The length argument for substr(), substr_count(), substr_compare(), and
     iconv_substr() can now be null. Null values will behave as if no length
     argument was provided and will therefore return the remainder of the string
@@ -351,7 +352,7 @@ PHP 8.0 UPGRADE NOTES
   . Added WeakMap.
     RFC: https://wiki.php.net/rfc/weak_maps
   . Added ValueError class.
-  . Any number of function parameters may not be replaced by a variadic
+  . Any number of function parameters may now be replaced by a variadic
     argument, as long as the types are compatible. For example, the following
     code is now allowed:
 

Zend/Makefile.frag

@@ -13,7 +13,7 @@ $(srcdir)/zend_language_parser.c: $(srcdir)/zend_language_parser.y
 # Tweak zendparse to be exported through ZEND_API. This has to be revisited once
 # bison supports foreign skeletons and that bison version is used. Read
 # https://git.savannah.gnu.org/cgit/bison.git/tree/data/README.md for more.
-	@$(YACC) -p zend -v -d $(srcdir)/zend_language_parser.y -o $@
+	@$(YACC) $(YFLAGS) -v -d $(srcdir)/zend_language_parser.y -o $@
 	@$(SED) -e 's,^int zendparse\(.*\),ZEND_API int zendparse\1,g' < $@ \
 	> [email protected] && \
 	mv [email protected] $@
@@ -27,7 +27,7 @@ $(srcdir)/zend_language_parser.c: $(srcdir)/zend_language_parser.y
 
 $(srcdir)/zend_ini_parser.h: $(srcdir)/zend_ini_parser.c
 $(srcdir)/zend_ini_parser.c: $(srcdir)/zend_ini_parser.y
-	@$(YACC) -p ini_ -v -d $(srcdir)/zend_ini_parser.y -o $@
+	$(YACC) $(YFLAGS) -v -d $(srcdir)/zend_ini_parser.y -o $@
 
 $(srcdir)/zend_ini_scanner.c: $(srcdir)/zend_ini_scanner.l
 	@(cd $(top_srcdir); $(RE2C) $(RE2C_FLAGS) --no-generation-date --case-inverted -cbdFt Zend/zend_ini_scanner_defs.h -oZend/zend_ini_scanner.c Zend/zend_ini_scanner.l)

Zend/tests/bug52361.phpt

@@ -25,9 +25,8 @@ try {
 --EXPECTF--
 1. Exception: aaa in %sbug52361.php:5
 Stack trace:
-#0 %sbug52361.php(13): aaa->__destruct()
-#1 %sbug52361.php(16): bbb()
-#2 {main}
+#0 %sbug52361.php(16): aaa->__destruct()
+#1 {main}
 2. Exception: bbb in %sbug52361.php:13
 Stack trace:
 #0 %sbug52361.php(16): bbb()

Zend/tests/bug76047.phpt

@@ -0,0 +1,68 @@
+--TEST--
+Bug #76047: Use-after-free when accessing already destructed backtrace arguments
+--FILE--
+<?php
+
+class Vuln {
+    public $a;
+    public function __destruct() {
+        unset($this->a);
+        $backtrace = (new Exception)->getTrace();
+        var_dump($backtrace);
+    }
+}
+
+function test($arg) {
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+function test2($arg) {
+    $$arg = 1; // Trigger symbol table
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+test('x');
+test2('x');
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}

Zend/tests/bug78973.phpt

@@ -16,4 +16,3 @@ test(new class {
 ?>
 --EXPECTF--
 #0  class@anonymous->__destruct() called at [%s:%d]
-#1  test() called at [%s:%d]

Zend/tests/call_in_const/class_const01.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Can call internal functions from class constants
+--FILE--
+<?php
+class Example {
+    const X = sprintf("Hello, %s\n", "World");
+
+    public static function main() {
+        echo "X is " . self::X . "\n";
+    }
+}
+Example::main();
+?>
+--EXPECT--
+X is Hello, World

Zend/tests/call_in_const/class_const02.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Can call internal functions from class constants
+--FILE--
+<?php
+function normalize_keys(array $x) {
+    // Should only invoke normalize_keys once
+    echo "Normalizing the keys\n";
+    $result = [];
+    foreach ($x as $k => $value) {
+        $result["prefix_$k"] = $value;
+    }
+    return $result;
+}
+class Example {
+    const X = [
+        'key1' => 'value1',
+        'key2' => 'value2',
+    ];
+    const Y = array_flip(self::X);
+    const Z = normalize_keys(self::Y);
+}
+var_export(Example::Z);
+var_export(Example::Z);
+var_export(Example::Y);
+?>
+--EXPECT--
+Normalizing the keys
+array (
+  'prefix_value1' => 'key1',
+  'prefix_value2' => 'key2',
+)array (
+  'prefix_value1' => 'key1',
+  'prefix_value2' => 'key2',
+)array (
+  'value1' => 'key1',
+  'value2' => 'key2',
+)

Zend/tests/call_in_const/global_const01.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Can call internal functions from global constants
+--FILE--
+<?php
+const NIL = var_export(null, true);
+
+echo "NIL is " . NIL . "\n";
+?>
+--EXPECT--
+NIL is NULL

Zend/tests/call_in_const/global_const02.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Cannot declare constants with function calls that contain objects
+--FILE--
+<?php
+function make_object_array() {
+    return [new stdClass()];
+}
+const OBJECT_VALUES = make_object_array();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Calls in constants may only evaluate to scalar values, arrays or resources in %s:5
+Stack trace:
+#0 {main}
+  thrown in %s on line 5

Zend/tests/call_in_const/param_defaults.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Can call internal functions from parameter default
+--FILE--
+<?php
+function evaluated_user_function() {
+    // NOTE: PHP only caches non-refcounted values in the RECV_INIT value,
+    // meaning that if the returned value is dynamic, this will get called every time.
+    // TODO: Would it be worth it to convert refcounted values to immutable values?
+    echo "Evaluating default\n";
+    return sprintf("%s default", "Dynamic");
+}
+function test_default($x = evaluated_user_function()) {
+    echo "x is $x\n";
+}
+test_default();
+test_default(2);
+test_default();
+?>
+--EXPECT--
+Evaluating default
+x is Dynamic default
+x is 2
+Evaluating default
+x is Dynamic default

Zend/tests/call_in_const/param_ref.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Warn when calling function expecting a reference as an argument
+--INI--
+error_reporting=E_ALL
+--FILE--
+<?php
+class Example {
+    const VALUES = [];
+    const IS_MATCH = preg_match('/test/', 'testing');
+    const IS_MATCH_V2 = preg_match('/test/', 'testing', self::VALUES);
+
+    public static function main() {
+        echo "X is " . self::X . "\n";
+    }
+}
+var_dump(Example::IS_MATCH);
+var_dump(Example::IS_MATCH_V2);
+var_dump(Example::VALUES);
+--EXPECTF--
+int(1)
+
+Warning: Parameter 3 to preg_match() expected to be a reference, value given in %s on line 12
+int(1)
+array(0) {
+}

Zend/tests/call_in_const/property_default01.phpt

@@ -0,0 +1,36 @@
+--TEST--
+Can call user-defined functions from defaults of static properties
+--FILE--
+<?php
+namespace NS;
+
+function log_call($arg) {
+    echo "log_call(" . var_export($arg, true) . ")\n";
+    return $arg;
+}
+
+class MyClass {
+    public static $DEBUG = log_call(true);
+    public static $DEBUG2 = namespace\log_call(range(1,2));
+}
+echo "Start\n";
+var_export(MyClass::$DEBUG); echo "\n";
+var_export(MyClass::$DEBUG2); echo "\n";
+var_export(MyClass::$DEBUG); echo "\n";
+MyClass::$DEBUG = "New value";
+echo MyClass::$DEBUG . "\n";
+?>
+--EXPECT--
+Start
+log_call(true)
+log_call(array (
+  0 => 1,
+  1 => 2,
+))
+true
+array (
+  0 => 1,
+  1 => 2,
+)
+true
+New value

Zend/tests/call_in_const/recursion.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Recursion in calls in class constants causes an error
+--FILE--
+<?php
+function x_plus_1() {
+    echo "Computing X + 1\n";
+    return Recursion::X + 1;
+}
+class Recursion {
+    const X = x_plus_1();
+    const MISSING = MISSING_GLOBAL + 1;
+}
+try {
+    echo "Recursion::X=" . Recursion::X . "\n";
+} catch (Error $e) {
+    printf("Caught %s: %s\n", get_class($e), $e->getMessage());
+}
+try {
+    echo "Recursion::X=" . Recursion::X . "\n";
+} catch (Error $e) {
+    printf("Second call caught %s: %s\n", get_class($e), $e->getMessage());
+}
+try {
+    echo "Recursion::MISSING=" . Recursion::MISSING;
+} catch (Error $e) {
+    printf("Caught %s: %s\n", get_class($e), $e->getMessage());
+}
+try {
+    echo "Recursion::MISSING=" . Recursion::MISSING;
+} catch (Error $e) {
+    printf("Second call caught %s: %s\n", get_class($e), $e->getMessage());
+}
+?>
+--EXPECT--
+Computing X + 1
+Caught Error: Unrecoverable error calling x_plus_1() in recursive constant definition
+Computing X + 1
+Second call caught Error: Unrecoverable error calling x_plus_1() in recursive constant definition
+Caught Error: Undefined constant 'MISSING_GLOBAL'
+Second call caught Error: Undefined constant 'MISSING_GLOBAL'