From e26afd5a0438ded8383e7566c39233c86f6f6afb Mon Sep 17 00:00:00 2001
From: David Walker <dave@mudsite.com>
Date: Thu, 2 Nov 2017 15:26:31 -0600
Subject: [PATCH 1/5] New Attempt to resolve Bug:37676

Rebased on master.  Simplified changes to zend_execute.c.
Ensure warnings for both AST, and execution lookups.
Updated existing tests for this new change.
Add a better breakdown of bug-tests.
---
 Zend/tests/assign_to_var_003.phpt             |   3 +-
 Zend/tests/bug37676/1.phpt                    |  33 +++++++
 Zend/tests/bug37676/10.phpt                   |   9 ++
 Zend/tests/bug37676/11.phpt                   |  13 +++
 Zend/tests/bug37676/2.phpt                    |  27 ++++++
 Zend/tests/bug37676/3.phpt                    |  21 +++++
 Zend/tests/bug37676/4.phpt                    |  32 +++++++
 Zend/tests/bug37676/5.phpt                    |  19 ++++
 Zend/tests/bug37676/6.phpt                    |  16 ++++
 Zend/tests/bug37676/7.phpt                    |   9 ++
 Zend/tests/bug37676/8.phpt                    |  23 +++++
 Zend/tests/bug37676/9.phpt                    |  82 ++++++++++++++++++
 Zend/tests/bug39304.phpt                      |   4 +
 Zend/tests/call_user_func_007.phpt            |   2 +
 Zend/tests/dereference_002.phpt               |   2 +
 Zend/tests/dereference_010.phpt               |   3 +
 Zend/tests/dereference_014.phpt               |   4 +
 Zend/tests/foreach_list_002.phpt              |   4 +
 Zend/tests/list_003.phpt                      |  11 ++-
 Zend/tests/list_005.phpt                      |  11 +++
 Zend/tests/list_006.phpt                      |   4 +
 Zend/tests/offset_bool.phpt                   |  19 +++-
 Zend/tests/offset_long.phpt                   |  19 +++-
 Zend/tests/offset_null.phpt                   |  19 +++-
 Zend/zend_ast.c                               |   7 +-
 Zend/zend_compile.c                           |   8 +-
 Zend/zend_compile.h                           |   3 +-
 Zend/zend_execute.c                           |  28 ++++--
 ext/simplexml/tests/017.phpt                  |  12 ++-
 ext/standard/tests/array/bug31158.phpt        |   2 +
 ext/standard/tests/array/each.phpt            | Bin 9688 -> 9852 bytes
 ext/standard/tests/strings/bug72663.phpt      |   4 +-
 tests/lang/031.phpt                           |  24 +++++
 tests/lang/each_binary_safety.phpt            |   4 +
 .../lang/engine_assignExecutionOrder_002.phpt |   4 +
 35 files changed, 463 insertions(+), 22 deletions(-)
 create mode 100644 Zend/tests/bug37676/1.phpt
 create mode 100644 Zend/tests/bug37676/10.phpt
 create mode 100644 Zend/tests/bug37676/11.phpt
 create mode 100644 Zend/tests/bug37676/2.phpt
 create mode 100644 Zend/tests/bug37676/3.phpt
 create mode 100644 Zend/tests/bug37676/4.phpt
 create mode 100644 Zend/tests/bug37676/5.phpt
 create mode 100644 Zend/tests/bug37676/6.phpt
 create mode 100644 Zend/tests/bug37676/7.phpt
 create mode 100644 Zend/tests/bug37676/8.phpt
 create mode 100644 Zend/tests/bug37676/9.phpt

diff --git a/Zend/tests/assign_to_var_003.phpt b/Zend/tests/assign_to_var_003.phpt
index 1fcd41a7f125b..e44a1e0c981ab 100644
--- a/Zend/tests/assign_to_var_003.phpt
+++ b/Zend/tests/assign_to_var_003.phpt
@@ -12,7 +12,8 @@ var_dump($var1);
 
 echo "Done\n";
 ?>
---EXPECT--	
+--EXPECTF--
+Warning: Variable of type float does not accept array offsets in %s on line %d
 NULL
 NULL
 Done
diff --git a/Zend/tests/bug37676/1.phpt b/Zend/tests/bug37676/1.phpt
new file mode 100644
index 0000000000000..7f0ed63f2665c
--- /dev/null
+++ b/Zend/tests/bug37676/1.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #37676 (Simple warnings)
+--FILE--
+<?php
+$a = false;
+$a[0];
+@$a[0];
+isset($a[0]);
+
+$a = 1;
+$a[0];
+@$a[0];
+isset($a[0]);
+
+$a = null;
+$a[0];
+@$a[0];
+isset($a[0]);
+
+$a = 1;
+$b = 2;
+$a[0] + $b[0];
+?>
+--EXPECTF--
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/10.phpt b/Zend/tests/bug37676/10.phpt
new file mode 100644
index 0000000000000..45d9b7904e096
--- /dev/null
+++ b/Zend/tests/bug37676/10.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #37676 (Coalesce non-warning)
+--FILE--
+<?php
+$a = false;
+var_dump($a[0][1] ?? 42); // Coalesce is fetched as an isset, which suppresses warnings.
+?>
+--EXPECTF--
+int(42)
diff --git a/Zend/tests/bug37676/11.phpt b/Zend/tests/bug37676/11.phpt
new file mode 100644
index 0000000000000..550b4ee593346
--- /dev/null
+++ b/Zend/tests/bug37676/11.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #37676 (AST Const Access)
+--FILE--
+<?php
+var_dump(null[0][1]);
+var_dump(true[0][1]);
+?>
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+NULL
diff --git a/Zend/tests/bug37676/2.phpt b/Zend/tests/bug37676/2.phpt
new file mode 100644
index 0000000000000..bbe61ec8399ef
--- /dev/null
+++ b/Zend/tests/bug37676/2.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #37676 (Chained warnings)
+--FILE--
+<?php
+$a = false;
+$a[0][1][2];
+
+$a = 1;
+$a[0][1][2];
+
+$a = null;
+$a[0][1][2];
+
+$a = 1;
+$b = 2;
+$a[0][1][2] + $b[0][1][2];
+?>
+--EXPECTF--
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/3.phpt b/Zend/tests/bug37676/3.phpt
new file mode 100644
index 0000000000000..1d72bf2bc6892
--- /dev/null
+++ b/Zend/tests/bug37676/3.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #37676 (Argument warnings)
+--FILE--
+<?php
+function f ($a) {}
+
+$a = false;
+f($a[0][1][2]);
+
+$a = 1;
+f($a[0][1][2]);
+
+$a = null;
+f($a[0][1][2]);
+?>
+--EXPECTF--
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/4.phpt b/Zend/tests/bug37676/4.phpt
new file mode 100644
index 0000000000000..03e086170246a
--- /dev/null
+++ b/Zend/tests/bug37676/4.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #37676 (List and Loop warnings)
+--FILE--
+<?php
+$a = array('one', 'two', 3);
+
+$a[0][1]; // Valid
+
+$a[2][0]; // Integer Error
+
+list($j, $k, list($l)) = $a; // Integer Error
+
+while (list($k, $v) = each($a)) { // each dep, boolean err
+    var_dump($k, $v);
+}
+?>
+--EXPECTF--
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Deprecated: The each() function is deprecated. This message will be suppressed on further calls in %s on line %d
+int(0)
+string(3) "one"
+int(1)
+string(3) "two"
+int(2)
+int(3)
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/5.phpt b/Zend/tests/bug37676/5.phpt
new file mode 100644
index 0000000000000..3e14274991c8f
--- /dev/null
+++ b/Zend/tests/bug37676/5.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #37676 (Function warnings)
+--FILE--
+<?php
+function foo() {
+    return null;
+}
+
+function foo_array() {
+    return [null];
+}
+
+foo()[0];
+foo()[0][1];
+?>
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/6.phpt b/Zend/tests/bug37676/6.phpt
new file mode 100644
index 0000000000000..ffdc0a6c6fc81
--- /dev/null
+++ b/Zend/tests/bug37676/6.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #37676 (Complex warnings)
+--FILE--
+<?php
+$a = [0 => null];
+$b = [1 => 0];
+$c = [2 => 1];
+$d = [3 => $b];
+
+$a[$b[$c[2]]][0];
+$a[$d[3][1]][$b[1]];
+?>
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/7.phpt b/Zend/tests/bug37676/7.phpt
new file mode 100644
index 0000000000000..a998ea0c546b6
--- /dev/null
+++ b/Zend/tests/bug37676/7.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #37676 (Constant warnings)
+--FILE--
+<?php
+const FOO = null;
+const BAR = FOO[0][1];
+?>
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/8.phpt b/Zend/tests/bug37676/8.phpt
new file mode 100644
index 0000000000000..d6c20a29ba8fa
--- /dev/null
+++ b/Zend/tests/bug37676/8.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #37676 (Object warnings)
+--FILE--
+<?php
+class FooArray implements ArrayAccess {
+    private $s = [];
+    function __construct(array $a) { $this->s = $a; }
+    function offsetSet ($k, $v) { $this->s[$k] = $v; }
+    function &offsetGet ($k) { return $this->s[$k]; }
+    function offsetExists ($k) { return isset($this->s[$k]); }
+    function offsetUnset ($k) { unset($this->s[$k]); }
+}
+
+$a = [1, 2, 3];
+$fa = new FooArray($a);
+
+$fa[0][1];
+$fa[4][1];
+?>
+--EXPECTF--
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/9.phpt b/Zend/tests/bug37676/9.phpt
new file mode 100644
index 0000000000000..55a2ae478d373
--- /dev/null
+++ b/Zend/tests/bug37676/9.phpt
@@ -0,0 +1,82 @@
+--TEST--
+Bug #37676 (Reference warnings)
+--FILE--
+<?php
+$int=5;
+$bool=true;
+$null=null;
+$float=5.1;
+
+$index_v=5;
+$index_r=6;
+
+$null_v = $null[$index_v];
+$null_r =& $null[$index_r];
+var_dump($null, $null_v, $null_r);
+
+$int_v = $int[$index_v];
+$int_r =& $int[$index_r];
+var_dump($int, $int_v, $int_r);
+
+$bool_v = $bool[$index_v];
+$bool_r =& $bool[$index_r];
+var_dump($bool, $bool_v, $bool_r);
+
+$float_v = $float[$index_v];
+$float_r =& $float[$index_r];
+var_dump($float, $float_v, $float_r);
+
+$null2 = null;
+$null2_v = $null2[1][2][3];
+$null2_r =& $null2[1][2][3];
+var_dump($null2, $null2_v, $null2_r);
+?>
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+array(1) {
+  [6]=>
+  &NULL
+}
+NULL
+NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+
+Notice: Undefined variable: int_r in %s on line %d
+int(5)
+NULL
+NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+
+Notice: Undefined variable: bool_r in %s on line %d
+bool(true)
+NULL
+NULL
+
+Warning: Variable of type float does not accept array offsets in %s on line %d
+
+Warning: Cannot use a scalar value as an array in %s on line %d
+
+Notice: Undefined variable: float_r in %s on line %d
+float(5.1)
+NULL
+NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
+array(1) {
+  [1]=>
+  array(1) {
+    [2]=>
+    array(1) {
+      [3]=>
+      &NULL
+    }
+  }
+}
+NULL
+NULL
diff --git a/Zend/tests/bug39304.phpt b/Zend/tests/bug39304.phpt
index 77da1a8bb8e48..6066011f2f46a 100644
--- a/Zend/tests/bug39304.phpt
+++ b/Zend/tests/bug39304.phpt
@@ -8,5 +8,9 @@ Bug #39304 (Segmentation fault with list unpacking of string offset)
 ?>
 --EXPECTF--
 Notice: Uninitialized string offset: 0 in %sbug39304.php on line %d
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
 NULL
 NULL
diff --git a/Zend/tests/call_user_func_007.phpt b/Zend/tests/call_user_func_007.phpt
index f73f14b1ff245..0072b20f830bb 100644
--- a/Zend/tests/call_user_func_007.phpt
+++ b/Zend/tests/call_user_func_007.phpt
@@ -13,6 +13,8 @@ var_dump($a);
 --EXPECTF--
 Notice: Undefined offset: 0 in %s on line %d
 
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
 Warning: Parameter 1 to foo() expected to be a reference, value given in %s on line %d
 array(0) {
 }
diff --git a/Zend/tests/dereference_002.phpt b/Zend/tests/dereference_002.phpt
index d16e1bb483037..373003c1638c7 100644
--- a/Zend/tests/dereference_002.phpt
+++ b/Zend/tests/dereference_002.phpt
@@ -69,6 +69,8 @@ array(2) {
   int(5)
 }
 int(1)
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
 
 Notice: Undefined offset: 4 in %s on line %d
diff --git a/Zend/tests/dereference_010.phpt b/Zend/tests/dereference_010.phpt
index 981fe3116082e..e6bf9ce8c8048 100644
--- a/Zend/tests/dereference_010.phpt
+++ b/Zend/tests/dereference_010.phpt
@@ -21,7 +21,10 @@ var_dump(b()[1]);
 
 ?>
 --EXPECTF--
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
 
 Fatal error: Uncaught Error: Cannot use object of type stdClass as array in %s:%d
diff --git a/Zend/tests/dereference_014.phpt b/Zend/tests/dereference_014.phpt
index 859ac9334805c..e3500d7002b13 100644
--- a/Zend/tests/dereference_014.phpt
+++ b/Zend/tests/dereference_014.phpt
@@ -27,8 +27,12 @@ var_dump($h);
 
 ?>
 --EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
 Notice: Trying to get property 'a' of non-object in %s on line %d
 NULL
 
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
 Notice: Trying to get property 'b' of non-object in %s on line %d
 NULL
diff --git a/Zend/tests/foreach_list_002.phpt b/Zend/tests/foreach_list_002.phpt
index 0ec1aac2c16f5..aa20e5005ad94 100644
--- a/Zend/tests/foreach_list_002.phpt
+++ b/Zend/tests/foreach_list_002.phpt
@@ -18,5 +18,9 @@ foreach($array as list(, $a)) {
 int(1)
 int(3)
 string(1) "b"
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
 NULL
diff --git a/Zend/tests/list_003.phpt b/Zend/tests/list_003.phpt
index 4a509f6a828b4..2cf412dd2f931 100644
--- a/Zend/tests/list_003.phpt
+++ b/Zend/tests/list_003.phpt
@@ -16,7 +16,16 @@ list($e) = print '';
 var_dump($a, $b, $c, $d, $e);
 
 ?>
---EXPECT--
+--EXPECTF--
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type float does not accept array offsets in %s on line %d
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
 NULL
 NULL
diff --git a/Zend/tests/list_005.phpt b/Zend/tests/list_005.phpt
index 7dc3bf6fa36a6..20b91b1cd5d66 100644
--- a/Zend/tests/list_005.phpt
+++ b/Zend/tests/list_005.phpt
@@ -35,10 +35,21 @@ var_dump($a, $b, $c);
 
 ?>
 --EXPECTF--
+Warning: Variable of type string does not accept array offsets in %s on line %d
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
+
+Warning: Variable of type string does not accept array offsets in %s on line %d
 NULL
 NULL
 NULL
 ----
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
 NULL
 NULL
diff --git a/Zend/tests/list_006.phpt b/Zend/tests/list_006.phpt
index d380235d257a0..54a71a5c27ae6 100644
--- a/Zend/tests/list_006.phpt
+++ b/Zend/tests/list_006.phpt
@@ -10,3 +10,7 @@ list($a, list($b, list(list($d)))) = array();
 Notice: Undefined offset: 0 in %s on line %d
 
 Notice: Undefined offset: 1 in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/offset_bool.phpt b/Zend/tests/offset_bool.phpt
index f9bfeeac3e5df..63f4e115d665a 100644
--- a/Zend/tests/offset_bool.phpt
+++ b/Zend/tests/offset_bool.phpt
@@ -24,14 +24,31 @@ var_dump($bool[$arr]);
 
 echo "Done\n";
 ?>
---EXPECT--	
+--EXPECTF--	
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 NULL
 Done
diff --git a/Zend/tests/offset_long.phpt b/Zend/tests/offset_long.phpt
index 41fedb55053af..91e25391c006e 100644
--- a/Zend/tests/offset_long.phpt
+++ b/Zend/tests/offset_long.phpt
@@ -24,14 +24,31 @@ var_dump($long[$arr]);
 
 echo "Done\n";
 ?>
---EXPECT--	
+--EXPECTF--	
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 NULL
 Done
diff --git a/Zend/tests/offset_null.phpt b/Zend/tests/offset_null.phpt
index cd98db40e72c4..ddd503d2469a6 100644
--- a/Zend/tests/offset_null.phpt
+++ b/Zend/tests/offset_null.phpt
@@ -24,14 +24,31 @@ var_dump($null[$arr]);
 
 echo "Done\n";
 ?>
---EXPECT--	
+--EXPECTF--	
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
 Done
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index ff1fd1b7447e4..1ed85b150afd2 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -650,8 +650,11 @@ ZEND_API int ZEND_FASTCALL zend_ast_evaluate(zval *result, zend_ast *ast, zend_c
 				zval_ptr_dtor_nogc(&op1);
 				ret = FAILURE;
 			} else {
-				zend_fetch_dimension_const(result, &op1, &op2, (ast->attr == ZEND_DIM_IS) ? BP_VAR_IS : BP_VAR_R);
-
+				if (!Z_ISERROR(op1)) {
+					zend_fetch_dimension_const(result, &op1, &op2, (ast->attr == ZEND_DIM_IS) ? BP_VAR_IS : BP_VAR_R);
+				} else {
+					ZVAL_COPY_OR_DUP(result, &op1);
+				}
 				zval_ptr_dtor_nogc(&op1);
 				zval_ptr_dtor_nogc(&op2);
 			}
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index dc9ee094906da..492923371980a 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -8603,8 +8603,12 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 			}
 
 			/* Set isset fetch indicator here, opcache disallows runtime altering of the AST */
-			if (ast->attr == ZEND_DIM_IS && ast->child[0]->kind == ZEND_AST_DIM) {
-				ast->child[0]->attr = ZEND_DIM_IS;
+			if (ast->child[0]->kind == ZEND_AST_DIM) {
+				if (ast->attr == ZEND_DIM_IS) {
+					ast->child[0]->attr = ZEND_DIM_IS;
+				} else {
+					ast->child[0]->attr = ZEND_DIM_PROPAGATE_ERROR;
+				}
 			}
 
 			zend_eval_const_expr(&ast->child[0]);
diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index bf24904834bc2..9e49cd8fe5705 100644
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -890,7 +890,8 @@ void zend_assert_valid_class_name(const zend_string *const_name);
 #define ZEND_SEND_BY_REF     1
 #define ZEND_SEND_PREFER_REF 2
 
-#define ZEND_DIM_IS 1
+#define ZEND_DIM_IS                 1
+#define ZEND_DIM_PROPAGATE_ERROR    2
 
 #define IS_CONSTANT_UNQUALIFIED     0x010
 #define IS_CONSTANT_CLASS           0x080  /* __CLASS__ in trait */
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index f57f2229f3d8c..5dff835bef01b 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1926,7 +1926,7 @@ static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_UNSET(z
 	zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET EXECUTE_DATA_CC);
 }
 
-static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, int support_strings, int slow EXECUTE_DATA_DC)
+static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, int support_strings, int slow, int is_ast EXECUTE_DATA_DC)
 {
 	zval *retval;
 
@@ -2026,32 +2026,42 @@ static zend_always_inline void zend_fetch_dimension_address_read(zval *result, z
 			}
 		}
 	} else {
-		if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
-			zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
+		if (type != BP_VAR_IS) {
+			if (UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
+				zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
+			} else if (!Z_ISERROR_P(container)) {
+				zend_error(E_WARNING, "Variable of type %s does not accept array offsets", zend_get_type_by_const(Z_TYPE_P(container)));
+			}
 		}
+
 		if (/*dim_type == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
 			zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
 		}
-		ZVAL_NULL(result);
+
+		if (type != BP_VAR_IS && (is_ast || ((EX(opline)+1)->op1_type == IS_VAR && EX(opline)->opcode == (EX(opline)+1)->opcode))) {
+			ZVAL_ERROR(result);
+		} else {
+			ZVAL_NULL(result);
+		}
 	}
 }
 
 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_R(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
 {
 	zval *result = EX_VAR(opline->result.var);
-	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0 EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0, 0 EXECUTE_DATA_CC);
 }
 
 static zend_never_inline void zend_fetch_dimension_address_read_R_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
 {
 	zval *result = EX_VAR(opline->result.var);
-	zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 1, 1 EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 1, 1, 0 EXECUTE_DATA_CC);
 }
 
 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_IS(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
 {
 	zval *result = EX_VAR(opline->result.var);
-	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 1, 0 EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 1, 0, 0 EXECUTE_DATA_CC);
 }
 
 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_w(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
@@ -2063,12 +2073,12 @@ static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_w(
 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
 {
 	zval *result = EX_VAR(opline->result.var);
-	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, BP_VAR_R, 0, 0, 0 EXECUTE_DATA_CC);
 }
 
 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)
 {
-	zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 1, 0 NO_EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 1, 0, 1 NO_EXECUTE_DATA_CC);
 }
 
 static zend_never_inline zval* ZEND_FASTCALL zend_find_array_dim_slow(HashTable *ht, zval *offset EXECUTE_DATA_DC)
diff --git a/ext/simplexml/tests/017.phpt b/ext/simplexml/tests/017.phpt
index ba42ac46a93ff..57cd59478755e 100644
--- a/ext/simplexml/tests/017.phpt
+++ b/ext/simplexml/tests/017.phpt
@@ -37,9 +37,9 @@ function print_xml2($xml) {
   $persons = 2;
   for ($i=0;$i<$persons;$i++) {
     echo "person: ".$xml->person[$i]['name']."\n";
-	$children = 2;
+    $children = 2;
     for ($j=0;$j<$children;$j++) {
-      echo "  child: ".$xml->person[$i]->child[$j]['name']."\n";
+        echo "  child: ".$xml->person[$i]->child[$j]['name']."\n";
     }
   }
 }
@@ -75,12 +75,20 @@ person: Boe
 ---22---
 person: Joe
   child: Ann
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
   child: 
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 person: 
 
 Notice: Trying to get property 'child' of non-object in %s017.php on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
   child: 
 
 Notice: Trying to get property 'child' of non-object in %s017.php on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
   child: 
 ===DONE===
diff --git a/ext/standard/tests/array/bug31158.phpt b/ext/standard/tests/array/bug31158.phpt
index da7a9ec907267..eaa9d62323038 100644
--- a/ext/standard/tests/array/bug31158.phpt
+++ b/ext/standard/tests/array/bug31158.phpt
@@ -15,5 +15,7 @@ echo "ok\n";
 ?>
 --EXPECTF--
 Notice: Undefined variable: GLOBALS in %sbug31158.php on line 6
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 ok
 
diff --git a/ext/standard/tests/array/each.phpt b/ext/standard/tests/array/each.phpt
index f1b6f76ea6bb1a4908914ebd56c3bc5ef3304e80..0841437bf70da51c3a01fe5e5e01913db715ceec 100644
GIT binary patch
delta 185
zcmccN{l{m+RJr=_#G<^+ymTvtu*9Ow#H5^5h5R&ylFEWqg{1uaoYcfTg_Qi%Vuif?
z5{1O%<kSKnRaBH%2~?F<oLW+>keR2TTC9+tr;wAGm#Uze!o@|BiK;{yIdOvMWPeui
J%?IVg*#XqQL0td<

delta 19
bcmez4bHjVXRJn;0L?`>Rif>Mp7iR|mTIL5>

diff --git a/ext/standard/tests/strings/bug72663.phpt b/ext/standard/tests/strings/bug72663.phpt
index ec16e069ff50b..0583ff7688ae1 100644
--- a/ext/standard/tests/strings/bug72663.phpt
+++ b/ext/standard/tests/strings/bug72663.phpt
@@ -16,7 +16,9 @@ $inner = 'a:1:{i:0;O:9:"Exception":2:{s:7:"'."\0".'*'."\0".'file";R:4;}';
 $exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
 
 $data = unserialize($exploit);
-echo $data[1];
+if ($data) {
+    echo $data[1];
+}
 ?>
 DONE
 --EXPECTF--
diff --git a/tests/lang/031.phpt b/tests/lang/031.phpt
index 134df03684295..7653888be45d9 100644
--- a/tests/lang/031.phpt
+++ b/tests/lang/031.phpt
@@ -55,18 +55,42 @@ Correct - with inner loop reset.
 Deprecated: The each() function is deprecated. This message will be suppressed on further calls in %s on line %d
 inloop 0 for key1
 inloop 1 for key1
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 What happens without inner loop reset.
 inloop 0 for key1
 inloop 1 for key1
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 What happens without inner loop reset but copy.
 inloop 0 for key1
 inloop 1 for key1
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 What happens with inner loop reset over copy.
 inloop 0 for key1
 inloop 1 for key1
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
diff --git a/tests/lang/each_binary_safety.phpt b/tests/lang/each_binary_safety.phpt
index 37b18b32c7329..3db59b915aea9 100644
--- a/tests/lang/each_binary_safety.phpt
+++ b/tests/lang/each_binary_safety.phpt
@@ -13,3 +13,7 @@ while (list($key, $val) = each($arr)) {
 
 Deprecated: The each() function is deprecated. This message will be suppressed on further calls in %s on line %d
 7: foo%00bar => foo%00bar
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
+
+Warning: Variable of type boolean does not accept array offsets in %s on line %d
diff --git a/tests/lang/engine_assignExecutionOrder_002.phpt b/tests/lang/engine_assignExecutionOrder_002.phpt
index c090a452c3748..bad5917ff16ab 100644
--- a/tests/lang/engine_assignExecutionOrder_002.phpt
+++ b/tests/lang/engine_assignExecutionOrder_002.phpt
@@ -113,6 +113,10 @@ array(3) {
   int(3000)
 }
 L=100 M=200 N=300
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
+
+Warning: Variable of type integer does not accept array offsets in %s on line %d
 O= and P=
 10 20 40 50 60 70 80
 

From cc3e7c9fa4530ff74b68736e43376940f6466767 Mon Sep 17 00:00:00 2001
From: David Walker <dave@mudsite.com>
Date: Tue, 7 Nov 2017 12:30:54 -0700
Subject: [PATCH 2/5] fix tests

---
 Zend/tests/bug37676/1.phpt                    |   8 +++---
 Zend/tests/bug37676/11.phpt                   |   2 +-
 Zend/tests/bug37676/2.phpt                    |   8 +++---
 Zend/tests/bug37676/3.phpt                    |   4 +--
 Zend/tests/bug37676/4.phpt                    |   8 +++---
 Zend/tests/bug37676/8.phpt                    |   2 +-
 Zend/tests/bug37676/9.phpt                    |   4 +--
 Zend/tests/dereference_002.phpt               |   2 +-
 Zend/tests/dereference_010.phpt               |   4 +--
 Zend/tests/foreach_list_002.phpt              |   2 +-
 Zend/tests/list/list_reference_006.phpt       |   2 ++
 Zend/tests/list/list_reference_007.phpt       |   4 ++-
 Zend/tests/list_003.phpt                      |   4 +--
 Zend/tests/list_005.phpt                      |   6 ++---
 Zend/tests/list_006.phpt                      |   4 +++
 Zend/tests/offset_bool.phpt                   |  18 ++++++-------
 Zend/tests/offset_long.phpt                   |  18 ++++++-------
 Zend/zend_execute.c                           |   2 +-
 ext/mysqli/tests/mysqli_fork.phpt             |  20 ++++++++-------
 ext/standard/tests/array/each.phpt            | Bin 9852 -> 9846 bytes
 ext/standard/tests/strings/bug72433.phpt      |   2 ++
 sapi/fpm/tests/fcgi.inc                       |   3 +++
 tests/lang/031.phpt                           |  24 +++++++++---------
 tests/lang/each_binary_safety.phpt            |   4 +--
 .../lang/engine_assignExecutionOrder_002.phpt |   4 +--
 25 files changed, 87 insertions(+), 72 deletions(-)

diff --git a/Zend/tests/bug37676/1.phpt b/Zend/tests/bug37676/1.phpt
index 7f0ed63f2665c..9c3e2ae28d5bb 100644
--- a/Zend/tests/bug37676/1.phpt
+++ b/Zend/tests/bug37676/1.phpt
@@ -22,12 +22,12 @@ $b = 2;
 $a[0] + $b[0];
 ?>
 --EXPECTF--
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Variable of type null does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/11.phpt b/Zend/tests/bug37676/11.phpt
index 550b4ee593346..7c6b847bc7ad2 100644
--- a/Zend/tests/bug37676/11.phpt
+++ b/Zend/tests/bug37676/11.phpt
@@ -9,5 +9,5 @@ var_dump(true[0][1]);
 Warning: Variable of type null does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
diff --git a/Zend/tests/bug37676/2.phpt b/Zend/tests/bug37676/2.phpt
index bbe61ec8399ef..beba5f2333554 100644
--- a/Zend/tests/bug37676/2.phpt
+++ b/Zend/tests/bug37676/2.phpt
@@ -16,12 +16,12 @@ $b = 2;
 $a[0][1][2] + $b[0][1][2];
 ?>
 --EXPECTF--
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Variable of type null does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/3.phpt b/Zend/tests/bug37676/3.phpt
index 1d72bf2bc6892..4b004374dd749 100644
--- a/Zend/tests/bug37676/3.phpt
+++ b/Zend/tests/bug37676/3.phpt
@@ -14,8 +14,8 @@ $a = null;
 f($a[0][1][2]);
 ?>
 --EXPECTF--
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/4.phpt b/Zend/tests/bug37676/4.phpt
index 03e086170246a..74d737c5dab0e 100644
--- a/Zend/tests/bug37676/4.phpt
+++ b/Zend/tests/bug37676/4.phpt
@@ -15,9 +15,9 @@ while (list($k, $v) = each($a)) { // each dep, boolean err
 }
 ?>
 --EXPECTF--
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Deprecated: The each() function is deprecated. This message will be suppressed on further calls in %s on line %d
 int(0)
@@ -27,6 +27,6 @@ string(3) "two"
 int(2)
 int(3)
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/8.phpt b/Zend/tests/bug37676/8.phpt
index d6c20a29ba8fa..63e45d6abc95a 100644
--- a/Zend/tests/bug37676/8.phpt
+++ b/Zend/tests/bug37676/8.phpt
@@ -18,6 +18,6 @@ $fa[0][1];
 $fa[4][1];
 ?>
 --EXPECTF--
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/bug37676/9.phpt b/Zend/tests/bug37676/9.phpt
index 55a2ae478d373..428f73cd89180 100644
--- a/Zend/tests/bug37676/9.phpt
+++ b/Zend/tests/bug37676/9.phpt
@@ -40,7 +40,7 @@ array(1) {
 NULL
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Cannot use a scalar value as an array in %s on line %d
 
@@ -49,7 +49,7 @@ int(5)
 NULL
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
 Warning: Cannot use a scalar value as an array in %s on line %d
 
diff --git a/Zend/tests/dereference_002.phpt b/Zend/tests/dereference_002.phpt
index 373003c1638c7..1dffe25ba5d9e 100644
--- a/Zend/tests/dereference_002.phpt
+++ b/Zend/tests/dereference_002.phpt
@@ -70,7 +70,7 @@ array(2) {
 }
 int(1)
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
 Notice: Undefined offset: 4 in %s on line %d
diff --git a/Zend/tests/dereference_010.phpt b/Zend/tests/dereference_010.phpt
index e6bf9ce8c8048..1785e8f1ce629 100644
--- a/Zend/tests/dereference_010.phpt
+++ b/Zend/tests/dereference_010.phpt
@@ -21,10 +21,10 @@ var_dump(b()[1]);
 
 ?>
 --EXPECTF--
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
 Fatal error: Uncaught Error: Cannot use object of type stdClass as array in %s:%d
diff --git a/Zend/tests/foreach_list_002.phpt b/Zend/tests/foreach_list_002.phpt
index aa20e5005ad94..5c1be4e627873 100644
--- a/Zend/tests/foreach_list_002.phpt
+++ b/Zend/tests/foreach_list_002.phpt
@@ -14,7 +14,7 @@ foreach($array as list(, $a)) {
 }
 
 ?>
---EXPECT--
+--EXPECTF--
 int(1)
 int(3)
 string(1) "b"
diff --git a/Zend/tests/list/list_reference_006.phpt b/Zend/tests/list/list_reference_006.phpt
index f85edf04a49ad..7db688a072acc 100644
--- a/Zend/tests/list/list_reference_006.phpt
+++ b/Zend/tests/list/list_reference_006.phpt
@@ -36,6 +36,8 @@ object(StorageNoRef)#1 (1) {
 }
 
 Notice: Undefined offset: 2 in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 object(StorageNoRef)#2 (1) {
   ["s":"StorageNoRef":private]=>
   array(2) {
diff --git a/Zend/tests/list/list_reference_007.phpt b/Zend/tests/list/list_reference_007.phpt
index 225ebff10fe25..1d512440473c5 100644
--- a/Zend/tests/list/list_reference_007.phpt
+++ b/Zend/tests/list/list_reference_007.phpt
@@ -29,7 +29,7 @@ $a = new StorageRef(['one' => 1, 'two' => 2]);
 var_dump($a);
 
 ?>
---EXPECT--
+--EXPECTF--
 object(StorageRef)#1 (1) {
   ["s":"StorageRef":private]=>
   array(2) {
@@ -39,6 +39,8 @@ object(StorageRef)#1 (1) {
     int(2)
   }
 }
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
 object(StorageRef)#2 (1) {
   ["s":"StorageRef":private]=>
   array(3) {
diff --git a/Zend/tests/list_003.phpt b/Zend/tests/list_003.phpt
index 2cf412dd2f931..21c9f0d165187 100644
--- a/Zend/tests/list_003.phpt
+++ b/Zend/tests/list_003.phpt
@@ -19,13 +19,13 @@ var_dump($a, $b, $c, $d, $e);
 --EXPECTF--
 Warning: Variable of type null does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
 Warning: Variable of type float does not accept array offsets in %s on line %d
 
 Warning: Variable of type string does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 NULL
 NULL
diff --git a/Zend/tests/list_005.phpt b/Zend/tests/list_005.phpt
index 20b91b1cd5d66..122afd5b8eaee 100644
--- a/Zend/tests/list_005.phpt
+++ b/Zend/tests/list_005.phpt
@@ -45,11 +45,11 @@ NULL
 NULL
 ----
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 NULL
 NULL
diff --git a/Zend/tests/list_006.phpt b/Zend/tests/list_006.phpt
index 54a71a5c27ae6..ceb907f291482 100644
--- a/Zend/tests/list_006.phpt
+++ b/Zend/tests/list_006.phpt
@@ -14,3 +14,7 @@ Notice: Undefined offset: 1 in %s on line %d
 Warning: Variable of type null does not accept array offsets in %s on line %d
 
 Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
+
+Warning: Variable of type null does not accept array offsets in %s on line %d
diff --git a/Zend/tests/offset_bool.phpt b/Zend/tests/offset_bool.phpt
index 63f4e115d665a..078558a90b5fa 100644
--- a/Zend/tests/offset_bool.phpt
+++ b/Zend/tests/offset_bool.phpt
@@ -25,30 +25,30 @@ var_dump($bool[$arr]);
 echo "Done\n";
 ?>
 --EXPECTF--	
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 NULL
 Done
diff --git a/Zend/tests/offset_long.phpt b/Zend/tests/offset_long.phpt
index 91e25391c006e..0ddc7ba3de5d1 100644
--- a/Zend/tests/offset_long.phpt
+++ b/Zend/tests/offset_long.phpt
@@ -25,30 +25,30 @@ var_dump($long[$arr]);
 echo "Done\n";
 ?>
 --EXPECTF--	
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 NULL
 Done
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5dff835bef01b..40709aac73f76 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2038,7 +2038,7 @@ static zend_always_inline void zend_fetch_dimension_address_read(zval *result, z
 			zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
 		}
 
-		if (type != BP_VAR_IS && (is_ast || ((EX(opline)+1)->op1_type == IS_VAR && EX(opline)->opcode == (EX(opline)+1)->opcode))) {
+		if (type != BP_VAR_IS && (is_ast || ((EX(opline)+1)->op1_type == IS_TMP_VAR && EX(opline)->opcode == (EX(opline)+1)->opcode))) {
 			ZVAL_ERROR(result);
 		} else {
 			ZVAL_NULL(result);
diff --git a/ext/mysqli/tests/mysqli_fork.phpt b/ext/mysqli/tests/mysqli_fork.phpt
index 4862b7a220b88..3b62c3d5d1bf2 100644
--- a/ext/mysqli/tests/mysqli_fork.phpt
+++ b/ext/mysqli/tests/mysqli_fork.phpt
@@ -111,13 +111,15 @@ if (!have_innodb($link))
 						continue;
 					$tmp = mysqli_fetch_assoc($pres);
 					mysqli_free_result($pres);
-					if ($tmp['msg_id'] == $msg_id)
-						/* no new message */
-						continue;
-					if ($tmp['msg'] == 'stop')
-						break 2;
-					$msg_id = $tmp['msg_id'];
-					break;
+					if ($tmp) {
+						if ($tmp['msg_id'] == $msg_id)
+							/* no new message */
+							continue;
+						if ($tmp['msg'] == 'stop')
+							break 2;
+						$msg_id = $tmp['msg_id'];
+						break;
+					}
 				} while ((time() - $start) < 5);
 
 			}
@@ -143,7 +145,7 @@ if (!have_innodb($link))
 				$wait_id = pcntl_waitpid($pid, $status, WNOHANG);
 				if ($pres = mysqli_query($plink, $sql)) {
 					$row = mysqli_fetch_assoc($pres);
-					if ($row['msg_id'] != $last_msg_id) {
+					if ($row && $row['msg_id'] != $last_msg_id) {
 						$last_msg_id = $row['msg_id'];
 						switch ($row['msg']) {
 							case 'start':
@@ -249,4 +251,4 @@ array(1) {
      child array
     parent conti
      child stop
-done!
\ No newline at end of file
+done!
diff --git a/ext/standard/tests/array/each.phpt b/ext/standard/tests/array/each.phpt
index 0841437bf70da51c3a01fe5e5e01913db715ceec..34207a31829802bef8cdc30c36e2f1d769acb5af 100644
GIT binary patch
delta 20
ccmez4^UY_&X1U26@`jV2%gJr#kS}2e0A$Mu0ssI2

delta 28
ecmez7^T%hyW;y26#JtIy<@}+v;bvobXLbO%m<tgA

diff --git a/ext/standard/tests/strings/bug72433.phpt b/ext/standard/tests/strings/bug72433.phpt
index 534b1e6ac6f6b..15dd75a074920 100644
--- a/ext/standard/tests/strings/bug72433.phpt
+++ b/ext/standard/tests/strings/bug72433.phpt
@@ -20,4 +20,6 @@ var_dump($free_me);
 ?>
 --EXPECTF--
 Notice: unserialize(): Error at offset %d of %d bytes in %sbug72433.php on line 8
+
+Warning: Variable of type bool does not accept array offsets in %sbug72433.php on line 10
 bool(false)
diff --git a/sapi/fpm/tests/fcgi.inc b/sapi/fpm/tests/fcgi.inc
index 71bdad17b9523..7e53a6903cfc0 100644
--- a/sapi/fpm/tests/fcgi.inc
+++ b/sapi/fpm/tests/fcgi.inc
@@ -591,6 +591,9 @@ class Client
 
         do {
             $resp = $this->readPacket();
+            if (!$resp) {
+                break;
+            }
 
             if ($resp['type'] == self::STDOUT || $resp['type'] == self::STDERR) {
                 if ($resp['type'] == self::STDERR) {
diff --git a/tests/lang/031.phpt b/tests/lang/031.phpt
index 7653888be45d9..d23121de5573d 100644
--- a/tests/lang/031.phpt
+++ b/tests/lang/031.phpt
@@ -56,41 +56,41 @@ Deprecated: The each() function is deprecated. This message will be suppressed o
 inloop 0 for key1
 inloop 1 for key1
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 What happens without inner loop reset.
 inloop 0 for key1
 inloop 1 for key1
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 What happens without inner loop reset but copy.
 inloop 0 for key1
 inloop 1 for key1
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 What happens with inner loop reset over copy.
 inloop 0 for key1
 inloop 1 for key1
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 inloop 0 for key2
 inloop 1 for key2
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
diff --git a/tests/lang/each_binary_safety.phpt b/tests/lang/each_binary_safety.phpt
index 3db59b915aea9..e9619fc1d5604 100644
--- a/tests/lang/each_binary_safety.phpt
+++ b/tests/lang/each_binary_safety.phpt
@@ -14,6 +14,6 @@ while (list($key, $val) = each($arr)) {
 Deprecated: The each() function is deprecated. This message will be suppressed on further calls in %s on line %d
 7: foo%00bar => foo%00bar
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
 
-Warning: Variable of type boolean does not accept array offsets in %s on line %d
+Warning: Variable of type bool does not accept array offsets in %s on line %d
diff --git a/tests/lang/engine_assignExecutionOrder_002.phpt b/tests/lang/engine_assignExecutionOrder_002.phpt
index bad5917ff16ab..e7c409a61846e 100644
--- a/tests/lang/engine_assignExecutionOrder_002.phpt
+++ b/tests/lang/engine_assignExecutionOrder_002.phpt
@@ -114,9 +114,9 @@ array(3) {
 }
 L=100 M=200 N=300
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 
-Warning: Variable of type integer does not accept array offsets in %s on line %d
+Warning: Variable of type int does not accept array offsets in %s on line %d
 O= and P=
 10 20 40 50 60 70 80
 

From 173d4258bd41b911e2987d1d78d81ccb94d5862c Mon Sep 17 00:00:00 2001
From: David Walker <dave@mudsite.com>
Date: Mon, 23 Jul 2018 21:18:00 -0600
Subject: [PATCH 3/5] add test for return from function, rather than through
 each

---
 Zend/tests/bug37676/4.phpt | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/Zend/tests/bug37676/4.phpt b/Zend/tests/bug37676/4.phpt
index 74d737c5dab0e..d8175a2426095 100644
--- a/Zend/tests/bug37676/4.phpt
+++ b/Zend/tests/bug37676/4.phpt
@@ -13,6 +13,32 @@ list($j, $k, list($l)) = $a; // Integer Error
 while (list($k, $v) = each($a)) { // each dep, boolean err
     var_dump($k, $v);
 }
+
+class _test {
+    function __construct() {
+        $this->elem = [
+            [0, 'one'],
+            [1, 2]
+        ];
+    }
+
+    function pop() {
+        if (count($this->elem)) {
+          return array_shift($this->elem);
+        }
+        return false;
+    }
+}
+
+$t1 = new _test();
+while (list($k, $v) = $t1->pop()) {
+    var_dump($k, $v);
+}
+
+$t2 = new _test();
+while (@list($k, $v) = $t2->pop()) {
+    var_dump($k, $v);
+}
 ?>
 --EXPECTF--
 Warning: Variable of type int does not accept array offsets in %s on line %d
@@ -30,3 +56,15 @@ int(3)
 Warning: Variable of type bool does not accept array offsets in %s on line %d
 
 Warning: Variable of type bool does not accept array offsets in %s on line %d
+int(0)
+string(3) "one"
+int(1)
+int(2)
+
+Warning: Variable of type bool does not accept array offsets in %s on line %d
+
+Warning: Variable of type bool does not accept array offsets in %s on line %d
+int(0)
+string(3) "one"
+int(1)
+int(2)

From fffea437ef68e7bcf7f91d7a6ed518a5db3a3911 Mon Sep 17 00:00:00 2001
From: David Walker <dave@mudsite.com>
Date: Mon, 23 Jul 2018 21:23:05 -0600
Subject: [PATCH 4/5] use dim_type rather than forcing tmp-var

---
 Zend/zend_execute.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 40709aac73f76..260a70eb27ab9 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2073,7 +2073,7 @@ static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_w(
 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
 {
 	zval *result = EX_VAR(opline->result.var);
-	zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, BP_VAR_R, 0, 0, 0 EXECUTE_DATA_CC);
+	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0, 0 EXECUTE_DATA_CC);
 }
 
 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)

From 05cba57615e8bfc3c7c08bf1ed59d729a8fe13e2 Mon Sep 17 00:00:00 2001
From: David Walker <dave@mudsite.com>
Date: Fri, 27 Jul 2018 07:40:12 -0600
Subject: [PATCH 5/5] remove suppression test

---
 Zend/tests/bug37676/4.phpt | 38 --------------------------------------
 1 file changed, 38 deletions(-)

diff --git a/Zend/tests/bug37676/4.phpt b/Zend/tests/bug37676/4.phpt
index d8175a2426095..74d737c5dab0e 100644
--- a/Zend/tests/bug37676/4.phpt
+++ b/Zend/tests/bug37676/4.phpt
@@ -13,32 +13,6 @@ list($j, $k, list($l)) = $a; // Integer Error
 while (list($k, $v) = each($a)) { // each dep, boolean err
     var_dump($k, $v);
 }
-
-class _test {
-    function __construct() {
-        $this->elem = [
-            [0, 'one'],
-            [1, 2]
-        ];
-    }
-
-    function pop() {
-        if (count($this->elem)) {
-          return array_shift($this->elem);
-        }
-        return false;
-    }
-}
-
-$t1 = new _test();
-while (list($k, $v) = $t1->pop()) {
-    var_dump($k, $v);
-}
-
-$t2 = new _test();
-while (@list($k, $v) = $t2->pop()) {
-    var_dump($k, $v);
-}
 ?>
 --EXPECTF--
 Warning: Variable of type int does not accept array offsets in %s on line %d
@@ -56,15 +30,3 @@ int(3)
 Warning: Variable of type bool does not accept array offsets in %s on line %d
 
 Warning: Variable of type bool does not accept array offsets in %s on line %d
-int(0)
-string(3) "one"
-int(1)
-int(2)
-
-Warning: Variable of type bool does not accept array offsets in %s on line %d
-
-Warning: Variable of type bool does not accept array offsets in %s on line %d
-int(0)
-string(3) "one"
-int(1)
-int(2)