From 70c2ebb69807d517fa38487e690462454c83f1ec Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Thu, 13 Mar 2025 22:24:49 +0100
Subject: [PATCH 01/37] Fix typo in GHSA-hgf5-96fm-v528 NEWS entry

---
 NEWS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index f34fc5c90e5de..29400e6ef5b5c 100644
--- a/NEWS
+++ b/NEWS
@@ -12,7 +12,7 @@ PHP                                                                        NEWS
     when requesting a redirected resource). (CVE-2025-1219) (timwolla)
 
 - Streams:
-  . Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit
+  . Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit
     basic auth header). (CVE-2025-1736) (Jakub Zelenka)
   . Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
     to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)

From a7d2703246cb4acdcb48ecb3682386a102702c43 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 13 Mar 2025 21:18:35 +0100
Subject: [PATCH 02/37] Correct check for maximum string length in JIT helpers

This is a bit of a theoretical issue, but the maximum string length is
actually ZSTR_MAX_LEN instead of SIZE_MAX. The resulting check is a bit
slower but should still be relatively cheap.

Closes GH-18049.
---
 ext/opcache/jit/zend_jit_helpers.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
index a79f2b5173d53..26e368dce6617 100644
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@ -1636,7 +1636,7 @@ static void ZEND_FASTCALL zend_jit_fast_assign_concat_helper(zval *op1, zval *op
 	zend_string *result_str;
 	uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
 
-	if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
+	if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
 		zend_throw_error(NULL, "String size overflow");
 		return;
 	}
@@ -1672,7 +1672,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_helper(zval *result, zval *op1, z
 	zend_string *result_str;
 	uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
 
-	if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
+	if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
 		zend_throw_error(NULL, "String size overflow");
 		return;
 	}
@@ -1696,7 +1696,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_tmp_helper(zval *result, zval *op
 	zend_string *result_str;
 	uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
 
-	if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
+	if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
 		zend_throw_error(NULL, "String size overflow");
 		return;
 	}

From 413938143b31405817abbdf0f8effb7c09ed0862 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 13 Mar 2025 21:05:33 +0100
Subject: [PATCH 03/37] Fix GH-18037: SEGV Zend/zend_execute.c

A frameless icall with 3 arguments is a special case because it uses
OP_DATA, but this was not added to the list, so the opline pointed to
the wrong address resulting in UBSAN report or crash.

Closes GH-18048.
---
 NEWS                               |  1 +
 ext/opcache/jit/zend_jit_ir.c      |  1 +
 ext/opcache/tests/jit/gh18037.phpt | 24 ++++++++++++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 ext/opcache/tests/jit/gh18037.phpt

diff --git a/NEWS b/NEWS
index 309bf290f28f8..72b890d29855d 100644
--- a/NEWS
+++ b/NEWS
@@ -40,6 +40,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal
     JIT). (nielsdos)
   . Fixed bug GH-17966 (Symfony JIT 1205 assertion failure). (nielsdos)
+  . Fixed bug GH-18037 (SEGV Zend/zend_execute.c). (nielsdos)
 
 - Standard:
   . Fix memory leaks in array_any() / array_all(). (nielsdos)
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 32c58f24c7cd2..7ff6522ba2c4a 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -4209,6 +4209,7 @@ static int zend_jit_handler(zend_jit_ctx *jit, const zend_op *opline, int may_th
 		case ZEND_ASSIGN_STATIC_PROP_OP:
 		case ZEND_ASSIGN_STATIC_PROP_REF:
 		case ZEND_ASSIGN_OBJ_REF:
+		case ZEND_FRAMELESS_ICALL_3:
 			zend_jit_set_last_valid_opline(jit, opline + 2);
 			break;
 		default:
diff --git a/ext/opcache/tests/jit/gh18037.phpt b/ext/opcache/tests/jit/gh18037.phpt
new file mode 100644
index 0000000000000..26de60228e8cb
--- /dev/null
+++ b/ext/opcache/tests/jit/gh18037.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-18037 (SEGV Zend/zend_execute.c)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.jit=1201
+--FILE--
+<?php
+function test_helper()
+{
+    $list = [];
+    \in_array($list[0], $list, true) !== $list->matches();
+}
+
+test_helper();
+?>
+--EXPECTF--
+Warning: Undefined array key 0 in %s on line %d
+
+Fatal error: Uncaught Error: Call to a member function matches() on array in %s:%d
+Stack trace:
+#0 %s(%d): test_helper()
+#1 {main}
+  thrown in %s on line %d

From 4e4f1729ddf1131895b678cd7f12354a4a5ce0c0 Mon Sep 17 00:00:00 2001
From: Saki Takamachi <34942839+SakiTakamachi@users.noreply.github.com>
Date: Fri, 14 Mar 2025 08:53:48 +0900
Subject: [PATCH 04/37] ext/bcmath: Simplify `bc_divide()` code (#17987)

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
---
 NEWS                               |   3 +
 ext/bcmath/libbcmath/src/convert.h |  34 +++-
 ext/bcmath/libbcmath/src/div.c     | 256 +++++++++++------------------
 ext/bcmath/libbcmath/src/private.h |   9 +
 4 files changed, 141 insertions(+), 161 deletions(-)

diff --git a/NEWS b/NEWS
index 2268ebedc7b45..f941ce90e47f1 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.5.0alpha1
 
+- BCMath:
+  . Simplify `bc_divide()` code. (SakiTakamachi)
+
 - CLI:
   . Add --ini=diff to print INI settings changed from the builtin default.
     (timwolla)
diff --git a/ext/bcmath/libbcmath/src/convert.h b/ext/bcmath/libbcmath/src/convert.h
index 6ddd447c8048e..e278ae5fef1aa 100644
--- a/ext/bcmath/libbcmath/src/convert.h
+++ b/ext/bcmath/libbcmath/src/convert.h
@@ -34,11 +34,11 @@ static inline BC_VECTOR bc_partial_convert_to_vector(const char *n, size_t len)
 	}
 
 	BC_VECTOR num = 0;
-	BC_VECTOR base = 1;
+	BC_VECTOR digit_base_value = 1;
 
 	for (size_t i = 0; i < len; i++) {
-		num += *n * base;
-		base *= BASE;
+		num += *n * digit_base_value;
+		digit_base_value *= BASE;
 		n--;
 	}
 
@@ -57,4 +57,32 @@ static inline void bc_convert_to_vector(BC_VECTOR *n_vector, const char *nend, s
 	}
 }
 
+static inline void bc_convert_to_vector_with_zero_pad(BC_VECTOR *n_vector, const char *nend, size_t nlen, size_t zeros)
+{
+	while (zeros >= BC_VECTOR_SIZE) {
+		*n_vector = 0;
+		n_vector++;
+		zeros -= BC_VECTOR_SIZE;
+	}
+
+	if (zeros > 0) {
+		*n_vector = 0;
+		BC_VECTOR digit_base_value = BC_POW_10_LUT[zeros];
+		size_t len_to_write = MIN(BC_VECTOR_SIZE - zeros, nlen);
+		for (size_t i = 0; i < len_to_write; i++) {
+			*n_vector += *nend * digit_base_value;
+			digit_base_value *= BASE;
+			nend--;
+		}
+		n_vector++;
+		nlen -= len_to_write;
+	}
+
+	if (nlen == 0) {
+		return;
+	}
+
+	bc_convert_to_vector(n_vector, nend, nlen);
+}
+
 #endif
diff --git a/ext/bcmath/libbcmath/src/div.c b/ext/bcmath/libbcmath/src/div.c
index ce9ae1e1dd792..cda452569dedc 100644
--- a/ext/bcmath/libbcmath/src/div.c
+++ b/ext/bcmath/libbcmath/src/div.c
@@ -37,10 +37,6 @@
 #include <string.h>
 #include "zend_alloc.h"
 
-static const BC_VECTOR POW_10_LUT[9] = {
-	1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000
-};
-
 /*
  * This function should be used when the divisor is not split into multiple chunks, i.e. when the size of the array is one.
  * This is because the algorithm can be simplified.
@@ -51,7 +47,7 @@ static inline void bc_fast_div(
 {
 	size_t numerator_top_index = numerator_arr_size - 1;
 	size_t quot_top_index = quot_arr_size - 1;
-	for (size_t i = 0; i < quot_arr_size - 1; i++) {
+	for (size_t i = 0; i < quot_top_index; i++) {
 		if (numerator_vectors[numerator_top_index - i] < divisor_vector) {
 			quot_vectors[quot_top_index - i] = 0;
 			/* numerator_vectors[numerator_top_index - i] < divisor_vector, so there will be no overflow. */
@@ -174,8 +170,8 @@ static inline void bc_standard_div(
 		divisor_top_digits = BC_VECTOR_SIZE;
 	}
 
-	size_t high_part_shift = POW_10_LUT[BC_VECTOR_SIZE - divisor_top_digits + 1];
-	size_t low_part_shift = POW_10_LUT[divisor_top_digits - 1];
+	size_t high_part_shift = BC_POW_10_LUT[BC_VECTOR_SIZE - divisor_top_digits + 1];
+	size_t low_part_shift = BC_POW_10_LUT[divisor_top_digits - 1];
 	BC_VECTOR divisor_high_part = divisor_vectors[divisor_top_index] * high_part_shift + divisor_vectors[divisor_top_index - 1] / low_part_shift;
 	for (size_t i = 0; i < quot_arr_size; i++) {
 		BC_VECTOR numerator_high_part = numerator_vectors[numerator_top_index - i] * high_part_shift + numerator_vectors[numerator_top_index - i - 1] / low_part_shift;
@@ -255,58 +251,39 @@ static inline void bc_standard_div(
 }
 
 static void bc_do_div(
-	const char *numerator, size_t numerator_readable_len, size_t numerator_bottom_extension,
-	const char *divisor, size_t divisor_len, bc_num *quot, size_t quot_len
+	const char *numerator, size_t numerator_size, size_t numerator_readable_size,
+	const char *divisor, size_t divisor_size,
+	bc_num *quot, size_t quot_size
 ) {
-	size_t divisor_arr_size = (divisor_len + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE;
-	size_t numerator_arr_size = (numerator_readable_len + numerator_bottom_extension + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE;
+	size_t numerator_arr_size = (numerator_size + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE;
+	size_t divisor_arr_size = (divisor_size + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE;
 	size_t quot_arr_size = numerator_arr_size - divisor_arr_size + 1;
-	size_t quot_real_arr_size = MIN(quot_arr_size, (quot_len + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE);
+	size_t quot_real_arr_size = MIN(quot_arr_size, (quot_size + BC_VECTOR_SIZE - 1) / BC_VECTOR_SIZE);
 
 	BC_VECTOR *numerator_vectors = safe_emalloc(numerator_arr_size + divisor_arr_size + quot_arr_size, sizeof(BC_VECTOR), 0);
 	BC_VECTOR *divisor_vectors = numerator_vectors + numerator_arr_size;
 	BC_VECTOR *quot_vectors = divisor_vectors + divisor_arr_size;
 
-	/* Fill with zeros and convert as many vector elements as needed */
-	size_t numerator_vector_count = 0;
-	while (numerator_bottom_extension >= BC_VECTOR_SIZE) {
-		numerator_vectors[numerator_vector_count] = 0;
-		numerator_bottom_extension -= BC_VECTOR_SIZE;
-		numerator_vector_count++;
-	}
-
-	size_t numerator_bottom_read_len = BC_VECTOR_SIZE - numerator_bottom_extension;
-
-	size_t base;
-	size_t numerator_read = 0;
-	if (numerator_bottom_read_len < BC_VECTOR_SIZE) {
-		numerator_read = MIN(numerator_bottom_read_len, numerator_readable_len);
-		base = POW_10_LUT[numerator_bottom_extension];
-		numerator_vectors[numerator_vector_count] = 0;
-		for (size_t i = 0; i < numerator_read; i++) {
-			numerator_vectors[numerator_vector_count] += *numerator * base;
-			base *= BASE;
-			numerator--;
-		}
-		numerator_vector_count++;
-	}
+	size_t numerator_extension = numerator_size > numerator_readable_size ? numerator_size - numerator_readable_size : 0;
 
 	/* Bulk convert numerator and divisor to vectors */
-	if (numerator_readable_len > numerator_read) {
-		bc_convert_to_vector(numerator_vectors + numerator_vector_count, numerator, numerator_readable_len - numerator_read);
-	}
-	bc_convert_to_vector(divisor_vectors, divisor, divisor_len);
+	size_t numerator_use_size = numerator_size - numerator_extension;
+	const char *numerator_end = numerator + numerator_use_size - 1;
+	bc_convert_to_vector_with_zero_pad(numerator_vectors, numerator_end, numerator_use_size, numerator_extension);
+
+	const char *divisor_end = divisor + divisor_size - 1;
+	bc_convert_to_vector(divisor_vectors, divisor_end, divisor_size);
 
 	/* Do the division */
 	if (divisor_arr_size == 1) {
 		bc_fast_div(numerator_vectors, numerator_arr_size, divisor_vectors[0], quot_vectors, quot_arr_size);
 	} else {
-		bc_standard_div(numerator_vectors, numerator_arr_size, divisor_vectors, divisor_arr_size, divisor_len, quot_vectors, quot_arr_size);
+		bc_standard_div(numerator_vectors, numerator_arr_size, divisor_vectors, divisor_arr_size, divisor_size, quot_vectors, quot_arr_size);
 	}
 
 	/* Convert to bc_num */
 	char *qptr = (*quot)->n_value;
-	char *qend = qptr + quot_len - 1;
+	char *qend = qptr + (*quot)->n_len + (*quot)->n_scale - 1;
 
 	size_t i;
 	for (i = 0; i < quot_real_arr_size - 1; i++) {
@@ -328,6 +305,38 @@ static void bc_do_div(
 	efree(numerator_vectors);
 }
 
+static inline void bc_divide_by_one(bc_num numerator, bc_num *quot, size_t quot_scale)
+{
+	quot_scale = MIN(numerator->n_scale, quot_scale);
+	*quot = bc_new_num_nonzeroed(numerator->n_len, quot_scale);
+	char *qptr = (*quot)->n_value;
+	memcpy(qptr, numerator->n_value, numerator->n_len + quot_scale);
+}
+
+static inline void bc_divide_by_pow_10(
+	const char *numeratorptr, size_t numerator_readable_size, bc_num *quot, size_t quot_size, size_t quot_scale)
+{
+	char *qptr = (*quot)->n_value;
+	for (size_t i = quot_size; i <= quot_scale; i++) {
+		*qptr++ = 0;
+	}
+
+	size_t numerator_use_size = quot_size > numerator_readable_size ? numerator_readable_size : quot_size;
+	memcpy(qptr, numeratorptr, numerator_use_size);
+	qptr += numerator_use_size;
+
+	if (numerator_use_size < (*quot)->n_len) {
+		/* e.g. 12.3 / 0.01 <=> 1230  */
+		for (size_t i = numerator_use_size; i < (*quot)->n_len; i++) {
+			*qptr++ = 0;
+		}
+		(*quot)->n_scale = 0;
+	} else {
+		char *qend = (*quot)->n_value + (*quot)->n_len + (*quot)->n_scale;
+		(*quot)->n_scale -= qend - qptr;
+	}
+}
+
 bool bc_divide(bc_num numerator, bc_num divisor, bc_num *quot, size_t scale)
 {
 	/* divide by zero */
@@ -336,166 +345,97 @@ bool bc_divide(bc_num numerator, bc_num divisor, bc_num *quot, size_t scale)
 	}
 
 	bc_free_num(quot);
+	size_t quot_scale = scale;
 
 	/* If numerator is zero, the quotient is always zero. */
 	if (bc_is_zero(numerator)) {
-		*quot = bc_copy_num(BCG(_zero_));
-		return true;
+		goto quot_zero;
 	}
 
 	/* If divisor is 1 / -1, the quotient's n_value is equal to numerator's n_value. */
 	if (_bc_do_compare(divisor, BCG(_one_), divisor->n_scale, false) == BCMATH_EQUAL) {
-		size_t quot_scale = MIN(numerator->n_scale, scale);
-		*quot = bc_new_num_nonzeroed(numerator->n_len, quot_scale);
-		char *qptr = (*quot)->n_value;
-		memcpy(qptr, numerator->n_value, numerator->n_len + quot_scale);
+		bc_divide_by_one(numerator, quot, quot_scale);
 		(*quot)->n_sign = numerator->n_sign == divisor->n_sign ? PLUS : MINUS;
-		_bc_rm_leading_zeros(*quot);
 		return true;
 	}
 
 	char *numeratorptr = numerator->n_value;
-	char *numeratorend = numeratorptr + numerator->n_len + numerator->n_scale - 1;
-	size_t numerator_len = numerator->n_len;
-	size_t numerator_scale = numerator->n_scale;
+	size_t numerator_size = numerator->n_len + quot_scale + divisor->n_scale;
 
 	char *divisorptr = divisor->n_value;
-	char *divisorend = divisorptr + divisor->n_len + divisor->n_scale - 1;
-	size_t divisor_len = divisor->n_len;
-	size_t divisor_scale = divisor->n_scale;
-	size_t divisor_int_right_zeros = 0;
-
-	/* remove divisor trailing zeros */
-	while (*divisorend == 0 && divisor_scale > 0) {
-		divisorend--;
-		divisor_scale--;
-	}
-	while (*divisorend == 0) {
-		divisorend--;
-		divisor_int_right_zeros++;
-	}
+	size_t divisor_size = divisor->n_len + divisor->n_scale;
 
-	if (*numeratorptr == 0 && numerator_len == 1) {
+	/* check and remove numerator leading zeros */
+	size_t numerator_leading_zeros = 0;
+	while (*numeratorptr == 0) {
 		numeratorptr++;
-		numerator_len = 0;
+		numerator_leading_zeros++;
 	}
-
-	size_t numerator_top_extension = 0;
-	size_t numerator_bottom_extension = 0;
-	if (divisor_scale > 0) {
-		/*
-		 * e.g. divisor_scale = 4
-		 * divisor = .0002, to be 2 or divisor = 200.001, to be 200001
-		 * numerator = .03, to be 300 or numerator = .000003, to be .03
-		 * numerator may become longer than the original data length due to the addition of
-		 * trailing zeros in the integer part.
-		 */
-		numerator_len += divisor_scale;
-		numerator_bottom_extension = numerator_scale < divisor_scale ? divisor_scale - numerator_scale : 0;
-		numerator_scale = numerator_scale > divisor_scale ? numerator_scale - divisor_scale : 0;
-		divisor_len += divisor_scale;
-		divisor_scale = 0;
-	} else if (divisor_int_right_zeros > 0) {
-		/*
-		 * e.g. divisor_int_right_zeros = 4
-		 * divisor = 2000, to be 2
-		 * numerator = 30, to be .03 or numerator = 30000, to be 30
-		 * Also, numerator may become longer than the original data length due to the addition of
-		 * leading zeros in the fractional part.
-		 */
-		numerator_top_extension = numerator_len < divisor_int_right_zeros ? divisor_int_right_zeros - numerator_len : 0;
-		numerator_len = numerator_len > divisor_int_right_zeros ? numerator_len - divisor_int_right_zeros : 0;
-		numerator_scale += divisor_int_right_zeros;
-		divisor_len -= divisor_int_right_zeros;
-		divisor_scale = 0;
+	if (numerator_size > numerator_leading_zeros) {
+		numerator_size -= numerator_leading_zeros;
+	} else {
+		goto quot_zero;
 	}
 
-	/* remove numerator leading zeros */
-	while (*numeratorptr == 0 && numerator_len > 0) {
-		numeratorptr++;
-		numerator_len--;
-	}
-	/* remove divisor leading zeros */
+	/* check and remove divisor leading zeros */
 	while (*divisorptr == 0) {
 		divisorptr++;
-		divisor_len--;
+		divisor_size--;
 	}
 
-	/* Considering the scale specification, the quotient is always 0 if this condition is met */
-	if (divisor_len > numerator_len + scale) {
-		*quot = bc_copy_num(BCG(_zero_));
-		return true;
+	if (divisor_size > numerator_size) {
+		goto quot_zero;
 	}
 
-	/* Length of numerator data that can be read */
-	size_t numerator_readable_len = numeratorend - numeratorptr + 1;
-
-	/* set scale to numerator */
-	if (numerator_scale > scale) {
-		size_t scale_diff = numerator_scale - scale;
-		if (numerator_bottom_extension > scale_diff) {
-			numerator_bottom_extension -= scale_diff;
-		} else {
-			numerator_bottom_extension = 0;
-			if (EXPECTED(numerator_readable_len > scale_diff)) {
-				numerator_readable_len -= scale_diff;
-				numeratorend -= scale_diff;
-			} else {
-				numerator_readable_len = 0;
-				numeratorend = numeratorptr;
-			}
+	/* check and remove divisor trailing zeros. The divisor is not 0, so leave only one digit */
+	size_t divisor_trailing_zeros = 0;
+	for (size_t i = divisor_size - 1; i > 0; i--) {
+		if (divisorptr[i] != 0) {
+			break;
 		}
-		numerator_top_extension = MIN(numerator_top_extension, scale);
+		divisor_trailing_zeros++;
+	}
+	divisor_size -= divisor_trailing_zeros;
+
+	if (numerator_size > divisor_trailing_zeros) {
+		numerator_size -= divisor_trailing_zeros;
 	} else {
-		numerator_bottom_extension += scale - numerator_scale;
+		goto quot_zero;
 	}
-	numerator_scale = scale;
 
-	if (divisor_len > numerator_readable_len + numerator_bottom_extension) {
-		*quot = bc_copy_num(BCG(_zero_));
-		return true;
+	size_t quot_size = numerator_size - divisor_size + 1; /* numerator_size >= divisor_size */
+	if (quot_size > quot_scale) {
+		*quot = bc_new_num_nonzeroed(quot_size - quot_scale, quot_scale);
+	} else {
+		*quot = bc_new_num_nonzeroed(1, quot_scale); /* 1 is for 0 */
 	}
 
-	/* If divisor is 1 here, return the result of adjusting the decimal point position of numerator. */
-	if (divisor_len == 1 && *divisorptr == 1) {
-		if (numerator_len == 0) {
-			numerator_len = 1;
-			numerator_top_extension++;
-		}
-		size_t quot_scale = numerator_scale > numerator_bottom_extension ? numerator_scale - numerator_bottom_extension : 0;
-		numerator_bottom_extension = numerator_scale < numerator_bottom_extension ? numerator_bottom_extension - numerator_scale : 0;
+	/* Size that can be read from numeratorptr */
+	size_t numerator_readable_size = numerator->n_len + numerator->n_scale - numerator_leading_zeros;
 
-		*quot = bc_new_num_nonzeroed(numerator_len, quot_scale);
-		char *qptr = (*quot)->n_value;
-		for (size_t i = 0; i < numerator_top_extension; i++) {
-			*qptr++ = 0;
-		}
-		memcpy(qptr, numeratorptr, numerator_readable_len);
-		qptr += numerator_readable_len;
-		for (size_t i = 0; i < numerator_bottom_extension; i++) {
-			*qptr++ = 0;
-		}
+	/* If divisor is 1 here, return the result of adjusting the decimal point position of numerator. */
+	if (divisor_size == 1 && *divisorptr == 1) {
+		bc_divide_by_pow_10(numeratorptr, numerator_readable_size, quot, quot_size, quot_scale);
 		(*quot)->n_sign = numerator->n_sign == divisor->n_sign ? PLUS : MINUS;
 		return true;
 	}
 
-	size_t quot_full_len;
-	if (divisor_len > numerator_len) {
-		*quot = bc_new_num_nonzeroed(1, scale);
-		quot_full_len = 1 + scale;
-	} else {
-		*quot = bc_new_num_nonzeroed(numerator_len - divisor_len + 1, scale);
-		quot_full_len = numerator_len - divisor_len + 1 + scale;
-	}
-
 	/* do divide */
-	bc_do_div(numeratorend, numerator_readable_len, numerator_bottom_extension, divisorend, divisor_len, quot, quot_full_len);
+	bc_do_div(
+		numeratorptr, numerator_size, numerator_readable_size,
+		divisorptr, divisor_size,
+		quot, quot_size
+	);
+
 	_bc_rm_leading_zeros(*quot);
 	if (bc_is_zero(*quot)) {
 		(*quot)->n_sign = PLUS;
 	} else {
 		(*quot)->n_sign = numerator->n_sign == divisor->n_sign ? PLUS : MINUS;
 	}
+	return true;
 
+quot_zero:
+	*quot = bc_copy_num(BCG(_zero_));
 	return true;
 }
diff --git a/ext/bcmath/libbcmath/src/private.h b/ext/bcmath/libbcmath/src/private.h
index 5c0087901a4a2..1a911442dc9a1 100644
--- a/ext/bcmath/libbcmath/src/private.h
+++ b/ext/bcmath/libbcmath/src/private.h
@@ -35,6 +35,9 @@
 #include <stddef.h>
 #include "zend_portability.h"
 
+#ifndef _BCMATH_PRIV_H_
+#define _BCMATH_PRIV_H_
+
 /* This will be 0x01010101 for 32-bit and 0x0101010101010101 for 64-bit */
 #define SWAR_ONES (~((size_t) 0) / 0xFF)
 /* This repeats a byte `x` into an entire 32/64-bit word.
@@ -67,9 +70,15 @@
  */
 #define BC_VECTOR_NO_OVERFLOW_ADD_COUNT (~((BC_VECTOR) 0) / (BC_VECTOR_BOUNDARY_NUM * BC_VECTOR_BOUNDARY_NUM))
 
+static const BC_VECTOR BC_POW_10_LUT[9] = {
+	1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000
+};
+
 
 /* routines */
 bcmath_compare_result _bc_do_compare (bc_num n1, bc_num n2, size_t scale, bool use_sign);
 bc_num _bc_do_add (bc_num n1, bc_num n2);
 bc_num _bc_do_sub (bc_num n1, bc_num n2);
 void _bc_rm_leading_zeros (bc_num num);
+
+#endif

From 7c9872e255b33a4d455c18153f1967b87654f443 Mon Sep 17 00:00:00 2001
From: Saki Takamachi <saki@php.net>
Date: Fri, 14 Mar 2025 09:00:00 +0900
Subject: [PATCH 05/37] Fixed pointer subtraction for scale (#17986)

Closes #17986
---
 NEWS                               | 3 +++
 ext/bcmath/libbcmath/src/str2num.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 72b890d29855d..7bcfc484d7302 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.6
 
+- BCMath:
+  . Fixed pointer subtraction for scale. (SakiTakamachi)
+
 - Core:
   . Fixed property hook backing value access in multi-level inheritance.
     (ilutov)
diff --git a/ext/bcmath/libbcmath/src/str2num.c b/ext/bcmath/libbcmath/src/str2num.c
index 79c1d4216fe7b..bd9a44a240503 100644
--- a/ext/bcmath/libbcmath/src/str2num.c
+++ b/ext/bcmath/libbcmath/src/str2num.c
@@ -180,7 +180,7 @@ bool bc_str2num(bc_num *num, const char *str, const char *end, size_t scale, siz
 			 */
 			if (str_scale > 0) {
 				const char *fractional_new_end = bc_skip_zero_reverse(fractional_end, fractional_ptr);
-				str_scale -= fractional_new_end - fractional_end;
+				str_scale -= fractional_end - fractional_new_end; /* fractional_end >= fractional_new_end */
 			}
 		}
 	} else {

From 32547f11271ebd9a4f29202179e1cc5e12c333a8 Mon Sep 17 00:00:00 2001
From: Saki Takamachi <34942839+SakiTakamachi@users.noreply.github.com>
Date: Fri, 14 Mar 2025 17:52:50 +0900
Subject: [PATCH 06/37] ext/bcmath: If the result is `0`, `n_scale` is set to
 `0`. (#18056)

---
 NEWS                              |  1 +
 ext/bcmath/bcmath.c               |  9 +++++----
 ext/bcmath/libbcmath/src/bcmath.h |  2 +-
 ext/bcmath/libbcmath/src/div.c    |  1 +
 ext/bcmath/libbcmath/src/divmod.c |  1 +
 ext/bcmath/libbcmath/src/recmul.c |  1 +
 ext/bcmath/libbcmath/src/round.c  | 24 +++++++++++++++---------
 7 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/NEWS b/NEWS
index f941ce90e47f1..bd7c6b3a26ae0 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 
 - BCMath:
   . Simplify `bc_divide()` code. (SakiTakamachi)
+  . If the result is 0, n_scale is set to 0. (SakiTakamachi)
 
 - CLI:
   . Add --ini=diff to print INI settings changed from the builtin default.
diff --git a/ext/bcmath/bcmath.c b/ext/bcmath/bcmath.c
index 233045bd7cd7e..962f839ba83f4 100644
--- a/ext/bcmath/bcmath.c
+++ b/ext/bcmath/bcmath.c
@@ -807,8 +807,8 @@ PHP_FUNCTION(bcround)
 		goto cleanup;
 	}
 
-	bc_round(num, precision, mode, &result);
-	RETVAL_NEW_STR(bc_num2str_ex(result, result->n_scale));
+	size_t scale = bc_round(num, precision, mode, &result);
+	RETVAL_NEW_STR(bc_num2str_ex(result, scale));
 
 	cleanup: {
 		bc_free_num(&num);
@@ -1799,9 +1799,10 @@ PHP_METHOD(BcMath_Number, round)
 	bcmath_number_obj_t *intern = get_bcmath_number_from_zval(ZEND_THIS);
 
 	bc_num ret = NULL;
-	bc_round(intern->num, precision, rounding_mode, &ret);
+	size_t scale = bc_round(intern->num, precision, rounding_mode, &ret);
+	bc_rm_trailing_zeros(ret);
 
-	bcmath_number_obj_t *new_intern = bcmath_number_new_obj(ret, ret->n_scale);
+	bcmath_number_obj_t *new_intern = bcmath_number_new_obj(ret, scale);
 	RETURN_OBJ(&new_intern->std);
 }
 
diff --git a/ext/bcmath/libbcmath/src/bcmath.h b/ext/bcmath/libbcmath/src/bcmath.h
index f7e14019bd336..1f05ad51f7f26 100644
--- a/ext/bcmath/libbcmath/src/bcmath.h
+++ b/ext/bcmath/libbcmath/src/bcmath.h
@@ -157,7 +157,7 @@ bool bc_divmod(bc_num num1, bc_num num2, bc_num *quo, bc_num *rem, size_t scale)
 
 bc_num bc_floor_or_ceil(bc_num num, bool is_floor);
 
-void bc_round(bc_num num, zend_long places, zend_long mode, bc_num *result);
+size_t bc_round(bc_num num, zend_long places, zend_long mode, bc_num *result);
 
 typedef enum {
 	OK,
diff --git a/ext/bcmath/libbcmath/src/div.c b/ext/bcmath/libbcmath/src/div.c
index cda452569dedc..ec7619fb77090 100644
--- a/ext/bcmath/libbcmath/src/div.c
+++ b/ext/bcmath/libbcmath/src/div.c
@@ -430,6 +430,7 @@ bool bc_divide(bc_num numerator, bc_num divisor, bc_num *quot, size_t scale)
 	_bc_rm_leading_zeros(*quot);
 	if (bc_is_zero(*quot)) {
 		(*quot)->n_sign = PLUS;
+		(*quot)->n_scale = 0;
 	} else {
 		(*quot)->n_sign = numerator->n_sign == divisor->n_sign ? PLUS : MINUS;
 	}
diff --git a/ext/bcmath/libbcmath/src/divmod.c b/ext/bcmath/libbcmath/src/divmod.c
index 294a281b2e687..477ec30e916ea 100644
--- a/ext/bcmath/libbcmath/src/divmod.c
+++ b/ext/bcmath/libbcmath/src/divmod.c
@@ -74,6 +74,7 @@ bool bc_divmod(bc_num num1, bc_num num2, bc_num *quot, bc_num *rem, size_t scale
 	(*rem)->n_scale = MIN(scale, (*rem)->n_scale);
 	if (bc_is_zero(*rem)) {
 		(*rem)->n_sign = PLUS;
+		(*rem)->n_scale = 0;
 	}
 
 	return true;
diff --git a/ext/bcmath/libbcmath/src/recmul.c b/ext/bcmath/libbcmath/src/recmul.c
index b92a1045ac3b5..de06a4ca037ec 100644
--- a/ext/bcmath/libbcmath/src/recmul.c
+++ b/ext/bcmath/libbcmath/src/recmul.c
@@ -264,6 +264,7 @@ bc_num bc_multiply(bc_num n1, bc_num n2, size_t scale)
 	_bc_rm_leading_zeros(prod);
 	if (bc_is_zero(prod)) {
 		prod->n_sign = PLUS;
+		prod->n_scale = 0;
 	}
 	return prod;
 }
diff --git a/ext/bcmath/libbcmath/src/round.c b/ext/bcmath/libbcmath/src/round.c
index ac3c7c41a315e..44df6036cbe3b 100644
--- a/ext/bcmath/libbcmath/src/round.c
+++ b/ext/bcmath/libbcmath/src/round.c
@@ -18,7 +18,8 @@
 #include "private.h"
 #include <stddef.h>
 
-void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
+/* Returns the scale of the value after rounding. */
+size_t bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 {
 	/* clear result */
 	bc_free_num(result);
@@ -43,19 +44,19 @@ void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 			case PHP_ROUND_HALF_ODD:
 			case PHP_ROUND_TOWARD_ZERO:
 				*result = bc_copy_num(BCG(_zero_));
-				return;
+				return 0;
 
 			case PHP_ROUND_CEILING:
 				if (num->n_sign == MINUS) {
 					*result = bc_copy_num(BCG(_zero_));
-					return;
+					return 0;
 				}
 				break;
 
 			case PHP_ROUND_FLOOR:
 				if (num->n_sign == PLUS) {
 					*result = bc_copy_num(BCG(_zero_));
-					return;
+					return 0;
 				}
 				break;
 
@@ -67,7 +68,7 @@ void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 
 		if (bc_is_zero(num)) {
 			*result = bc_copy_num(BCG(_zero_));
-			return;
+			return 0;
 		}
 
 		/* If precision is -3, it becomes 1000. */
@@ -78,7 +79,7 @@ void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 		}
 		(*result)->n_value[0] = 1;
 		(*result)->n_sign = num->n_sign;
-		return;
+		return 0;
 	}
 
 	/* Just like bcadd('1', '1', 4) becomes '2.0000', it pads with zeros at the end if necessary. */
@@ -90,7 +91,7 @@ void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 			(*result)->n_sign = num->n_sign;
 			memcpy((*result)->n_value, num->n_value, num->n_len + num->n_scale);
 		}
-		return;
+		return precision;
 	}
 
 	/*
@@ -222,7 +223,12 @@ void bc_round(bc_num num, zend_long precision, zend_long mode, bc_num *result)
 	}
 
 check_zero:
-	if (bc_is_zero(*result)) {
-		(*result)->n_sign = PLUS;
+	{
+		size_t scale = (*result)->n_scale;
+		if (bc_is_zero(*result)) {
+			(*result)->n_sign = PLUS;
+			(*result)->n_scale = 0;
+		}
+		return scale;
 	}
 }

From 1c182674b09b88cb3ca954740504ba57aa1826ad Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Mon, 3 Mar 2025 13:12:21 +0100
Subject: [PATCH 07/37] Destroy temporary module classes in reverse order

We destroy classes of dl()'ed modules in clean_module_classes(), during
shutdown. Child classes of a module use structures of the parent class (such as
inherited properties), which are destroyed earlier, so we have a use-after-free
when destroying a child class.

Here I destroy classes in reverse order, as it is done in zend_shutdown() for
persistent classes.

Fixes GH-17961
Fixes GH-15367
---
 NEWS                          |  6 ++++
 Zend/zend_API.c               | 23 ++++++--------
 ext/dl_test/dl_test.c         | 12 ++++++++
 ext/dl_test/dl_test.stub.php  | 12 ++++++++
 ext/dl_test/dl_test_arginfo.h | 58 ++++++++++++++++++++++++++++++++++-
 5 files changed, 97 insertions(+), 14 deletions(-)

diff --git a/NEWS b/NEWS
index a6e51761301b8..3f4b5aa2bc83a 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,12 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.3.20
 
+- Core:
+  . Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction).
+    (Arnaud)
+  . Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown).
+    (Arnaud)
+
 - DOM:
   . Fix weird unpack behaviour in DOM. (nielsdos)
 
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 13c640a64dd51..47de6e7897546 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -22,6 +22,7 @@
 #include "zend.h"
 #include "zend_execute.h"
 #include "zend_API.h"
+#include "zend_hash.h"
 #include "zend_modules.h"
 #include "zend_extensions.h"
 #include "zend_constants.h"
@@ -3111,21 +3112,17 @@ ZEND_API zend_result zend_get_module_started(const char *module_name) /* {{{ */
 }
 /* }}} */
 
-static int clean_module_class(zval *el, void *arg) /* {{{ */
-{
-	zend_class_entry *ce = (zend_class_entry *)Z_PTR_P(el);
-	int module_number = *(int *)arg;
-	if (ce->type == ZEND_INTERNAL_CLASS && ce->info.internal.module->module_number == module_number) {
-		return ZEND_HASH_APPLY_REMOVE;
-	} else {
-		return ZEND_HASH_APPLY_KEEP;
-	}
-}
-/* }}} */
-
 static void clean_module_classes(int module_number) /* {{{ */
 {
-	zend_hash_apply_with_argument(EG(class_table), clean_module_class, (void *) &module_number);
+	/* Child classes may reuse structures from parent classes, so destroy in reverse order. */
+	Bucket *bucket;
+	ZEND_HASH_REVERSE_FOREACH_BUCKET(EG(class_table), bucket) {
+		zend_class_entry *ce = Z_CE(bucket->val);
+		if (ce->type == ZEND_INTERNAL_CLASS && ce->info.internal.module->module_number == module_number) {
+			zend_hash_del_bucket(EG(class_table), bucket);
+		}
+	} ZEND_HASH_FOREACH_END();
+
 }
 /* }}} */
 
diff --git a/ext/dl_test/dl_test.c b/ext/dl_test/dl_test.c
index 1121a96b9df8d..1176a874d6027 100644
--- a/ext/dl_test/dl_test.c
+++ b/ext/dl_test/dl_test.c
@@ -92,10 +92,22 @@ PHP_METHOD(DlTest, test)
 	RETURN_STR(retval);
 }
 
+PHP_METHOD(DlTestSuperClass, test)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+	RETURN_NULL();
+}
+
 /* {{{ PHP_MINIT_FUNCTION */
 PHP_MINIT_FUNCTION(dl_test)
 {
+	zend_class_entry *ce;
+
 	register_class_DlTest();
+	ce = register_class_DlTestSuperClass();
+	register_class_DlTestSubClass(ce);
+	register_class_DlTestAliasedClass();
 
 	/* Test backwards compatibility */
 	if (getenv("PHP_DL_TEST_USE_OLD_REGISTER_INI_ENTRIES")) {
diff --git a/ext/dl_test/dl_test.stub.php b/ext/dl_test/dl_test.stub.php
index cd8b3916bae2e..c2d8ff577780f 100644
--- a/ext/dl_test/dl_test.stub.php
+++ b/ext/dl_test/dl_test.stub.php
@@ -12,3 +12,15 @@ function dl_test_test2(string $str = ""): string {}
 class DlTest {
     public function test(string $str = ""): string {}
 }
+
+class DlTestSuperClass {
+    public int $a;
+    public function test(string $str = ""): string {}
+}
+
+class DlTestSubClass extends DlTestSuperClass {
+}
+
+/** @alias DlTestClassAlias */
+class DlTestAliasedClass {
+}
diff --git a/ext/dl_test/dl_test_arginfo.h b/ext/dl_test/dl_test_arginfo.h
index 0618bbdb222ca..549ac220b58bc 100644
--- a/ext/dl_test/dl_test_arginfo.h
+++ b/ext/dl_test/dl_test_arginfo.h
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: 2dbacf5282b0f8e53923ac70495c2da43c7237e3 */
+ * Stub hash: 0641a8eeff00e6c8083fe4a8639f970e3ba80db9 */
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_dl_test_test1, 0, 0, IS_VOID, 0)
 ZEND_END_ARG_INFO()
@@ -10,10 +10,13 @@ ZEND_END_ARG_INFO()
 
 #define arginfo_class_DlTest_test arginfo_dl_test_test2
 
+#define arginfo_class_DlTestSuperClass_test arginfo_dl_test_test2
+
 
 ZEND_FUNCTION(dl_test_test1);
 ZEND_FUNCTION(dl_test_test2);
 ZEND_METHOD(DlTest, test);
+ZEND_METHOD(DlTestSuperClass, test);
 
 
 static const zend_function_entry ext_functions[] = {
@@ -28,6 +31,22 @@ static const zend_function_entry class_DlTest_methods[] = {
 	ZEND_FE_END
 };
 
+
+static const zend_function_entry class_DlTestSuperClass_methods[] = {
+	ZEND_ME(DlTestSuperClass, test, arginfo_class_DlTestSuperClass_test, ZEND_ACC_PUBLIC)
+	ZEND_FE_END
+};
+
+
+static const zend_function_entry class_DlTestSubClass_methods[] = {
+	ZEND_FE_END
+};
+
+
+static const zend_function_entry class_DlTestAliasedClass_methods[] = {
+	ZEND_FE_END
+};
+
 static zend_class_entry *register_class_DlTest(void)
 {
 	zend_class_entry ce, *class_entry;
@@ -37,3 +56,40 @@ static zend_class_entry *register_class_DlTest(void)
 
 	return class_entry;
 }
+
+static zend_class_entry *register_class_DlTestSuperClass(void)
+{
+	zend_class_entry ce, *class_entry;
+
+	INIT_CLASS_ENTRY(ce, "DlTestSuperClass", class_DlTestSuperClass_methods);
+	class_entry = zend_register_internal_class_ex(&ce, NULL);
+
+	zval property_a_default_value;
+	ZVAL_UNDEF(&property_a_default_value);
+	zend_string *property_a_name = zend_string_init("a", sizeof("a") - 1, 1);
+	zend_declare_typed_property(class_entry, property_a_name, &property_a_default_value, ZEND_ACC_PUBLIC, NULL, (zend_type) ZEND_TYPE_INIT_MASK(MAY_BE_LONG));
+	zend_string_release(property_a_name);
+
+	return class_entry;
+}
+
+static zend_class_entry *register_class_DlTestSubClass(zend_class_entry *class_entry_DlTestSuperClass)
+{
+	zend_class_entry ce, *class_entry;
+
+	INIT_CLASS_ENTRY(ce, "DlTestSubClass", class_DlTestSubClass_methods);
+	class_entry = zend_register_internal_class_ex(&ce, class_entry_DlTestSuperClass);
+
+	return class_entry;
+}
+
+static zend_class_entry *register_class_DlTestAliasedClass(void)
+{
+	zend_class_entry ce, *class_entry;
+
+	INIT_CLASS_ENTRY(ce, "DlTestAliasedClass", class_DlTestAliasedClass_methods);
+	class_entry = zend_register_internal_class_ex(&ce, NULL);
+	zend_register_class_alias("DlTestClassAlias", class_entry);
+
+	return class_entry;
+}

From 5a8a98eae3bbb5ffecaca1aded4bfe81eb019db8 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 08:55:48 +0100
Subject: [PATCH 08/37] add new token

---
 Zend/zend_language_parser.y           | 1 +
 Zend/zend_language_scanner.l          | 4 ++++
 ext/tokenizer/tokenizer_data.c        | 1 +
 ext/tokenizer/tokenizer_data.stub.php | 5 +++++
 4 files changed, 11 insertions(+)

diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index c671b3a295e5c..480cdc8406d29 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -231,6 +231,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %token T_DOLLAR_OPEN_CURLY_BRACES "'${'"
 %token T_CURLY_OPEN      "'{$'"
 %token T_PAAMAYIM_NEKUDOTAYIM "'::'"
+%token T_INNER_REF       "':>'"
 %token T_NS_SEPARATOR    "'\\'"
 %token T_ELLIPSIS        "'...'"
 %token T_COALESCE        "'??'"
diff --git a/Zend/zend_language_scanner.l b/Zend/zend_language_scanner.l
index 7ae73875926eb..32668d3ee804b 100644
--- a/Zend/zend_language_scanner.l
+++ b/Zend/zend_language_scanner.l
@@ -1601,6 +1601,10 @@ OPTIONAL_WHITESPACE_OR_COMMENTS ({WHITESPACE}|{MULTI_LINE_COMMENT}|{SINGLE_LINE_
 	RETURN_TOKEN(T_PAAMAYIM_NEKUDOTAYIM);
 }
 
+<ST_IN_SCRIPTING>":>" {
+	RETURN_TOKEN(T_INNER_REF);
+}
+
 <ST_IN_SCRIPTING>"..." {
 	RETURN_TOKEN(T_ELLIPSIS);
 }
diff --git a/ext/tokenizer/tokenizer_data.c b/ext/tokenizer/tokenizer_data.c
index a046ab50e1498..59da06bc0bf17 100644
--- a/ext/tokenizer/tokenizer_data.c
+++ b/ext/tokenizer/tokenizer_data.c
@@ -167,6 +167,7 @@ char *get_token_type_name(int token_type)
 		case T_DOLLAR_OPEN_CURLY_BRACES: return "T_DOLLAR_OPEN_CURLY_BRACES";
 		case T_CURLY_OPEN: return "T_CURLY_OPEN";
 		case T_PAAMAYIM_NEKUDOTAYIM: return "T_DOUBLE_COLON";
+		case T_INNER_REF: return "T_INNER_REF";
 		case T_NS_SEPARATOR: return "T_NS_SEPARATOR";
 		case T_ELLIPSIS: return "T_ELLIPSIS";
 		case T_COALESCE: return "T_COALESCE";
diff --git a/ext/tokenizer/tokenizer_data.stub.php b/ext/tokenizer/tokenizer_data.stub.php
index 45f3c89f2de3a..ba9421aa65ae7 100644
--- a/ext/tokenizer/tokenizer_data.stub.php
+++ b/ext/tokenizer/tokenizer_data.stub.php
@@ -712,6 +712,11 @@
  * @cvalue T_PAAMAYIM_NEKUDOTAYIM
  */
 const T_PAAMAYIM_NEKUDOTAYIM = UNKNOWN;
+/**
+ * @var int
+ * @cvalue T_INNER_REF
+ */
+const T_INNER_REF = UNKNOWN;
 /**
  * @var int
  * @cvalue T_NS_SEPARATOR

From 716a4013c390d91fa91cf6b44d56134d0e6df35e Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 09:21:56 +0100
Subject: [PATCH 09/37] create the new grammar

---
 Zend/zend_language_parser.y | 42 ++++++++++++++++++++++++++++++-------
 1 file changed, 34 insertions(+), 8 deletions(-)

diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index 480cdc8406d29..402e7593acc98 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -276,7 +276,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %type <ast> ctor_arguments alt_if_stmt_without_else trait_adaptation_list lexical_vars
 %type <ast> lexical_var_list encaps_list
 %type <ast> array_pair non_empty_array_pair_list array_pair_list possible_array_pair
-%type <ast> isset_variable type return_type type_expr type_without_static
+%type <ast> isset_variable type return_type type_expr type_without_static inner_type_without_static
 %type <ast> identifier type_expr_without_static union_type_without_static_element union_type_without_static intersection_type_without_static
 %type <ast> inline_function union_type_element union_type intersection_type
 %type <ast> attributed_statement attributed_class_statement attributed_parameter
@@ -285,7 +285,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %type <ast> enum_declaration_statement enum_backing_type enum_case enum_case_expr
 %type <ast> function_name non_empty_member_modifiers
 %type <ast> property_hook property_hook_list optional_property_hook_list hooked_property property_hook_body
-%type <ast> optional_parameter_list
+%type <ast> optional_parameter_list inner_class_statement inner_class_modifiers inner_class_name_reference
 
 %type <num> returns_ref function fn is_reference is_variadic property_modifiers property_hook_modifiers
 %type <num> method_modifiers class_const_modifiers member_modifier optional_cpp_modifiers
@@ -865,9 +865,16 @@ type_expr_without_static:
 ;
 
 type_without_static:
-		T_ARRAY		{ $$ = zend_ast_create_ex(ZEND_AST_TYPE, IS_ARRAY); }
-	|	T_CALLABLE	{ $$ = zend_ast_create_ex(ZEND_AST_TYPE, IS_CALLABLE); }
-	|	name		{ $$ = $1; }
+		T_ARRAY						{ $$ = zend_ast_create_ex(ZEND_AST_TYPE, IS_ARRAY); }
+	|	T_CALLABLE					{ $$ = zend_ast_create_ex(ZEND_AST_TYPE, IS_CALLABLE); }
+	|	inner_type_without_static	{ $$ = $1; }
+;
+
+inner_type_without_static:
+		inner_type_without_static T_INNER_REF name
+			{ $$ = zend_ast_create(ZEND_AST_INNER_CLASS, $1, $3); }
+	| 	name
+			{ $$ = $1; }
 ;
 
 union_type_without_static_element:
@@ -942,6 +949,18 @@ class_statement_list:
 			{ $$ = zend_ast_create_list(0, ZEND_AST_STMT_LIST); }
 ;
 
+inner_class_statement:
+		T_CLASS T_STRING { $<num>$ = CG(zend_lineno); } extends_from implements_list backup_doc_comment '{' class_statement_list '}'
+			{ $$ = zend_ast_create_decl(ZEND_AST_CLASS, 0, $<num>3, $6, zend_ast_get_str($2), $4, $5, $8, NULL, NULL); }
+;
+
+inner_class_modifiers:
+		non_empty_member_modifiers
+			{ $$ = zend_modifier_list_to_flags(ZEND_MODIFIER_TARGET_INNER_CLASS, $1);
+			  if (!$$) { YYERROR; } }
+	|	%empty
+			{ $$ = ZEND_ACC_PUBLIC; }
+;
 
 attributed_class_statement:
 		property_modifiers optional_type_without_static property_list ';'
@@ -961,6 +980,8 @@ attributed_class_statement:
 			{ $$ = zend_ast_create_decl(ZEND_AST_METHOD, $3 | $1 | $12, $2, $5,
 				  zend_ast_get_str($4), $7, NULL, $11, $9, NULL); CG(extra_fn_flags) = $10; }
 	|	enum_case { $$ = $1; }
+	|	inner_class_modifiers inner_class_statement
+			{ $$ = $2; $$->attr = $1; }
 ;
 
 class_statement:
@@ -1413,11 +1434,16 @@ class_name:
 ;
 
 class_name_reference:
-		class_name		{ $$ = $1; }
-	|	new_variable	{ $$ = $1; }
-	|	'(' expr ')'	{ $$ = $2; }
+		inner_class_name_reference	{ $$ = $1; }
+	|	new_variable				{ $$ = $1; }
+	|	'(' expr ')'				{ $$ = $2; }
 ;
 
+inner_class_name_reference:
+		class_name		{ $$ = $1; }
+	|	inner_class_name_reference T_INNER_REF class_name
+			{ $$ = zend_ast_create(ZEND_AST_INNER_CLASS, $1, $3); }
+
 backticks_expr:
 		%empty
 			{ $$ = zend_ast_create_zval_from_str(ZSTR_EMPTY_ALLOC()); }

From 1388dcaab42082fa82c9db3ca3c59f276990e3bb Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 09:34:39 +0100
Subject: [PATCH 10/37] add new ast pieces

---
 Zend/zend_ast.h     | 1 +
 Zend/zend_compile.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Zend/zend_ast.h b/Zend/zend_ast.h
index d0dad8490c4e3..2bf4638f0348e 100644
--- a/Zend/zend_ast.h
+++ b/Zend/zend_ast.h
@@ -133,6 +133,7 @@ enum _zend_ast_kind {
 	ZEND_AST_YIELD,
 	ZEND_AST_COALESCE,
 	ZEND_AST_ASSIGN_COALESCE,
+	ZEND_AST_INNER_CLASS,
 
 	ZEND_AST_STATIC,
 	ZEND_AST_WHILE,
diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index a7ee8f9327c54..f57f6e3e4944c 100644
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -894,6 +894,7 @@ typedef enum {
 	ZEND_MODIFIER_TARGET_CONSTANT,
 	ZEND_MODIFIER_TARGET_CPP,
 	ZEND_MODIFIER_TARGET_PROPERTY_HOOK,
+	ZEND_MODIFIER_TARGET_INNER_CLASS,
 } zend_modifier_target;
 
 /* Used during AST construction */

From c3cc41ecb093d581e275e31590cd0f91fb4ae298 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 09:59:30 +0100
Subject: [PATCH 11/37] handle modifiers

---
 Zend/zend_compile.c                  | 33 ++++++++++++++++++++++++++++
 Zend/zend_language_parser.y          |  4 ++--
 tests/classes/inner_classes_001.phpt | 13 +++++++++++
 tests/classes/inner_classes_002.phpt | 13 +++++++++++
 tests/classes/inner_classes_003.phpt | 13 +++++++++++
 tests/classes/inner_classes_004.phpt | 13 +++++++++++
 tests/classes/inner_classes_005.phpt | 13 +++++++++++
 tests/classes/inner_classes_006.phpt | 13 +++++++++++
 8 files changed, 113 insertions(+), 2 deletions(-)
 create mode 100644 tests/classes/inner_classes_001.phpt
 create mode 100644 tests/classes/inner_classes_002.phpt
 create mode 100644 tests/classes/inner_classes_003.phpt
 create mode 100644 tests/classes/inner_classes_004.phpt
 create mode 100644 tests/classes/inner_classes_005.phpt
 create mode 100644 tests/classes/inner_classes_006.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index e5df485919942..c54bbf1f43b23 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -943,6 +943,8 @@ uint32_t zend_modifier_token_to_flag(zend_modifier_target target, uint32_t token
 		member = "parameter";
 	} else if (target == ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {
 		member = "property hook";
+	} else if (target == ZEND_MODIFIER_TARGET_INNER_CLASS) {
+		member = "inner class";
 	} else {
 		ZEND_UNREACHABLE();
 	}
@@ -1050,6 +1052,37 @@ uint32_t zend_add_member_modifier(uint32_t flags, uint32_t new_flag, zend_modifi
 			return 0;
 		}
 	}
+	if (target == ZEND_MODIFIER_TARGET_INNER_CLASS) {
+		if ((flags & ZEND_ACC_PPP_MASK) && (new_flag & ZEND_ACC_PPP_MASK)) {
+			zend_throw_exception(zend_ce_compile_error,
+				"Multiple access type modifiers are not allowed", 0);
+			return 0;
+		}
+
+		if ((flags & ZEND_ACC_STATIC) || (new_flag & ZEND_ACC_STATIC)) {
+			zend_throw_exception(zend_ce_compile_error,
+				"Static inner classes are not allowed", 0);
+			return 0;
+		}
+
+		if ((flags & ZEND_ACC_PUBLIC_SET) || (new_flag & ZEND_ACC_PUBLIC_SET)) {
+			zend_throw_exception(zend_ce_compile_error,
+				"Public(set) inner classes are not allowed", 0);
+			return 0;
+		}
+
+		if ((flags & ZEND_ACC_PROTECTED_SET) || (new_flag & ZEND_ACC_PROTECTED_SET)) {
+			zend_throw_exception(zend_ce_compile_error,
+				"Protected(set) inner classes are not allowed", 0);
+			return 0;
+		}
+
+		if ((flags & ZEND_ACC_PRIVATE_SET) || (new_flag & ZEND_ACC_PRIVATE_SET)) {
+			zend_throw_exception(zend_ce_compile_error,
+				"Private(set) inner classes are not allowed", 0);
+			return 0;
+		}
+	}
 	return new_flags;
 }
 /* }}} */
diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index 402e7593acc98..5396cf7e9df63 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -285,10 +285,10 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %type <ast> enum_declaration_statement enum_backing_type enum_case enum_case_expr
 %type <ast> function_name non_empty_member_modifiers
 %type <ast> property_hook property_hook_list optional_property_hook_list hooked_property property_hook_body
-%type <ast> optional_parameter_list inner_class_statement inner_class_modifiers inner_class_name_reference
+%type <ast> optional_parameter_list inner_class_statement inner_class_name_reference
 
 %type <num> returns_ref function fn is_reference is_variadic property_modifiers property_hook_modifiers
-%type <num> method_modifiers class_const_modifiers member_modifier optional_cpp_modifiers
+%type <num> method_modifiers class_const_modifiers member_modifier optional_cpp_modifiers inner_class_modifiers
 %type <num> class_modifiers class_modifier anonymous_class_modifiers anonymous_class_modifiers_optional use_type backup_fn_flags
 
 %type <ptr> backup_lex_pos
diff --git a/tests/classes/inner_classes_001.phpt b/tests/classes/inner_classes_001.phpt
new file mode 100644
index 0000000000000..ac1ce71cd3d40
--- /dev/null
+++ b/tests/classes/inner_classes_001.phpt
@@ -0,0 +1,13 @@
+--TEST--
+multiple access modifiers
+--FILE--
+<?php
+
+class Outer {
+    public private class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Multiple access type modifiers are not allowed in %s on line %d
diff --git a/tests/classes/inner_classes_002.phpt b/tests/classes/inner_classes_002.phpt
new file mode 100644
index 0000000000000..7e4fb38c3f2dd
--- /dev/null
+++ b/tests/classes/inner_classes_002.phpt
@@ -0,0 +1,13 @@
+--TEST--
+invalid inner class
+--FILE--
+<?php
+
+class Outer {
+    int class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Multiple access type modifiers are not allowed in %s on line %d
diff --git a/tests/classes/inner_classes_003.phpt b/tests/classes/inner_classes_003.phpt
new file mode 100644
index 0000000000000..3dd79008daa60
--- /dev/null
+++ b/tests/classes/inner_classes_003.phpt
@@ -0,0 +1,13 @@
+--TEST--
+static access modifiers
+--FILE--
+<?php
+
+class Outer {
+    static class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot use the static modifier on a inner class in %s on line %d
diff --git a/tests/classes/inner_classes_004.phpt b/tests/classes/inner_classes_004.phpt
new file mode 100644
index 0000000000000..a4e86484ed9ec
--- /dev/null
+++ b/tests/classes/inner_classes_004.phpt
@@ -0,0 +1,13 @@
+--TEST--
+public(set) inner class
+--FILE--
+<?php
+
+class Outer {
+    public(set) class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot use the public(set) modifier on a inner class in %s on line %d
diff --git a/tests/classes/inner_classes_005.phpt b/tests/classes/inner_classes_005.phpt
new file mode 100644
index 0000000000000..82d7f0e93676c
--- /dev/null
+++ b/tests/classes/inner_classes_005.phpt
@@ -0,0 +1,13 @@
+--TEST--
+protected(set) inner class
+--FILE--
+<?php
+
+class Outer {
+    protected(set) class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot use the protected(set) modifier on a inner class in %s on line %d
diff --git a/tests/classes/inner_classes_006.phpt b/tests/classes/inner_classes_006.phpt
new file mode 100644
index 0000000000000..41266b10b453f
--- /dev/null
+++ b/tests/classes/inner_classes_006.phpt
@@ -0,0 +1,13 @@
+--TEST--
+private(set) inner class
+--FILE--
+<?php
+
+class Outer {
+    private(set) class Inner {
+    }
+}
+
+?>
+--EXPECTF--
+Fatal error: Cannot use the private(set) modifier on a inner class in %s on line %d

From b9b93e6dd0228a5014621ee8d68904021eb47ddc Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 12:24:08 +0100
Subject: [PATCH 12/37] handle compiling class declarations

---
 Zend/zend.h                            |  3 ++
 Zend/zend_compile.c                    | 40 ++++++++++++++++++++++----
 ext/tokenizer/tokenizer_data_arginfo.h |  3 +-
 tests/classes/inner_classes_007.phpt   | 21 ++++++++++++++
 tests/classes/inner_classes_008.phpt   | 13 +++++++++
 5 files changed, 74 insertions(+), 6 deletions(-)
 create mode 100644 tests/classes/inner_classes_007.phpt
 create mode 100644 tests/classes/inner_classes_008.phpt

diff --git a/Zend/zend.h b/Zend/zend.h
index 0cf1faeb653fe..81ced0cf41a1d 100644
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -164,6 +164,9 @@ struct _zend_class_entry {
 	HashTable properties_info;
 	HashTable constants_table;
 
+	zend_class_entry *required_scope;
+	char required_scope_absolute;
+
 	ZEND_MAP_PTR_DEF(zend_class_mutable_data*, mutable_data);
 	zend_inheritance_cache_entry *inheritance_cache;
 
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index c54bbf1f43b23..d784a7086c367 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -9090,10 +9090,6 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 	if (EXPECTED((decl->flags & ZEND_ACC_ANON_CLASS) == 0)) {
 		zend_string *unqualified_name = decl->name;
 
-		if (CG(active_class_entry)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Class declarations may not be nested");
-		}
-
 		const char *type = "a class name";
 		if (decl->flags & ZEND_ACC_ENUM) {
 			type = "an enum name";
@@ -9103,7 +9099,41 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 			type = "a trait name";
 		}
 		zend_assert_valid_class_name(unqualified_name, type);
-		name = zend_prefix_with_ns(unqualified_name);
+
+		if (CG(active_class_entry) && CG(active_op_array)->function_name) {
+			zend_error_noreturn(E_COMPILE_ERROR, "Class declarations may not be declared inside functions");
+		}
+
+		if (CG(active_class_entry)) {
+			// rename the inner class so we may reference it by name
+			name = zend_string_concat3(
+				ZSTR_VAL(CG(active_class_entry)->name), ZSTR_LEN(CG(active_class_entry)->name),
+				":>", 2,
+				ZSTR_VAL(unqualified_name), ZSTR_LEN(unqualified_name)
+			);
+
+			// configure the current ce->flags for a nested class. This should only include:
+			// - final
+			// - readonly
+			// - abstract
+			ce->ce_flags |= decl->attr & (ZEND_ACC_FINAL|ZEND_ACC_READONLY|ZEND_ACC_ABSTRACT);
+
+			// configure the const stand-ins for a nested class. This should only include:
+			// - public
+			// - private
+			// - protected
+			int propFlags = decl->attr & (ZEND_ACC_PUBLIC|ZEND_ACC_PROTECTED|ZEND_ACC_PRIVATE);
+
+			// if a class is private or protected, we need to require the correct scope
+			ce->required_scope = propFlags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED) ? CG(active_class_entry) : NULL;
+			ce->required_scope_absolute = propFlags & ZEND_ACC_PRIVATE ? true : false;
+
+			// ensure the class is treated as a top-level class and not an anon class
+			toplevel = true;
+		} else {
+			name = zend_prefix_with_ns(unqualified_name);
+			ce->required_scope = NULL;
+		}
 		name = zend_new_interned_string(name);
 		lcname = zend_string_tolower(name);
 
diff --git a/ext/tokenizer/tokenizer_data_arginfo.h b/ext/tokenizer/tokenizer_data_arginfo.h
index 61f6ac1ec3659..a50c5de80c790 100644
--- a/ext/tokenizer/tokenizer_data_arginfo.h
+++ b/ext/tokenizer/tokenizer_data_arginfo.h
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: d917cab61a2b436a16d2227cdb438add45e42d69 */
+ * Stub hash: b9b93f604bff8f299fa3e008db9f61fccd603686 */
 
 static void register_tokenizer_data_symbols(int module_number)
 {
@@ -145,6 +145,7 @@ static void register_tokenizer_data_symbols(int module_number)
 	REGISTER_LONG_CONSTANT("T_DOLLAR_OPEN_CURLY_BRACES", T_DOLLAR_OPEN_CURLY_BRACES, CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("T_CURLY_OPEN", T_CURLY_OPEN, CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("T_PAAMAYIM_NEKUDOTAYIM", T_PAAMAYIM_NEKUDOTAYIM, CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("T_INNER_REF", T_INNER_REF, CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("T_NS_SEPARATOR", T_NS_SEPARATOR, CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("T_ELLIPSIS", T_ELLIPSIS, CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("T_COALESCE", T_COALESCE, CONST_PERSISTENT);
diff --git a/tests/classes/inner_classes_007.phpt b/tests/classes/inner_classes_007.phpt
new file mode 100644
index 0000000000000..8b53dd3b089b2
--- /dev/null
+++ b/tests/classes/inner_classes_007.phpt
@@ -0,0 +1,21 @@
+--TEST--
+simple declaration
+--FILE--
+<?php
+
+class Outer {
+    class Middle {
+        class Inner {}
+    }
+}
+
+var_dump(class_exists('Outer:>Middle'));
+var_dump(class_exists('Outer:>Middle:>Inner'));
+var_dump(class_exists(Outer:>Middle::class));
+var_dump(class_exists(Outer:>Middle:>Inner::class));
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
diff --git a/tests/classes/inner_classes_008.phpt b/tests/classes/inner_classes_008.phpt
new file mode 100644
index 0000000000000..d129f17a7b0a5
--- /dev/null
+++ b/tests/classes/inner_classes_008.phpt
@@ -0,0 +1,13 @@
+--TEST--
+nested inside function
+--FILE--
+<?php
+
+class Outer {
+    public function test() {
+        class Inner {}
+    }
+}
+?>
+--EXPECTF--
+Fatal error: Class declarations may not be declared inside functions in %s on line %d

From 0ac2ef0d5431d6a55a81e18698970d27171a52fb Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sat, 8 Mar 2025 21:27:45 +0100
Subject: [PATCH 13/37] add initial implementation; this adds all the initial
 opcode handling and special parts -- or the basics anyway.

---
 Zend/zend_compile.c     |  39 ++
 Zend/zend_opcode.c      |   4 +
 Zend/zend_vm_def.h      |  43 ++
 Zend/zend_vm_execute.h  | 290 +++++++++----
 Zend/zend_vm_handlers.h | 921 ++++++++++++++++++++--------------------
 Zend/zend_vm_opcodes.c  |   6 +-
 Zend/zend_vm_opcodes.h  |   3 +-
 7 files changed, 752 insertions(+), 554 deletions(-)

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index d784a7086c367..c6beae851093a 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2877,10 +2877,43 @@ static inline void zend_set_class_name_op1(zend_op *opline, znode *class_node) /
 }
 /* }}} */
 
+static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags);
+
+static void zend_compile_inner_class_ref(znode *result, zend_ast *ast) /* {{{ */
+{
+	zend_ast *outer_class = ast->child[0];
+	zend_ast *inner_class = ast->child[1];
+
+	znode outer_node, inner_node;
+
+	// handle nesting
+	if (outer_class->kind == ZEND_AST_INNER_CLASS) {
+		zend_compile_inner_class_ref(&outer_node, outer_class);
+	} else {
+		zend_compile_class_ref(&outer_node, outer_class, ZEND_FETCH_CLASS_EXCEPTION);
+	}
+
+	if (inner_class->kind == ZEND_AST_ZVAL && Z_TYPE_P(zend_ast_get_zval(inner_class)) == IS_STRING) {
+		ZVAL_STR(&inner_node.u.constant, zend_string_dup(Z_STR_P(zend_ast_get_zval(inner_class)), 0));
+		inner_node.op_type = IS_CONST;
+	} else {
+		zend_compile_expr(&inner_node, inner_class);
+	}
+
+	zend_op *opline = zend_emit_op(result, ZEND_FETCH_INNER_CLASS, &outer_node, &inner_node);
+	opline->extended_value = zend_alloc_cache_slot();
+}
+/* }}} */
+
 static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags) /* {{{ */
 {
 	uint32_t fetch_type;
 
+	if (name_ast->kind == ZEND_AST_INNER_CLASS) {
+		zend_compile_inner_class_ref(result, name_ast);
+		return;
+	}
+
 	if (name_ast->kind != ZEND_AST_ZVAL) {
 		znode name_node;
 
@@ -9127,6 +9160,9 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 			// if a class is private or protected, we need to require the correct scope
 			ce->required_scope = propFlags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED) ? CG(active_class_entry) : NULL;
 			ce->required_scope_absolute = propFlags & ZEND_ACC_PRIVATE ? true : false;
+			if (ce->required_scope) {
+				ce->required_scope->refcount ++;
+			}
 
 			// ensure the class is treated as a top-level class and not an anon class
 			toplevel = true;
@@ -11760,6 +11796,9 @@ static void zend_compile_expr_inner(znode *result, zend_ast *ast) /* {{{ */
 		case ZEND_AST_MATCH:
 			zend_compile_match(result, ast);
 			return;
+                        case ZEND_AST_INNER_CLASS:
+                          zend_compile_inner_class_ref(result, ast);
+                          return;
 		default:
 			ZEND_ASSERT(0 /* not supported */);
 	}
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index f32ae13e06793..b5ed1b7a9bc85 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -430,6 +430,10 @@ ZEND_API void destroy_zend_class(zval *zv)
 			if (ce->backed_enum_table) {
 				zend_hash_release(ce->backed_enum_table);
 			}
+			if (ce->required_scope) {
+				ce->required_scope->refcount--;
+				ce->required_scope = NULL;
+			}
 			break;
 		case ZEND_INTERNAL_CLASS:
 			if (ce->doc_comment) {
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 467b5c6193310..3959abffea271 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1798,6 +1798,49 @@ ZEND_VM_C_LABEL(fetch_this):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR, CONST, CACHE_SLOT)
+{
+	USE_OPLINE
+	SAVE_OPLINE();
+
+	zend_string *inner_class_name, *full_class_name;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+
+	if (OP1_TYPE == IS_CONST) {
+		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
+		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
+		if (!outer_ce) {
+			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			HANDLE_EXCEPTION();
+		}
+	} else {
+		outer_ce = CACHED_PTR(opline->extended_value);
+		if (UNEXPECTED(outer_ce == NULL)) {
+			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
+		}
+	}
+
+	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
+
+	full_class_name = zend_string_concat3(
+		ZSTR_VAL(outer_ce->name), ZSTR_LEN(outer_ce->name),
+		":>", 2,
+		ZSTR_VAL(inner_class_name), ZSTR_LEN(inner_class_name)
+	);
+
+	inner_ce = zend_lookup_class(full_class_name);
+	if (!inner_ce) {
+		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+	}
+
+	CACHE_PTR(opline->extended_value, inner_ce);
+	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
+
+	zend_string_release(full_class_name);
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 ZEND_VM_HANDLER(80, ZEND_FETCH_R, CONST|TMPVAR|CV, UNUSED, VAR_FETCH)
 {
 	ZEND_VM_DISPATCH_TO_HELPER(zend_fetch_var_address_helper, type, BP_VAR_R);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index e890f94cb08e2..36ae015622552 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6610,6 +6610,49 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_XOR_SPEC_CON
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	SAVE_OPLINE();
+
+	zend_string *inner_class_name, *full_class_name;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+
+	if (IS_CONST == IS_CONST) {
+		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
+		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
+		if (!outer_ce) {
+			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			HANDLE_EXCEPTION();
+		}
+	} else {
+		outer_ce = CACHED_PTR(opline->extended_value);
+		if (UNEXPECTED(outer_ce == NULL)) {
+			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
+		}
+	}
+
+	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
+
+	full_class_name = zend_string_concat3(
+		ZSTR_VAL(outer_ce->name), ZSTR_LEN(outer_ce->name),
+		":>", 2,
+		ZSTR_VAL(inner_class_name), ZSTR_LEN(inner_class_name)
+	);
+
+	inner_ce = zend_lookup_class(full_class_name);
+	if (!inner_ce) {
+		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+	}
+
+	CACHE_PTR(opline->extended_value, inner_ce);
+	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
+
+	zend_string_release(full_class_name);
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	USE_OPLINE
@@ -16127,6 +16170,49 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_XOR_SPEC_TMPVAR_CONST_HAN
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	SAVE_OPLINE();
+
+	zend_string *inner_class_name, *full_class_name;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+
+	if ((IS_TMP_VAR|IS_VAR) == IS_CONST) {
+		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
+		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
+		if (!outer_ce) {
+			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			HANDLE_EXCEPTION();
+		}
+	} else {
+		outer_ce = CACHED_PTR(opline->extended_value);
+		if (UNEXPECTED(outer_ce == NULL)) {
+			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
+		}
+	}
+
+	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
+
+	full_class_name = zend_string_concat3(
+		ZSTR_VAL(outer_ce->name), ZSTR_LEN(outer_ce->name),
+		":>", 2,
+		ZSTR_VAL(inner_class_name), ZSTR_LEN(inner_class_name)
+	);
+
+	inner_ce = zend_lookup_class(full_class_name);
+	if (!inner_ce) {
+		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+	}
+
+	CACHE_PTR(opline->extended_value, inner_ce);
+	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
+
+	zend_string_release(full_class_name);
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	USE_OPLINE
@@ -57643,6 +57729,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
 			(void*)&&ZEND_FRAMELESS_ICALL_3_SPEC_OBSERVER_LABEL,
 			(void*)&&ZEND_JMP_FRAMELESS_SPEC_CONST_LABEL,
 			(void*)&&ZEND_INIT_PARENT_PROPERTY_HOOK_CALL_SPEC_CONST_UNUSED_LABEL,
+			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_LABEL,
+			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_LABEL,
+			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_LABEL,
+			(void*)&&ZEND_NULL_LABEL,
+			(void*)&&ZEND_NULL_LABEL,
 			(void*)&&ZEND_INIT_FCALL_OFFSET_SPEC_CONST_LABEL,
 			(void*)&&ZEND_RECV_NOTYPE_SPEC_LABEL,
 			(void*)&&ZEND_NULL_LABEL,
@@ -59514,6 +59605,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
 				ZEND_BOOL_XOR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
 				VM_TRACE_OP_END(ZEND_BOOL_XOR_SPEC_CONST_CONST)
 				HYBRID_BREAK();
+			HYBRID_CASE(ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST):
+				VM_TRACE(ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST)
+				ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+				VM_TRACE_OP_END(ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST)
+				HYBRID_BREAK();
 			HYBRID_CASE(ZEND_FETCH_DIM_R_SPEC_CONST_CONST):
 				VM_TRACE(ZEND_FETCH_DIM_R_SPEC_CONST_CONST)
 				ZEND_FETCH_DIM_R_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -60784,6 +60880,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
 				ZEND_BOOL_XOR_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
 				VM_TRACE_OP_END(ZEND_BOOL_XOR_SPEC_TMPVAR_CONST)
 				HYBRID_BREAK();
+			HYBRID_CASE(ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST):
+				VM_TRACE(ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST)
+				ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+				VM_TRACE_OP_END(ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST)
+				HYBRID_BREAK();
 			HYBRID_CASE(ZEND_FETCH_DIM_R_SPEC_TMPVAR_CONST):
 				VM_TRACE(ZEND_FETCH_DIM_R_SPEC_TMPVAR_CONST)
 				ZEND_FETCH_DIM_R_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -66830,6 +66931,11 @@ void zend_vm_init(void)
 		ZEND_FRAMELESS_ICALL_3_SPEC_OBSERVER_HANDLER,
 		ZEND_JMP_FRAMELESS_SPEC_CONST_HANDLER,
 		ZEND_INIT_PARENT_PROPERTY_HOOK_CALL_SPEC_CONST_UNUSED_HANDLER,
+		ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_HANDLER,
+		ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER,
+		ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
 		ZEND_INIT_FCALL_OFFSET_SPEC_CONST_HANDLER,
 		ZEND_RECV_NOTYPE_SPEC_HANDLER,
 		ZEND_NULL_HANDLER,
@@ -67787,7 +67893,7 @@ void zend_vm_init(void)
 		1255,
 		1256 | SPEC_RULE_OP1,
 		1261 | SPEC_RULE_OP1,
-		3486,
+		3491,
 		1266 | SPEC_RULE_OP1,
 		1271 | SPEC_RULE_OP1,
 		1276 | SPEC_RULE_OP2,
@@ -67821,7 +67927,7 @@ void zend_vm_init(void)
 		1559 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		1584 | SPEC_RULE_OP1,
 		1589,
-		3486,
+		3491,
 		1590 | SPEC_RULE_OP1,
 		1595 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		1620 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
@@ -67952,52 +68058,52 @@ void zend_vm_init(void)
 		2573 | SPEC_RULE_OBSERVER,
 		2575,
 		2576,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
-		3486,
+		2577 | SPEC_RULE_OP1,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
+		3491,
 	};
 #if (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID)
 	zend_opcode_handler_funcs = labels;
@@ -68170,7 +68276,7 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2585 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2590 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 				if (op->op1_type < op->op2_type) {
 					zend_swap_operands(op);
 				}
@@ -68178,7 +68284,7 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2610 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2615 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 				if (op->op1_type < op->op2_type) {
 					zend_swap_operands(op);
 				}
@@ -68186,7 +68292,7 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2635 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2640 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 				if (op->op1_type < op->op2_type) {
 					zend_swap_operands(op);
 				}
@@ -68197,17 +68303,17 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2660 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+				spec = 2665 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
 			} else if (op1_info == MAY_BE_LONG && op2_info == MAY_BE_LONG) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2685 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+				spec = 2690 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2710 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+				spec = 2715 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
 			}
 			break;
 		case ZEND_MUL:
@@ -68218,17 +68324,17 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2735 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2740 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_LONG && op2_info == MAY_BE_LONG) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2760 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2765 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2785 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 2790 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 			}
 			break;
 		case ZEND_IS_IDENTICAL:
@@ -68239,14 +68345,14 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2810 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2815 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2885 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2890 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op->op1_type == IS_CV && (op->op2_type & (IS_CONST|IS_CV)) && !(op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) && !(op2_info & (MAY_BE_UNDEF|MAY_BE_REF))) {
-				spec = 3110 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 3115 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 			}
 			break;
 		case ZEND_IS_NOT_IDENTICAL:
@@ -68257,14 +68363,14 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2960 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2965 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3035 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 3040 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op->op1_type == IS_CV && (op->op2_type & (IS_CONST|IS_CV)) && !(op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) && !(op2_info & (MAY_BE_UNDEF|MAY_BE_REF))) {
-				spec = 3115 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
+				spec = 3120 | SPEC_RULE_OP2 | SPEC_RULE_COMMUTATIVE;
 			}
 			break;
 		case ZEND_IS_EQUAL:
@@ -68275,12 +68381,12 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2810 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2815 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2885 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2890 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			}
 			break;
 		case ZEND_IS_NOT_EQUAL:
@@ -68291,12 +68397,12 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 2960 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 2965 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3035 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
+				spec = 3040 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH | SPEC_RULE_COMMUTATIVE;
 			}
 			break;
 		case ZEND_IS_SMALLER:
@@ -68304,12 +68410,12 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3120 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+				spec = 3125 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3195 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+				spec = 3200 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
 			}
 			break;
 		case ZEND_IS_SMALLER_OR_EQUAL:
@@ -68317,79 +68423,79 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3270 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+				spec = 3275 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
 			} else if (op1_info == MAY_BE_DOUBLE && op2_info == MAY_BE_DOUBLE) {
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3345 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
+				spec = 3350 | SPEC_RULE_OP1 | SPEC_RULE_OP2 | SPEC_RULE_SMART_BRANCH;
 			}
 			break;
 		case ZEND_QM_ASSIGN:
 			if (op1_info == MAY_BE_LONG) {
-				spec = 3432 | SPEC_RULE_OP1;
-			} else if (op1_info == MAY_BE_DOUBLE) {
 				spec = 3437 | SPEC_RULE_OP1;
-			} else if ((op->op1_type == IS_CONST) ? !Z_REFCOUNTED_P(RT_CONSTANT(op, op->op1)) : (!(op1_info & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE))))) {
+			} else if (op1_info == MAY_BE_DOUBLE) {
 				spec = 3442 | SPEC_RULE_OP1;
+			} else if ((op->op1_type == IS_CONST) ? !Z_REFCOUNTED_P(RT_CONSTANT(op, op->op1)) : (!(op1_info & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE))))) {
+				spec = 3447 | SPEC_RULE_OP1;
 			}
 			break;
 		case ZEND_PRE_INC:
 			if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-				spec = 3420 | SPEC_RULE_RETVAL;
+				spec = 3425 | SPEC_RULE_RETVAL;
 			} else if (op1_info == MAY_BE_LONG) {
-				spec = 3422 | SPEC_RULE_RETVAL;
+				spec = 3427 | SPEC_RULE_RETVAL;
 			}
 			break;
 		case ZEND_PRE_DEC:
 			if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-				spec = 3424 | SPEC_RULE_RETVAL;
+				spec = 3429 | SPEC_RULE_RETVAL;
 			} else if (op1_info == MAY_BE_LONG) {
-				spec = 3426 | SPEC_RULE_RETVAL;
+				spec = 3431 | SPEC_RULE_RETVAL;
 			}
 			break;
 		case ZEND_POST_INC:
 			if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-				spec = 3428;
+				spec = 3433;
 			} else if (op1_info == MAY_BE_LONG) {
-				spec = 3429;
+				spec = 3434;
 			}
 			break;
 		case ZEND_POST_DEC:
 			if (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG) {
-				spec = 3430;
+				spec = 3435;
 			} else if (op1_info == MAY_BE_LONG) {
-				spec = 3431;
+				spec = 3436;
 			}
 			break;
 		case ZEND_JMP:
 			if (OP_JMP_ADDR(op, op->op1) > op) {
-				spec = 2584;
+				spec = 2589;
 			}
 			break;
 		case ZEND_INIT_FCALL:
 			if (Z_EXTRA_P(RT_CONSTANT(op, op->op2)) != 0) {
-				spec = 2577;
+				spec = 2582;
 			}
 			break;
 		case ZEND_RECV:
 			if (op->op2.num == MAY_BE_ANY) {
-				spec = 2578;
+				spec = 2583;
 			}
 			break;
 		case ZEND_SEND_VAL:
 			if (op->op1_type == IS_CONST && op->op2_type == IS_UNUSED && !Z_REFCOUNTED_P(RT_CONSTANT(op, op->op1))) {
-				spec = 3482;
+				spec = 3487;
 			}
 			break;
 		case ZEND_SEND_VAR_EX:
 			if (op->op2_type == IS_UNUSED && op->op2.num <= MAX_ARG_FLAG_NUM && (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
-				spec = 3477 | SPEC_RULE_OP1;
+				spec = 3482 | SPEC_RULE_OP1;
 			}
 			break;
 		case ZEND_FE_FETCH_R:
 			if (op->op2_type == IS_CV && (op1_info & (MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY) {
-				spec = 3484 | SPEC_RULE_RETVAL;
+				spec = 3489 | SPEC_RULE_RETVAL;
 			}
 			break;
 		case ZEND_FETCH_DIM_R:
@@ -68397,22 +68503,22 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t
 				if (op->op1_type == IS_CONST && op->op2_type == IS_CONST) {
 					break;
 				}
-				spec = 3447 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
+				spec = 3452 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
 			}
 			break;
 		case ZEND_SEND_VAL_EX:
 			if (op->op2_type == IS_UNUSED && op->op2.num <= MAX_ARG_FLAG_NUM && op->op1_type == IS_CONST && !Z_REFCOUNTED_P(RT_CONSTANT(op, op->op1))) {
-				spec = 3483;
+				spec = 3488;
 			}
 			break;
 		case ZEND_SEND_VAR:
 			if (op->op2_type == IS_UNUSED && (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
-				spec = 3472 | SPEC_RULE_OP1;
+				spec = 3477 | SPEC_RULE_OP1;
 			}
 			break;
 		case ZEND_COUNT:
 			if ((op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY) {
-				spec = 2579 | SPEC_RULE_OP1;
+				spec = 2584 | SPEC_RULE_OP1;
 			}
 			break;
 		case ZEND_BW_OR:
diff --git a/Zend/zend_vm_handlers.h b/Zend/zend_vm_handlers.h
index 7f3a3cb5de260..3bf5234bf696d 100644
--- a/Zend/zend_vm_handlers.h
+++ b/Zend/zend_vm_handlers.h
@@ -1372,502 +1372,505 @@
 	_(2574, ZEND_FRAMELESS_ICALL_3_SPEC_OBSERVER) \
 	_(2575, ZEND_JMP_FRAMELESS_SPEC_CONST) \
 	_(2576, ZEND_INIT_PARENT_PROPERTY_HOOK_CALL_SPEC_CONST_UNUSED) \
-	_(2577, ZEND_INIT_FCALL_OFFSET_SPEC_CONST) \
-	_(2578, ZEND_RECV_NOTYPE_SPEC) \
-	_(2580, ZEND_COUNT_ARRAY_SPEC_TMPVAR_UNUSED) \
-	_(2581, ZEND_COUNT_ARRAY_SPEC_TMPVAR_UNUSED) \
-	_(2583, ZEND_COUNT_ARRAY_SPEC_CV_UNUSED) \
-	_(2584, ZEND_JMP_FORWARD_SPEC) \
-	_(2590, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2591, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2592, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2594, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2577, ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST) \
+	_(2578, ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST) \
+	_(2579, ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST) \
+	_(2582, ZEND_INIT_FCALL_OFFSET_SPEC_CONST) \
+	_(2583, ZEND_RECV_NOTYPE_SPEC) \
+	_(2585, ZEND_COUNT_ARRAY_SPEC_TMPVAR_UNUSED) \
+	_(2586, ZEND_COUNT_ARRAY_SPEC_TMPVAR_UNUSED) \
+	_(2588, ZEND_COUNT_ARRAY_SPEC_CV_UNUSED) \
+	_(2589, ZEND_JMP_FORWARD_SPEC) \
 	_(2595, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
 	_(2596, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2597, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2599, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2605, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2606, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2607, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2609, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2615, ZEND_ADD_LONG_SPEC_TMPVARCV_CONST) \
-	_(2616, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2617, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2619, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2600, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2601, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2602, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2604, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2610, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2611, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2612, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2614, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2620, ZEND_ADD_LONG_SPEC_TMPVARCV_CONST) \
 	_(2621, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2622, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2624, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2630, ZEND_ADD_LONG_SPEC_TMPVARCV_CONST) \
-	_(2631, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2632, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2634, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2640, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2641, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2642, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2644, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2625, ZEND_ADD_LONG_SPEC_TMPVARCV_CONST) \
+	_(2626, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2627, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2629, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2635, ZEND_ADD_LONG_SPEC_TMPVARCV_CONST) \
+	_(2636, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2637, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2639, ZEND_ADD_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2645, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_CONST) \
 	_(2646, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2647, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2649, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2655, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2656, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2657, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2659, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2661, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
-	_(2662, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
-	_(2664, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
-	_(2665, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2666, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2667, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2669, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2650, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2651, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2652, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2654, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2660, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2661, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2662, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2664, ZEND_ADD_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2666, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
+	_(2667, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
+	_(2669, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_CONST_TMPVARCV) \
 	_(2670, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
 	_(2671, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2672, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2674, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2680, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2681, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2682, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2684, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2686, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
-	_(2687, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
-	_(2689, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
-	_(2690, ZEND_SUB_LONG_SPEC_TMPVARCV_CONST) \
-	_(2691, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2692, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2694, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2675, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2676, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2677, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2679, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2685, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2686, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2687, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2689, ZEND_SUB_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2691, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
+	_(2692, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
+	_(2694, ZEND_SUB_LONG_SPEC_CONST_TMPVARCV) \
 	_(2695, ZEND_SUB_LONG_SPEC_TMPVARCV_CONST) \
 	_(2696, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2697, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2699, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2705, ZEND_SUB_LONG_SPEC_TMPVARCV_CONST) \
-	_(2706, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2707, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2709, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2711, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(2712, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(2714, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(2715, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2716, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2717, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2719, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2700, ZEND_SUB_LONG_SPEC_TMPVARCV_CONST) \
+	_(2701, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2702, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2704, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2710, ZEND_SUB_LONG_SPEC_TMPVARCV_CONST) \
+	_(2711, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2712, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2714, ZEND_SUB_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2716, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(2717, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(2719, ZEND_SUB_DOUBLE_SPEC_CONST_TMPVARCV) \
 	_(2720, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_CONST) \
 	_(2721, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2722, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2724, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2730, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2731, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2732, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2734, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2740, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2741, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2742, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2744, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2725, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2726, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2727, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2729, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2735, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2736, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2737, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2739, ZEND_SUB_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2745, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
 	_(2746, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2747, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2749, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2755, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
-	_(2756, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2757, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2759, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
-	_(2765, ZEND_MUL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2766, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2767, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2769, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2750, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2751, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2752, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2754, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2760, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \
+	_(2761, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2762, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
+	_(2764, ZEND_MUL_LONG_NO_OVERFLOW_SPEC_TMPVARCV_TMPVARCV) \
 	_(2770, ZEND_MUL_LONG_SPEC_TMPVARCV_CONST) \
 	_(2771, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2772, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2774, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2780, ZEND_MUL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2781, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2782, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2784, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2790, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2791, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2792, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2794, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2775, ZEND_MUL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2776, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2777, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2779, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2785, ZEND_MUL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2786, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2787, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2789, ZEND_MUL_LONG_SPEC_TMPVARCV_TMPVARCV) \
 	_(2795, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_CONST) \
 	_(2796, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2797, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
 	_(2799, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2805, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2806, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2807, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2809, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2825, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2826, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2827, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2828, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2829, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2830, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2831, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2832, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2833, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2837, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2838, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2839, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2840, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2841, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2842, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2843, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2844, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2845, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2846, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2847, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2848, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2852, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2853, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2854, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2870, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2871, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2872, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2873, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2874, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2875, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2876, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2877, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2878, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2882, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2883, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2884, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2900, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2901, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2902, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2903, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2904, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2905, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2906, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2907, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2908, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2912, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2913, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2914, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2915, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2916, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2917, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2918, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2919, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2920, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2921, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2922, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2923, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2927, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2928, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2929, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2945, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(2946, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2947, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2948, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2949, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2950, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2951, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2952, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2953, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2957, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(2958, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2959, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2975, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2976, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2977, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2978, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2979, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2980, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2981, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2982, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2983, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2987, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2988, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2989, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2990, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(2991, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(2992, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(2993, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2994, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2995, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(2996, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(2997, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(2998, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3002, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3003, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3004, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3020, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(3021, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3022, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3023, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3024, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3025, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3026, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3027, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3028, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3032, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3033, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3034, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3050, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3051, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3052, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3053, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3054, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3055, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3056, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3057, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3058, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3062, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3063, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3064, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3065, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3066, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3067, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3068, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3069, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3070, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3071, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3072, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3073, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3077, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3078, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3079, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3095, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3096, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3097, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3098, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3099, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3100, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3101, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3102, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3103, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3107, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3108, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3109, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3110, ZEND_IS_IDENTICAL_NOTHROW_SPEC_CV_CONST) \
-	_(3114, ZEND_IS_IDENTICAL_NOTHROW_SPEC_CV_CV) \
-	_(3115, ZEND_IS_NOT_IDENTICAL_NOTHROW_SPEC_CV_CONST) \
-	_(3119, ZEND_IS_NOT_IDENTICAL_NOTHROW_SPEC_CV_CV) \
-	_(3123, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
-	_(3124, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3125, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3126, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
-	_(3127, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3128, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3132, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
-	_(3133, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3134, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3135, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
-	_(3136, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3137, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3138, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3139, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3140, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3141, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3142, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3143, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3147, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3148, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3149, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3150, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
-	_(3151, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3152, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3153, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3154, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3155, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3156, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3157, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3158, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3162, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3163, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3164, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3180, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
-	_(3181, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3182, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3183, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3184, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3185, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3186, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3187, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3188, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3192, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3193, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3194, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3198, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3199, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3200, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3201, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3202, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3203, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3207, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3208, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3209, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3210, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3211, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3212, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3213, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3214, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3215, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3216, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3217, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3218, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3222, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3223, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3224, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3225, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3226, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3227, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3228, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3229, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3230, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3231, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3232, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3233, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3237, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3238, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3239, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3255, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3256, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3257, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3258, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3259, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3260, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3261, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3262, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3263, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3267, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3268, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3269, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3273, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
-	_(3274, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3275, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3276, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
-	_(3277, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3278, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3282, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
-	_(3283, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3284, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3285, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(3286, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3287, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3288, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3289, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3290, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3291, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3292, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3293, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3297, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3298, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3299, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3300, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(3301, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3302, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3303, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3304, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3305, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3306, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3307, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3308, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3312, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3313, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3314, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3330, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
-	_(3331, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3332, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3333, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3334, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3335, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3336, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3337, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3338, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3342, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
-	_(3343, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3344, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3348, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3349, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3350, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3351, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3352, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3353, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3357, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
-	_(3358, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
-	_(3359, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
-	_(3360, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3361, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3362, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3363, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3364, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3365, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3366, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3367, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3368, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3372, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3373, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3374, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3375, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3376, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3377, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3378, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3379, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3380, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3381, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3382, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3383, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3387, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3388, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3389, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3405, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
-	_(3406, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
-	_(3407, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
-	_(3408, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3409, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3410, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3411, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3412, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3413, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3417, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
-	_(3418, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
-	_(3419, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
-	_(3420, ZEND_PRE_INC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_UNUSED) \
-	_(3421, ZEND_PRE_INC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_USED) \
-	_(3422, ZEND_PRE_INC_LONG_SPEC_CV_RETVAL_UNUSED) \
-	_(3423, ZEND_PRE_INC_LONG_SPEC_CV_RETVAL_USED) \
-	_(3424, ZEND_PRE_DEC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_UNUSED) \
-	_(3425, ZEND_PRE_DEC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_USED) \
-	_(3426, ZEND_PRE_DEC_LONG_SPEC_CV_RETVAL_UNUSED) \
-	_(3427, ZEND_PRE_DEC_LONG_SPEC_CV_RETVAL_USED) \
-	_(3428, ZEND_POST_INC_LONG_NO_OVERFLOW_SPEC_CV) \
-	_(3429, ZEND_POST_INC_LONG_SPEC_CV) \
-	_(3430, ZEND_POST_DEC_LONG_NO_OVERFLOW_SPEC_CV) \
-	_(3431, ZEND_POST_DEC_LONG_SPEC_CV) \
-	_(3432, ZEND_QM_ASSIGN_LONG_SPEC_CONST) \
-	_(3433, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
-	_(3434, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
-	_(3436, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
-	_(3437, ZEND_QM_ASSIGN_DOUBLE_SPEC_CONST) \
-	_(3438, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
-	_(3439, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
-	_(3441, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
-	_(3442, ZEND_QM_ASSIGN_NOREF_SPEC_CONST) \
-	_(3443, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
-	_(3444, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
-	_(3446, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
-	_(3448, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
-	_(3449, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
-	_(3451, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
-	_(3452, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_CONST) \
-	_(3453, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
-	_(3454, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
-	_(3456, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
+	_(2800, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2801, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2802, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2804, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2810, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2811, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2812, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2814, ZEND_MUL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2830, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2831, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2832, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2833, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2834, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2835, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2836, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2837, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2838, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2842, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2843, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2844, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2845, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2846, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2847, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2848, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2849, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2850, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2851, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2852, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2853, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2857, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2858, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2859, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2875, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2876, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2877, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2878, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2879, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2880, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2881, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2882, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2883, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2887, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2888, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2889, ZEND_IS_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2905, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2906, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2907, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2908, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2909, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2910, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2911, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2912, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2913, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2917, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2918, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2919, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2920, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2921, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2922, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2923, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2924, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2925, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2926, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2927, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2928, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2932, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2933, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2934, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2950, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(2951, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2952, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2953, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2954, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2955, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2956, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2957, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2958, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2962, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(2963, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2964, ZEND_IS_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2980, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2981, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2982, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2983, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2984, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2985, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2986, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2987, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2988, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2992, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2993, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(2994, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(2995, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(2996, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(2997, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(2998, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(2999, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3000, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3001, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3002, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3003, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3007, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3008, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3009, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3025, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(3026, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3027, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3028, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3029, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3030, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3031, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3032, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3033, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3037, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3038, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3039, ZEND_IS_NOT_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3055, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3056, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3057, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3058, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3059, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3060, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3061, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3062, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3063, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3067, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3068, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3069, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3070, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3071, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3072, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3073, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3074, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3075, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3076, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3077, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3078, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3082, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3083, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3084, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3100, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3101, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3102, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3103, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3104, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3105, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3106, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3107, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3108, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3112, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3113, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3114, ZEND_IS_NOT_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3115, ZEND_IS_IDENTICAL_NOTHROW_SPEC_CV_CONST) \
+	_(3119, ZEND_IS_IDENTICAL_NOTHROW_SPEC_CV_CV) \
+	_(3120, ZEND_IS_NOT_IDENTICAL_NOTHROW_SPEC_CV_CONST) \
+	_(3124, ZEND_IS_NOT_IDENTICAL_NOTHROW_SPEC_CV_CV) \
+	_(3128, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
+	_(3129, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3130, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3131, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
+	_(3132, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3133, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3137, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV) \
+	_(3138, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3139, ZEND_IS_SMALLER_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3140, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
+	_(3141, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3142, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3143, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3144, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3145, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3146, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3147, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3148, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3152, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3153, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3154, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3155, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
+	_(3156, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3157, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3158, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3159, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3160, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3161, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3162, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3163, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3167, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3168, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3169, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3185, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST) \
+	_(3186, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3187, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3188, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3189, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3190, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3191, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3192, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3193, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3197, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3198, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3199, ZEND_IS_SMALLER_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3203, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3204, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3205, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3206, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3207, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3208, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3212, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3213, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3214, ZEND_IS_SMALLER_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3215, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3216, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3217, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3218, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3219, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3220, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3221, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3222, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3223, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3227, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3228, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3229, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3230, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3231, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3232, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3233, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3234, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3235, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3236, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3237, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3238, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3242, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3243, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3244, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3260, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3261, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3262, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3263, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3264, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3265, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3266, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3267, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3268, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3272, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3273, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3274, ZEND_IS_SMALLER_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3278, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
+	_(3279, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3280, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3281, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
+	_(3282, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3283, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3287, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV) \
+	_(3288, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3289, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3290, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(3291, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3292, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3293, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3294, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3295, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3296, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3297, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3298, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3302, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3303, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3304, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3305, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(3306, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3307, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3308, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3309, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3310, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3311, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3312, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3313, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3317, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3318, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3319, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3335, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST) \
+	_(3336, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3337, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3338, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3339, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3340, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3341, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3342, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3343, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3347, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV) \
+	_(3348, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3349, ZEND_IS_SMALLER_OR_EQUAL_LONG_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3353, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3354, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3355, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3356, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3357, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3358, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3362, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV) \
+	_(3363, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPZ) \
+	_(3364, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_CONST_TMPVARCV_JMPNZ) \
+	_(3365, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3366, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3367, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3368, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3369, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3370, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3371, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3372, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3373, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3377, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3378, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3379, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3380, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3381, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3382, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3383, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3384, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3385, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3386, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3387, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3388, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3392, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3393, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3394, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3410, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST) \
+	_(3411, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPZ) \
+	_(3412, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_CONST_JMPNZ) \
+	_(3413, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3414, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3415, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3416, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3417, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3418, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3422, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV) \
+	_(3423, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPZ) \
+	_(3424, ZEND_IS_SMALLER_OR_EQUAL_DOUBLE_SPEC_TMPVARCV_TMPVARCV_JMPNZ) \
+	_(3425, ZEND_PRE_INC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_UNUSED) \
+	_(3426, ZEND_PRE_INC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_USED) \
+	_(3427, ZEND_PRE_INC_LONG_SPEC_CV_RETVAL_UNUSED) \
+	_(3428, ZEND_PRE_INC_LONG_SPEC_CV_RETVAL_USED) \
+	_(3429, ZEND_PRE_DEC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_UNUSED) \
+	_(3430, ZEND_PRE_DEC_LONG_NO_OVERFLOW_SPEC_CV_RETVAL_USED) \
+	_(3431, ZEND_PRE_DEC_LONG_SPEC_CV_RETVAL_UNUSED) \
+	_(3432, ZEND_PRE_DEC_LONG_SPEC_CV_RETVAL_USED) \
+	_(3433, ZEND_POST_INC_LONG_NO_OVERFLOW_SPEC_CV) \
+	_(3434, ZEND_POST_INC_LONG_SPEC_CV) \
+	_(3435, ZEND_POST_DEC_LONG_NO_OVERFLOW_SPEC_CV) \
+	_(3436, ZEND_POST_DEC_LONG_SPEC_CV) \
+	_(3437, ZEND_QM_ASSIGN_LONG_SPEC_CONST) \
+	_(3438, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
+	_(3439, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
+	_(3441, ZEND_QM_ASSIGN_LONG_SPEC_TMPVARCV) \
+	_(3442, ZEND_QM_ASSIGN_DOUBLE_SPEC_CONST) \
+	_(3443, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
+	_(3444, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
+	_(3446, ZEND_QM_ASSIGN_DOUBLE_SPEC_TMPVARCV) \
+	_(3447, ZEND_QM_ASSIGN_NOREF_SPEC_CONST) \
+	_(3448, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
+	_(3449, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
+	_(3451, ZEND_QM_ASSIGN_NOREF_SPEC_TMPVARCV) \
+	_(3453, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
+	_(3454, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
+	_(3456, ZEND_FETCH_DIM_R_INDEX_SPEC_CONST_TMPVARCV) \
 	_(3457, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_CONST) \
 	_(3458, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
 	_(3459, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
 	_(3461, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
-	_(3467, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_CONST) \
-	_(3468, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
-	_(3469, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
-	_(3471, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
-	_(3474, ZEND_SEND_VAR_SIMPLE_SPEC_VAR) \
-	_(3476, ZEND_SEND_VAR_SIMPLE_SPEC_CV) \
-	_(3479, ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_UNUSED) \
-	_(3481, ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_UNUSED) \
-	_(3482, ZEND_SEND_VAL_SIMPLE_SPEC_CONST) \
-	_(3483, ZEND_SEND_VAL_EX_SIMPLE_SPEC_CONST) \
-	_(3484, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_UNUSED) \
-	_(3485, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_USED) \
-	_(3485+1, ZEND_NULL)
+	_(3462, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_CONST) \
+	_(3463, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
+	_(3464, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
+	_(3466, ZEND_FETCH_DIM_R_INDEX_SPEC_TMPVAR_TMPVARCV) \
+	_(3472, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_CONST) \
+	_(3473, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
+	_(3474, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
+	_(3476, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
+	_(3479, ZEND_SEND_VAR_SIMPLE_SPEC_VAR) \
+	_(3481, ZEND_SEND_VAR_SIMPLE_SPEC_CV) \
+	_(3484, ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_UNUSED) \
+	_(3486, ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_UNUSED) \
+	_(3487, ZEND_SEND_VAL_SIMPLE_SPEC_CONST) \
+	_(3488, ZEND_SEND_VAL_EX_SIMPLE_SPEC_CONST) \
+	_(3489, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_UNUSED) \
+	_(3490, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_USED) \
+	_(3490+1, ZEND_NULL)
diff --git a/Zend/zend_vm_opcodes.c b/Zend/zend_vm_opcodes.c
index 202dfd3f734f3..b1e6c2950fd6d 100644
--- a/Zend/zend_vm_opcodes.c
+++ b/Zend/zend_vm_opcodes.c
@@ -22,7 +22,7 @@
 #include <zend.h>
 #include <zend_vm_opcodes.h>
 
-static const char *zend_vm_opcodes_names[210] = {
+static const char *zend_vm_opcodes_names[211] = {
 	"ZEND_NOP",
 	"ZEND_ADD",
 	"ZEND_SUB",
@@ -233,9 +233,10 @@ static const char *zend_vm_opcodes_names[210] = {
 	"ZEND_FRAMELESS_ICALL_3",
 	"ZEND_JMP_FRAMELESS",
 	"ZEND_INIT_PARENT_PROPERTY_HOOK_CALL",
+	"ZEND_FETCH_INNER_CLASS",
 };
 
-static uint32_t zend_vm_opcodes_flags[210] = {
+static uint32_t zend_vm_opcodes_flags[211] = {
 	0x00000000,
 	0x00000b0b,
 	0x00000b0b,
@@ -446,6 +447,7 @@ static uint32_t zend_vm_opcodes_flags[210] = {
 	0x00000000,
 	0x01042003,
 	0x01001103,
+	0x00040307,
 };
 
 ZEND_API const char* ZEND_FASTCALL zend_get_opcode_name(uint8_t opcode) {
diff --git a/Zend/zend_vm_opcodes.h b/Zend/zend_vm_opcodes.h
index d472b5b9660f5..9734d26ee768e 100644
--- a/Zend/zend_vm_opcodes.h
+++ b/Zend/zend_vm_opcodes.h
@@ -291,7 +291,8 @@ END_EXTERN_C()
 #define ZEND_FRAMELESS_ICALL_3              207
 #define ZEND_JMP_FRAMELESS                  208
 #define ZEND_INIT_PARENT_PROPERTY_HOOK_CALL 209
+#define ZEND_FETCH_INNER_CLASS              210
 
-#define ZEND_VM_LAST_OPCODE                 209
+#define ZEND_VM_LAST_OPCODE                 210
 
 #endif

From 17bd2ccc2deeb765445ded1e48511db887f8541f Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 09:46:32 +0100
Subject: [PATCH 14/37] get return types working

---
 Zend/zend_compile.c                  | 33 ++++++++++++++++++++++++++++
 Zend/zend_language_parser.y          | 11 ++++------
 tests/classes/inner_classes_009.phpt | 20 +++++++++++++++++
 tests/classes/inner_classes_010.phpt | 18 +++++++++++++++
 4 files changed, 75 insertions(+), 7 deletions(-)
 create mode 100644 tests/classes/inner_classes_009.phpt
 create mode 100644 tests/classes/inner_classes_010.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index c6beae851093a..46379d775f6b4 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -7018,6 +7018,36 @@ ZEND_API void zend_set_function_arg_flags(zend_function *func) /* {{{ */
 }
 /* }}} */
 
+static zend_string *zend_resolve_nested_class_name(zend_ast *ast)
+{
+	ZEND_ASSERT(ast->kind == ZEND_AST_INNER_CLASS);
+
+	zend_ast *outer_class = ast->child[0];
+	zend_ast *inner_class = ast->child[1];
+
+	zend_string *outer_name, *inner_name, *full_name;
+
+	if (outer_class->kind == ZEND_AST_INNER_CLASS) {
+		full_name = zend_resolve_nested_class_name(outer_class);
+	} else {
+		zval outer_class_name;
+		zend_try_compile_const_expr_resolve_class_name(&outer_class_name, outer_class);
+		outer_name = Z_STR(outer_class_name);
+	}
+
+	inner_name = zend_ast_get_str(inner_class);
+
+	full_name = zend_string_concat3(
+		ZSTR_VAL(outer_name), ZSTR_LEN(outer_name),
+		":>", 2,
+		ZSTR_VAL(inner_name), ZSTR_LEN(inner_name)
+	);
+
+	zend_string_release(outer_name);
+
+	return full_name;
+}
+
 static zend_type zend_compile_single_typename(zend_ast *ast)
 {
 	ZEND_ASSERT(!(ast->attr & ZEND_TYPE_NULLABLE));
@@ -7382,6 +7412,9 @@ static zend_type zend_compile_typename_ex(
 			ZEND_TYPE_FULL_MASK(type) |= _ZEND_TYPE_INTERSECTION_BIT;
 			ZEND_TYPE_FULL_MASK(type) |= _ZEND_TYPE_ARENA_BIT;
 		}
+	} else if (ast->kind == ZEND_AST_INNER_CLASS) {
+		zend_string *name = zend_resolve_nested_class_name(ast);
+		return (zend_type) ZEND_TYPE_INIT_CLASS(name, /* allow null */ false, 0);
 	} else {
 		type = zend_compile_single_typename(ast);
 	}
diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index 5396cf7e9df63..bc2082c5cc73e 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -285,7 +285,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 %type <ast> enum_declaration_statement enum_backing_type enum_case enum_case_expr
 %type <ast> function_name non_empty_member_modifiers
 %type <ast> property_hook property_hook_list optional_property_hook_list hooked_property property_hook_body
-%type <ast> optional_parameter_list inner_class_statement inner_class_name_reference
+%type <ast> optional_parameter_list inner_class_statement
 
 %type <num> returns_ref function fn is_reference is_variadic property_modifiers property_hook_modifiers
 %type <num> method_modifiers class_const_modifiers member_modifier optional_cpp_modifiers inner_class_modifiers
@@ -1431,19 +1431,16 @@ class_name:
 			{ zval zv; ZVAL_INTERNED_STR(&zv, ZSTR_KNOWN(ZEND_STR_STATIC));
 			  $$ = zend_ast_create_zval_ex(&zv, ZEND_NAME_NOT_FQ); }
 	|	name { $$ = $1; }
+	| class_name T_INNER_REF name
+			{ $$ = zend_ast_create(ZEND_AST_INNER_CLASS, $1, $3); }
 ;
 
 class_name_reference:
-		inner_class_name_reference	{ $$ = $1; }
+		class_name	{ $$ = $1; }
 	|	new_variable				{ $$ = $1; }
 	|	'(' expr ')'				{ $$ = $2; }
 ;
 
-inner_class_name_reference:
-		class_name		{ $$ = $1; }
-	|	inner_class_name_reference T_INNER_REF class_name
-			{ $$ = zend_ast_create(ZEND_AST_INNER_CLASS, $1, $3); }
-
 backticks_expr:
 		%empty
 			{ $$ = zend_ast_create_zval_from_str(ZSTR_EMPTY_ALLOC()); }
diff --git a/tests/classes/inner_classes_009.phpt b/tests/classes/inner_classes_009.phpt
new file mode 100644
index 0000000000000..13c84de709caa
--- /dev/null
+++ b/tests/classes/inner_classes_009.phpt
@@ -0,0 +1,20 @@
+--TEST--
+basic nested classes
+--FILE--
+<?php
+
+namespace Foo;
+
+class Outer {
+    class Middle {
+        class Inner {
+            public function test() {
+                echo __CLASS__;
+            }
+        }
+    }
+}
+new Outer:>Middle:>Inner()->test();
+?>
+--EXPECT--
+Foo\Outer:>Middle:>Inner
diff --git a/tests/classes/inner_classes_010.phpt b/tests/classes/inner_classes_010.phpt
new file mode 100644
index 0000000000000..d7190df3644d0
--- /dev/null
+++ b/tests/classes/inner_classes_010.phpt
@@ -0,0 +1,18 @@
+--TEST--
+test return types
+--FILE--
+<?php
+
+class Outer {
+    class Inner {
+        public static function test(): Outer:>Inner {
+            return new Outer:>Inner();
+        }
+    }
+}
+
+var_dump(Outer:>Inner::test());
+?>
+--EXPECT--
+object(Outer:>Inner)#1 (0) {
+}

From eef0b95a69f020ca67695d1f1ee7b881ab0f0b9d Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 14:15:22 +0100
Subject: [PATCH 15/37] make ::class work

---
 Zend/zend_compile.c | 74 +++++++++++++++++++++++++--------------------
 1 file changed, 41 insertions(+), 33 deletions(-)

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 46379d775f6b4..f8521035a4c26 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1820,11 +1820,49 @@ static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
 }
 /* }}} */
 
+static bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast);
+
+static zend_string *zend_resolve_nested_class_name(zend_ast *ast) /* {{{ */
+{
+	ZEND_ASSERT(ast->kind == ZEND_AST_INNER_CLASS);
+
+	zend_ast *outer_class = ast->child[0];
+	zend_ast *inner_class = ast->child[1];
+
+	zend_string *outer_name, *inner_name, *full_name;
+
+	if (outer_class->kind == ZEND_AST_INNER_CLASS) {
+		outer_name = zend_resolve_nested_class_name(outer_class);
+	} else {
+		zval outer_class_name;
+		zend_try_compile_const_expr_resolve_class_name(&outer_class_name, outer_class);
+		outer_name = Z_STR(outer_class_name);
+	}
+
+	inner_name = zend_ast_get_str(inner_class);
+
+	full_name = zend_string_concat3(
+		ZSTR_VAL(outer_name), ZSTR_LEN(outer_name),
+		":>", 2,
+		ZSTR_VAL(inner_name), ZSTR_LEN(inner_name)
+	);
+
+	zend_string_release(outer_name);
+
+	return full_name;
+}
+/* }}} */
+
 static bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast) /* {{{ */
 {
 	uint32_t fetch_type;
 	zval *class_name;
 
+	if (class_ast->kind == ZEND_AST_INNER_CLASS) {
+		ZVAL_STR(zv, zend_resolve_nested_class_name(class_ast));
+		return 1;
+	}
+
 	if (class_ast->kind != ZEND_AST_ZVAL) {
 		return 0;
 	}
@@ -7018,36 +7056,6 @@ ZEND_API void zend_set_function_arg_flags(zend_function *func) /* {{{ */
 }
 /* }}} */
 
-static zend_string *zend_resolve_nested_class_name(zend_ast *ast)
-{
-	ZEND_ASSERT(ast->kind == ZEND_AST_INNER_CLASS);
-
-	zend_ast *outer_class = ast->child[0];
-	zend_ast *inner_class = ast->child[1];
-
-	zend_string *outer_name, *inner_name, *full_name;
-
-	if (outer_class->kind == ZEND_AST_INNER_CLASS) {
-		full_name = zend_resolve_nested_class_name(outer_class);
-	} else {
-		zval outer_class_name;
-		zend_try_compile_const_expr_resolve_class_name(&outer_class_name, outer_class);
-		outer_name = Z_STR(outer_class_name);
-	}
-
-	inner_name = zend_ast_get_str(inner_class);
-
-	full_name = zend_string_concat3(
-		ZSTR_VAL(outer_name), ZSTR_LEN(outer_name),
-		":>", 2,
-		ZSTR_VAL(inner_name), ZSTR_LEN(inner_name)
-	);
-
-	zend_string_release(outer_name);
-
-	return full_name;
-}
-
 static zend_type zend_compile_single_typename(zend_ast *ast)
 {
 	ZEND_ASSERT(!(ast->attr & ZEND_TYPE_NULLABLE));
@@ -11829,9 +11837,9 @@ static void zend_compile_expr_inner(znode *result, zend_ast *ast) /* {{{ */
 		case ZEND_AST_MATCH:
 			zend_compile_match(result, ast);
 			return;
-                        case ZEND_AST_INNER_CLASS:
-                          zend_compile_inner_class_ref(result, ast);
-                          return;
+		case ZEND_AST_INNER_CLASS:
+			zend_compile_inner_class_ref(result, ast);
+			return;
 		default:
 			ZEND_ASSERT(0 /* not supported */);
 	}

From f6006adb5d7db1524bace17014b4413425f98c1b Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 14:16:19 +0100
Subject: [PATCH 16/37] fix failing test

---
 tests/classes/inner_classes_002.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/classes/inner_classes_002.phpt b/tests/classes/inner_classes_002.phpt
index 7e4fb38c3f2dd..9c9eee89387b0 100644
--- a/tests/classes/inner_classes_002.phpt
+++ b/tests/classes/inner_classes_002.phpt
@@ -10,4 +10,4 @@ class Outer {
 
 ?>
 --EXPECTF--
-Fatal error: Multiple access type modifiers are not allowed in %s on line %d
+Parse error: syntax error, unexpected identifier "int", expecting "class" in %s on line %d

From 1b85087fea665182efe1d1eaabfac9e642add8de Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 14:20:09 +0100
Subject: [PATCH 17/37] add another class

---
 tests/classes/inner_classes_011.phpt | 30 ++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 tests/classes/inner_classes_011.phpt

diff --git a/tests/classes/inner_classes_011.phpt b/tests/classes/inner_classes_011.phpt
new file mode 100644
index 0000000000000..e656a9648a2ca
--- /dev/null
+++ b/tests/classes/inner_classes_011.phpt
@@ -0,0 +1,30 @@
+--TEST--
+::class, statics, and inner classes
+--FILE--
+<?php
+
+class Outer {
+    class Middle {
+        public const FOO = 'foo';
+        public static int $bar = 42;
+        class Inner {
+            public const FOO = 'foo';
+            public static int $bar = 42;
+        }
+    }
+}
+
+var_dump(Outer:>Middle::class);
+var_dump(Outer:>Middle::FOO);
+var_dump(Outer:>Middle::$bar);
+var_dump(Outer:>Middle:>Inner::class);
+var_dump(Outer:>Middle:>Inner::FOO);
+var_dump(Outer:>Middle:>Inner::$bar);
+?>
+--EXPECT--
+string(13) "Outer:>Middle"
+string(3) "foo"
+int(42)
+string(20) "Outer:>Middle:>Inner"
+string(3) "foo"
+int(42)

From 3d46bc2f4f633aa51b0049859b0d7b7b1416700a Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 17:39:27 +0100
Subject: [PATCH 18/37] add more tests to validate scope resolution keywords

---
 Zend/zend_compile.c                  |  68 +++++------
 Zend/zend_vm_def.h                   |  38 ++++++-
 Zend/zend_vm_execute.h               | 161 ++++++++++++++++++++++++++-
 Zend/zend_vm_handlers.h              |   1 +
 tests/classes/inner_classes_012.phpt |  43 +++++++
 5 files changed, 275 insertions(+), 36 deletions(-)
 create mode 100644 tests/classes/inner_classes_012.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index f8521035a4c26..84522d2d957df 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1793,33 +1793,6 @@ static uint32_t zend_get_class_fetch_type_ast(zend_ast *name_ast) /* {{{ */
 }
 /* }}} */
 
-static zend_string *zend_resolve_const_class_name_reference(zend_ast *ast, const char *type)
-{
-	zend_string *class_name = zend_ast_get_str(ast);
-	if (ZEND_FETCH_CLASS_DEFAULT != zend_get_class_fetch_type_ast(ast)) {
-		zend_error_noreturn(E_COMPILE_ERROR,
-			"Cannot use \"%s\" as %s, as it is reserved",
-			ZSTR_VAL(class_name), type);
-	}
-	return zend_resolve_class_name(class_name, ast->attr);
-}
-
-static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
-{
-	if (fetch_type != ZEND_FETCH_CLASS_DEFAULT && zend_is_scope_known()) {
-		zend_class_entry *ce = CG(active_class_entry);
-		if (!ce) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use \"%s\" when no class scope is active",
-				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
-				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
-		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT && !ce->parent_name) {
-			zend_error_noreturn(E_COMPILE_ERROR,
-				"Cannot use \"parent\" when current class scope has no parent");
-		}
-	}
-}
-/* }}} */
-
 static bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast);
 
 static zend_string *zend_resolve_nested_class_name(zend_ast *ast) /* {{{ */
@@ -1853,6 +1826,37 @@ static zend_string *zend_resolve_nested_class_name(zend_ast *ast) /* {{{ */
 }
 /* }}} */
 
+static zend_string *zend_resolve_const_class_name_reference(zend_ast *ast, const char *type)
+{
+	if (ast->kind == ZEND_AST_INNER_CLASS) {
+		return zend_resolve_nested_class_name(ast);
+	}
+
+	zend_string *class_name = zend_ast_get_str(ast);
+	if (ZEND_FETCH_CLASS_DEFAULT != zend_get_class_fetch_type_ast(ast)) {
+		zend_error_noreturn(E_COMPILE_ERROR,
+			"Cannot use \"%s\" as %s, as it is reserved",
+			ZSTR_VAL(class_name), type);
+	}
+	return zend_resolve_class_name(class_name, ast->attr);
+}
+
+static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
+{
+	if (fetch_type != ZEND_FETCH_CLASS_DEFAULT && zend_is_scope_known()) {
+		zend_class_entry *ce = CG(active_class_entry);
+		if (!ce) {
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use \"%s\" when no class scope is active",
+				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
+				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
+		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT && !ce->parent_name) {
+			zend_error_noreturn(E_COMPILE_ERROR,
+				"Cannot use \"parent\" when current class scope has no parent");
+		}
+	}
+}
+/* }}} */
+
 static bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast) /* {{{ */
 {
 	uint32_t fetch_type;
@@ -2917,7 +2921,7 @@ static inline void zend_set_class_name_op1(zend_op *opline, znode *class_node) /
 
 static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t fetch_flags);
 
-static void zend_compile_inner_class_ref(znode *result, zend_ast *ast) /* {{{ */
+static void zend_compile_inner_class_ref(znode *result, zend_ast *ast, uint32_t fetch_flags) /* {{{ */
 {
 	zend_ast *outer_class = ast->child[0];
 	zend_ast *inner_class = ast->child[1];
@@ -2926,9 +2930,9 @@ static void zend_compile_inner_class_ref(znode *result, zend_ast *ast) /* {{{ */
 
 	// handle nesting
 	if (outer_class->kind == ZEND_AST_INNER_CLASS) {
-		zend_compile_inner_class_ref(&outer_node, outer_class);
+		zend_compile_inner_class_ref(&outer_node, outer_class, fetch_flags);
 	} else {
-		zend_compile_class_ref(&outer_node, outer_class, ZEND_FETCH_CLASS_EXCEPTION);
+		zend_compile_class_ref(&outer_node, outer_class, fetch_flags);
 	}
 
 	if (inner_class->kind == ZEND_AST_ZVAL && Z_TYPE_P(zend_ast_get_zval(inner_class)) == IS_STRING) {
@@ -2948,7 +2952,7 @@ static void zend_compile_class_ref(znode *result, zend_ast *name_ast, uint32_t f
 	uint32_t fetch_type;
 
 	if (name_ast->kind == ZEND_AST_INNER_CLASS) {
-		zend_compile_inner_class_ref(result, name_ast);
+		zend_compile_inner_class_ref(result, name_ast, fetch_flags);
 		return;
 	}
 
@@ -11838,7 +11842,7 @@ static void zend_compile_expr_inner(znode *result, zend_ast *ast) /* {{{ */
 			zend_compile_match(result, ast);
 			return;
 		case ZEND_AST_INNER_CLASS:
-			zend_compile_inner_class_ref(result, ast);
+			zend_compile_inner_class_ref(result, ast, ZEND_FETCH_CLASS_EXCEPTION);
 			return;
 		default:
 			ZEND_ASSERT(0 /* not supported */);
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 3959abffea271..fc747afbc393e 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1798,7 +1798,7 @@ ZEND_VM_C_LABEL(fetch_this):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR, CONST, CACHE_SLOT)
+ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_SLOT)
 {
 	USE_OPLINE
 	SAVE_OPLINE();
@@ -1813,6 +1813,42 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR, CONST, CACHE_SLOT)
 			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
 			HANDLE_EXCEPTION();
 		}
+	} else if (OP1_TYPE == IS_UNUSED) {
+		uint32_t fetch_type;
+		zend_class_entry *called_scope, *scope;
+
+		fetch_type = opline->op1.num;
+		scope = EX(func)->op_array.scope;
+		if (UNEXPECTED(scope == NULL)) {
+			SAVE_OPLINE();
+			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
+				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
+				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
+			ZVAL_UNDEF(EX_VAR(opline->result.var));
+			HANDLE_EXCEPTION();
+		}
+		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+			outer_ce = scope;
+		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+			if (UNEXPECTED(scope->parent == NULL)) {
+				SAVE_OPLINE();
+				zend_throw_error(NULL,
+					"Cannot use \"parent\" when current class scope has no parent");
+				ZVAL_UNDEF(EX_VAR(opline->result.var));
+				HANDLE_EXCEPTION();
+			}
+			outer_ce = scope->parent;
+		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+			if (Z_TYPE(EX(This)) == IS_OBJECT) {
+				called_scope = Z_OBJCE(EX(This));
+			} else {
+				called_scope = Z_CE(EX(This));
+			}
+			outer_ce = called_scope;
+		} else {
+			zend_throw_error(NULL, "Unknown scope resolution");
+			HANDLE_EXCEPTION();
+		}
 	} else {
 		outer_ce = CACHED_PTR(opline->extended_value);
 		if (UNEXPECTED(outer_ce == NULL)) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 36ae015622552..3b407d62c7bba 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6625,6 +6625,42 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
 			HANDLE_EXCEPTION();
 		}
+	} else if (IS_CONST == IS_UNUSED) {
+		uint32_t fetch_type;
+		zend_class_entry *called_scope, *scope;
+
+		fetch_type = opline->op1.num;
+		scope = EX(func)->op_array.scope;
+		if (UNEXPECTED(scope == NULL)) {
+			SAVE_OPLINE();
+			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
+				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
+				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
+			ZVAL_UNDEF(EX_VAR(opline->result.var));
+			HANDLE_EXCEPTION();
+		}
+		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+			outer_ce = scope;
+		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+			if (UNEXPECTED(scope->parent == NULL)) {
+				SAVE_OPLINE();
+				zend_throw_error(NULL,
+					"Cannot use \"parent\" when current class scope has no parent");
+				ZVAL_UNDEF(EX_VAR(opline->result.var));
+				HANDLE_EXCEPTION();
+			}
+			outer_ce = scope->parent;
+		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+			if (Z_TYPE(EX(This)) == IS_OBJECT) {
+				called_scope = Z_OBJCE(EX(This));
+			} else {
+				called_scope = Z_CE(EX(This));
+			}
+			outer_ce = called_scope;
+		} else {
+			zend_throw_error(NULL, "Unknown scope resolution");
+			HANDLE_EXCEPTION();
+		}
 	} else {
 		outer_ce = CACHED_PTR(opline->extended_value);
 		if (UNEXPECTED(outer_ce == NULL)) {
@@ -16185,6 +16221,42 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
 			HANDLE_EXCEPTION();
 		}
+	} else if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) {
+		uint32_t fetch_type;
+		zend_class_entry *called_scope, *scope;
+
+		fetch_type = opline->op1.num;
+		scope = EX(func)->op_array.scope;
+		if (UNEXPECTED(scope == NULL)) {
+			SAVE_OPLINE();
+			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
+				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
+				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
+			ZVAL_UNDEF(EX_VAR(opline->result.var));
+			HANDLE_EXCEPTION();
+		}
+		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+			outer_ce = scope;
+		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+			if (UNEXPECTED(scope->parent == NULL)) {
+				SAVE_OPLINE();
+				zend_throw_error(NULL,
+					"Cannot use \"parent\" when current class scope has no parent");
+				ZVAL_UNDEF(EX_VAR(opline->result.var));
+				HANDLE_EXCEPTION();
+			}
+			outer_ce = scope->parent;
+		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+			if (Z_TYPE(EX(This)) == IS_OBJECT) {
+				called_scope = Z_OBJCE(EX(This));
+			} else {
+				called_scope = Z_CE(EX(This));
+			}
+			outer_ce = called_scope;
+		} else {
+			zend_throw_error(NULL, "Unknown scope resolution");
+			HANDLE_EXCEPTION();
+		}
 	} else {
 		outer_ce = CACHED_PTR(opline->extended_value);
 		if (UNEXPECTED(outer_ce == NULL)) {
@@ -33830,6 +33902,85 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	SAVE_OPLINE();
+
+	zend_string *inner_class_name, *full_class_name;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+
+	if (IS_UNUSED == IS_CONST) {
+		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
+		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
+		if (!outer_ce) {
+			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			HANDLE_EXCEPTION();
+		}
+	} else if (IS_UNUSED == IS_UNUSED) {
+		uint32_t fetch_type;
+		zend_class_entry *called_scope, *scope;
+
+		fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
+		scope = EX(func)->op_array.scope;
+		if (UNEXPECTED(scope == NULL)) {
+			SAVE_OPLINE();
+			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
+				fetch_type == ZEND_FETCH_CLASS_SELF ? "self" :
+				fetch_type == ZEND_FETCH_CLASS_PARENT ? "parent" : "static");
+			ZVAL_UNDEF(EX_VAR(opline->result.var));
+			HANDLE_EXCEPTION();
+		}
+		if (fetch_type == ZEND_FETCH_CLASS_SELF) {
+			outer_ce = scope;
+		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
+			if (UNEXPECTED(scope->parent == NULL)) {
+				SAVE_OPLINE();
+				zend_throw_error(NULL,
+					"Cannot use \"parent\" when current class scope has no parent");
+				ZVAL_UNDEF(EX_VAR(opline->result.var));
+				HANDLE_EXCEPTION();
+			}
+			outer_ce = scope->parent;
+		} else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
+			if (Z_TYPE(EX(This)) == IS_OBJECT) {
+				called_scope = Z_OBJCE(EX(This));
+			} else {
+				called_scope = Z_CE(EX(This));
+			}
+			outer_ce = called_scope;
+		} else {
+			zend_throw_error(NULL, "Unknown scope resolution");
+			HANDLE_EXCEPTION();
+		}
+	} else {
+		outer_ce = CACHED_PTR(opline->extended_value);
+		if (UNEXPECTED(outer_ce == NULL)) {
+			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
+		}
+	}
+
+	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
+
+	full_class_name = zend_string_concat3(
+		ZSTR_VAL(outer_ce->name), ZSTR_LEN(outer_ce->name),
+		":>", 2,
+		ZSTR_VAL(inner_class_name), ZSTR_LEN(inner_class_name)
+	);
+
+	inner_ce = zend_lookup_class(full_class_name);
+	if (!inner_ce) {
+		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+	}
+
+	CACHE_PTR(opline->extended_value, inner_ce);
+	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
+
+	zend_string_release(full_class_name);
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 static zend_always_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_INLINE_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	USE_OPLINE
@@ -57732,7 +57883,7 @@ ZEND_API void execute_ex(zend_execute_data *ex)
 			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_LABEL,
 			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_LABEL,
 			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_LABEL,
-			(void*)&&ZEND_NULL_LABEL,
+			(void*)&&ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST_LABEL,
 			(void*)&&ZEND_NULL_LABEL,
 			(void*)&&ZEND_INIT_FCALL_OFFSET_SPEC_CONST_LABEL,
 			(void*)&&ZEND_RECV_NOTYPE_SPEC_LABEL,
@@ -62473,6 +62624,11 @@ ZEND_API void execute_ex(zend_execute_data *ex)
 				ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
 				VM_TRACE_OP_END(ZEND_POST_INC_OBJ_SPEC_UNUSED_CONST)
 				HYBRID_BREAK();
+			HYBRID_CASE(ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST):
+				VM_TRACE(ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST)
+				ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+				VM_TRACE_OP_END(ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST)
+				HYBRID_BREAK();
 			HYBRID_CASE(ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST):
 				VM_TRACE(ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST)
 				ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_INLINE_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
@@ -66934,7 +67090,7 @@ void zend_vm_init(void)
 		ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST_HANDLER,
 		ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER,
 		ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST_HANDLER,
-		ZEND_NULL_HANDLER,
+		ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST_HANDLER,
 		ZEND_NULL_HANDLER,
 		ZEND_INIT_FCALL_OFFSET_SPEC_CONST_HANDLER,
 		ZEND_RECV_NOTYPE_SPEC_HANDLER,
@@ -68585,4 +68741,3 @@ ZEND_API int ZEND_FASTCALL zend_vm_call_opcode_handler(zend_execute_data* ex)
 #endif
 	return ret;
 }
-
diff --git a/Zend/zend_vm_handlers.h b/Zend/zend_vm_handlers.h
index 3bf5234bf696d..e632a82498637 100644
--- a/Zend/zend_vm_handlers.h
+++ b/Zend/zend_vm_handlers.h
@@ -1375,6 +1375,7 @@
 	_(2577, ZEND_FETCH_INNER_CLASS_SPEC_CONST_CONST) \
 	_(2578, ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST) \
 	_(2579, ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_CONST) \
+	_(2580, ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_CONST) \
 	_(2582, ZEND_INIT_FCALL_OFFSET_SPEC_CONST) \
 	_(2583, ZEND_RECV_NOTYPE_SPEC) \
 	_(2585, ZEND_COUNT_ARRAY_SPEC_TMPVAR_UNUSED) \
diff --git a/tests/classes/inner_classes_012.phpt b/tests/classes/inner_classes_012.phpt
new file mode 100644
index 0000000000000..54611341343e6
--- /dev/null
+++ b/tests/classes/inner_classes_012.phpt
@@ -0,0 +1,43 @@
+--TEST--
+scope resolution access
+--FILE--
+<?php
+
+class Outer {
+    public class Middle {
+    }
+    public static function testStatic(): self:>Middle {
+        return new static:>Middle();
+    }
+    public static function testSelf(): self:>Middle {
+        return new self:>Middle();
+    }
+}
+
+class Outer2 extends Outer {
+    public class Middle extends parent:>Middle {
+    }
+
+    public static function testParent(): parent:>Middle {
+        return new parent:>Middle();
+    }
+}
+
+var_dump(Outer::testStatic());
+var_dump(Outer::testSelf());
+var_dump(Outer2::testParent());
+var_dump(Outer2::testStatic());
+var_dump(Outer2::testSelf());
+
+?>
+--EXPECT--
+object(Outer:>Middle)#1 (0) {
+}
+object(Outer:>Middle)#1 (0) {
+}
+object(Outer:>Middle)#1 (0) {
+}
+object(Outer2:>Middle)#1 (0) {
+}
+object(Outer:>Middle)#1 (0) {
+}

From 99abdcd77bb70d3cf7acba06ba2b996db4d9ddeb Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 18:35:20 +0100
Subject: [PATCH 19/37] update reflection

---
 ext/reflection/php_reflection.c         | 50 +++++++++++++++++++++++++
 ext/reflection/php_reflection.stub.php  |  8 ++++
 ext/reflection/php_reflection_arginfo.h | 18 ++++++++-
 tests/classes/inner_classes_013.phpt    | 31 +++++++++++++++
 4 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 tests/classes/inner_classes_013.phpt

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index bc8ffbdd8bd8e..c297426c06d9a 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -4075,6 +4075,56 @@ static void add_class_vars(zend_class_entry *ce, bool statics, zval *return_valu
 }
 /* }}} */
 
+/* {{{ Returns whether the current class is an inner class */
+ZEND_METHOD(ReflectionClass, isInnerClass)
+{
+	reflection_object *intern;
+  zend_class_entry *ce;
+
+  ZEND_PARSE_PARAMETERS_NONE();
+
+  GET_REFLECTION_OBJECT_PTR(ce);
+
+  // If the class is an inner class, it will have a T_INNER_REF in its name
+  // todo: make this better?
+
+  RETURN_BOOL(strstr(ZSTR_VAL(ce->name), ":>") != NULL);
+}
+/* }}} */
+
+/* {{{ Returns true if the class is private */
+ZEND_METHOD(ReflectionClass, isPrivate)
+{
+    reflection_object *intern;
+    zend_class_entry *ce;
+
+    ZEND_PARSE_PARAMETERS_NONE();
+    GET_REFLECTION_OBJECT_PTR(ce);
+    RETURN_BOOL(ce->required_scope && ce->required_scope_absolute);
+}
+
+/* {{{ Returns true if the class is protected */
+ZEND_METHOD(ReflectionClass, isProtected)
+{
+    reflection_object *intern;
+    zend_class_entry *ce;
+
+    ZEND_PARSE_PARAMETERS_NONE();
+    GET_REFLECTION_OBJECT_PTR(ce);
+    RETURN_BOOL(ce->required_scope && !ce->required_scope_absolute);
+}
+
+/* {{{ Returns true if the class is public */
+ZEND_METHOD(ReflectionClass, isPublic)
+{
+    reflection_object *intern;
+    zend_class_entry *ce;
+
+    ZEND_PARSE_PARAMETERS_NONE();
+    GET_REFLECTION_OBJECT_PTR(ce);
+    RETURN_BOOL(!ce->required_scope);
+}
+
 /* {{{ Returns an associative array containing all static property values of the class */
 ZEND_METHOD(ReflectionClass, getStaticProperties)
 {
diff --git a/ext/reflection/php_reflection.stub.php b/ext/reflection/php_reflection.stub.php
index be511d7ee14cd..6b03c6deb03c8 100644
--- a/ext/reflection/php_reflection.stub.php
+++ b/ext/reflection/php_reflection.stub.php
@@ -432,6 +432,14 @@ public function getNamespaceName(): string {}
     public function getShortName(): string {}
 
     public function getAttributes(?string $name = null, int $flags = 0): array {}
+
+    public function isInnerClass(): bool {}
+
+    public function isPrivate(): bool {}
+
+    public function isProtected(): bool {}
+
+    public function isPublic(): bool {}
 }
 
 class ReflectionObject extends ReflectionClass
diff --git a/ext/reflection/php_reflection_arginfo.h b/ext/reflection/php_reflection_arginfo.h
index d78a685dde9c9..9630754e93c27 100644
--- a/ext/reflection/php_reflection_arginfo.h
+++ b/ext/reflection/php_reflection_arginfo.h
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: 3c6be99bb36965139464925a618cb0bf03affa62 */
+ * Stub hash: be0cae939aa05863ce2206767bbb923ea9951dd7 */
 
 ZEND_BEGIN_ARG_WITH_TENTATIVE_RETURN_TYPE_INFO_EX(arginfo_class_Reflection_getModifierNames, 0, 1, IS_ARRAY, 0)
 	ZEND_ARG_TYPE_INFO(0, modifiers, IS_LONG, 0)
@@ -366,6 +366,14 @@ ZEND_END_ARG_INFO()
 
 #define arginfo_class_ReflectionClass_getAttributes arginfo_class_ReflectionFunctionAbstract_getAttributes
 
+#define arginfo_class_ReflectionClass_isInnerClass arginfo_class_ReflectionFunctionAbstract_hasTentativeReturnType
+
+#define arginfo_class_ReflectionClass_isPrivate arginfo_class_ReflectionFunctionAbstract_hasTentativeReturnType
+
+#define arginfo_class_ReflectionClass_isProtected arginfo_class_ReflectionFunctionAbstract_hasTentativeReturnType
+
+#define arginfo_class_ReflectionClass_isPublic arginfo_class_ReflectionFunctionAbstract_hasTentativeReturnType
+
 ZEND_BEGIN_ARG_INFO_EX(arginfo_class_ReflectionObject___construct, 0, 0, 1)
 	ZEND_ARG_TYPE_INFO(0, object, IS_OBJECT, 0)
 ZEND_END_ARG_INFO()
@@ -847,6 +855,10 @@ ZEND_METHOD(ReflectionClass, inNamespace);
 ZEND_METHOD(ReflectionClass, getNamespaceName);
 ZEND_METHOD(ReflectionClass, getShortName);
 ZEND_METHOD(ReflectionClass, getAttributes);
+ZEND_METHOD(ReflectionClass, isInnerClass);
+ZEND_METHOD(ReflectionClass, isPrivate);
+ZEND_METHOD(ReflectionClass, isProtected);
+ZEND_METHOD(ReflectionClass, isPublic);
 ZEND_METHOD(ReflectionObject, __construct);
 ZEND_METHOD(ReflectionProperty, __construct);
 ZEND_METHOD(ReflectionProperty, __toString);
@@ -1139,6 +1151,10 @@ static const zend_function_entry class_ReflectionClass_methods[] = {
 	ZEND_ME(ReflectionClass, getNamespaceName, arginfo_class_ReflectionClass_getNamespaceName, ZEND_ACC_PUBLIC)
 	ZEND_ME(ReflectionClass, getShortName, arginfo_class_ReflectionClass_getShortName, ZEND_ACC_PUBLIC)
 	ZEND_ME(ReflectionClass, getAttributes, arginfo_class_ReflectionClass_getAttributes, ZEND_ACC_PUBLIC)
+	ZEND_ME(ReflectionClass, isInnerClass, arginfo_class_ReflectionClass_isInnerClass, ZEND_ACC_PUBLIC)
+	ZEND_ME(ReflectionClass, isPrivate, arginfo_class_ReflectionClass_isPrivate, ZEND_ACC_PUBLIC)
+	ZEND_ME(ReflectionClass, isProtected, arginfo_class_ReflectionClass_isProtected, ZEND_ACC_PUBLIC)
+	ZEND_ME(ReflectionClass, isPublic, arginfo_class_ReflectionClass_isPublic, ZEND_ACC_PUBLIC)
 	ZEND_FE_END
 };
 
diff --git a/tests/classes/inner_classes_013.phpt b/tests/classes/inner_classes_013.phpt
new file mode 100644
index 0000000000000..0f1f53bae838e
--- /dev/null
+++ b/tests/classes/inner_classes_013.phpt
@@ -0,0 +1,31 @@
+--TEST--
+reflection on inner classes
+--FILE--
+<?php
+
+namespace n\s;
+
+class Outer {
+    class Middle {
+        class Inner {}
+    }
+}
+
+$outer = new \ReflectionClass(Outer::class);
+$ref = new \ReflectionClass('n\s\Outer:>Middle:>Inner');
+var_dump($ref->getName());
+var_dump($ref->getShortName());
+var_dump($ref->isInnerClass());
+var_dump($outer->isInnerClass());
+var_dump($ref->isPrivate());
+var_dump($ref->isProtected());
+var_dump($ref->isPublic());
+?>
+--EXPECT--
+string(24) "n\s\Outer:>Middle:>Inner"
+string(20) "Outer:>Middle:>Inner"
+bool(true)
+bool(false)
+bool(false)
+bool(false)
+bool(true)

From 72e14ca6caebbea8d8c2645e8c02494fd33fee6e Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 19:32:47 +0100
Subject: [PATCH 20/37] enable visibility

---
 Zend/zend_execute.c                  | 17 +++++++
 Zend/zend_vm_def.h                   | 26 +++++++---
 Zend/zend_vm_execute.h               | 71 +++++++++++++++++++++-------
 tests/classes/inner_classes_014.phpt | 28 +++++++++++
 tests/classes/inner_classes_015.phpt | 31 ++++++++++++
 tests/classes/inner_classes_016.phpt | 25 ++++++++++
 tests/classes/inner_classes_017.phpt | 25 ++++++++++
 7 files changed, 199 insertions(+), 24 deletions(-)
 create mode 100644 tests/classes/inner_classes_014.phpt
 create mode 100644 tests/classes/inner_classes_015.phpt
 create mode 100644 tests/classes/inner_classes_016.phpt
 create mode 100644 tests/classes/inner_classes_017.phpt

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 6b6af2c225f79..efa759f334ef8 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1196,6 +1196,23 @@ static zend_always_inline bool zend_check_type_slow(
 			}
 		} else {
 			ce = zend_fetch_ce_from_cache_slot(cache_slot, type);
+
+			// verify that the class is being used in the correct scope
+			if (ce && ce->required_scope) {
+				zend_class_entry *scope = zend_get_executed_scope();
+				if (ce->required_scope_absolute && scope != ce->required_scope) {
+					if (scope == NULL) {
+						zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the global scope", ce->name->val);
+					}
+
+					zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the scope of %s", ce->name->val, scope->name->val);
+				} else if (scope == NULL) {
+					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the global scope", ce->name->val);
+				} else if (!instanceof_function(scope, ce->required_scope)) {
+					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the scope of %s", ce->name->val, scope->name->val);
+				}
+			}
+
 			/* If we have a CE we check if it satisfies the type constraint,
 			 * otherwise it will check if a standard type satisfies it. */
 			if (ce && instanceof_function(Z_OBJCE_P(arg), ce)) {
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index fc747afbc393e..298fb982ad09f 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1804,7 +1804,9 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 	SAVE_OPLINE();
 
 	zend_string *inner_class_name, *full_class_name;
-	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL, *scope = NULL;
+
+	scope = EX(func)->op_array.scope;
 
 	if (OP1_TYPE == IS_CONST) {
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
@@ -1815,10 +1817,9 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 		}
 	} else if (OP1_TYPE == IS_UNUSED) {
 		uint32_t fetch_type;
-		zend_class_entry *called_scope, *scope;
+		zend_class_entry *called_scope;
 
-		fetch_type = opline->op1.num;
-		scope = EX(func)->op_array.scope;
+		fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
 		if (UNEXPECTED(scope == NULL)) {
 			SAVE_OPLINE();
 			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
@@ -1827,9 +1828,9 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 			ZVAL_UNDEF(EX_VAR(opline->result.var));
 			HANDLE_EXCEPTION();
 		}
-		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+		if (fetch_type == ZEND_FETCH_CLASS_SELF) {
 			outer_ce = scope;
-		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
 			if (UNEXPECTED(scope->parent == NULL)) {
 				SAVE_OPLINE();
 				zend_throw_error(NULL,
@@ -1838,7 +1839,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 				HANDLE_EXCEPTION();
 			}
 			outer_ce = scope->parent;
-		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
 			if (Z_TYPE(EX(This)) == IS_OBJECT) {
 				called_scope = Z_OBJCE(EX(This));
 			} else {
@@ -1867,6 +1868,17 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
 		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		HANDLE_EXCEPTION();
+	}
+
+	if (inner_ce->required_scope) {
+		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
+			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
+			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		}
 	}
 
 	CACHE_PTR(opline->extended_value, inner_ce);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 3b407d62c7bba..0ffc1de667925 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6616,7 +6616,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 	SAVE_OPLINE();
 
 	zend_string *inner_class_name, *full_class_name;
-	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL, *scope = NULL;
+
+	scope = EX(func)->op_array.scope;
 
 	if (IS_CONST == IS_CONST) {
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
@@ -6627,10 +6629,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 		}
 	} else if (IS_CONST == IS_UNUSED) {
 		uint32_t fetch_type;
-		zend_class_entry *called_scope, *scope;
+		zend_class_entry *called_scope;
 
-		fetch_type = opline->op1.num;
-		scope = EX(func)->op_array.scope;
+		fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
 		if (UNEXPECTED(scope == NULL)) {
 			SAVE_OPLINE();
 			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
@@ -6639,9 +6640,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 			ZVAL_UNDEF(EX_VAR(opline->result.var));
 			HANDLE_EXCEPTION();
 		}
-		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+		if (fetch_type == ZEND_FETCH_CLASS_SELF) {
 			outer_ce = scope;
-		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
 			if (UNEXPECTED(scope->parent == NULL)) {
 				SAVE_OPLINE();
 				zend_throw_error(NULL,
@@ -6650,7 +6651,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 				HANDLE_EXCEPTION();
 			}
 			outer_ce = scope->parent;
-		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
 			if (Z_TYPE(EX(This)) == IS_OBJECT) {
 				called_scope = Z_OBJCE(EX(This));
 			} else {
@@ -6679,6 +6680,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
 		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		HANDLE_EXCEPTION();
+	}
+
+	if (inner_ce->required_scope) {
+		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
+			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
+			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		}
 	}
 
 	CACHE_PTR(opline->extended_value, inner_ce);
@@ -16212,7 +16224,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 	SAVE_OPLINE();
 
 	zend_string *inner_class_name, *full_class_name;
-	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL, *scope = NULL;
+
+	scope = EX(func)->op_array.scope;
 
 	if ((IS_TMP_VAR|IS_VAR) == IS_CONST) {
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
@@ -16223,10 +16237,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 		}
 	} else if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) {
 		uint32_t fetch_type;
-		zend_class_entry *called_scope, *scope;
+		zend_class_entry *called_scope;
 
-		fetch_type = opline->op1.num;
-		scope = EX(func)->op_array.scope;
+		fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
 		if (UNEXPECTED(scope == NULL)) {
 			SAVE_OPLINE();
 			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
@@ -16235,9 +16248,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 			ZVAL_UNDEF(EX_VAR(opline->result.var));
 			HANDLE_EXCEPTION();
 		}
-		if (fetch_type & ZEND_FETCH_CLASS_SELF) {
+		if (fetch_type == ZEND_FETCH_CLASS_SELF) {
 			outer_ce = scope;
-		} else if (fetch_type & ZEND_FETCH_CLASS_PARENT) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
 			if (UNEXPECTED(scope->parent == NULL)) {
 				SAVE_OPLINE();
 				zend_throw_error(NULL,
@@ -16246,7 +16259,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 				HANDLE_EXCEPTION();
 			}
 			outer_ce = scope->parent;
-		} else if (fetch_type & ZEND_FETCH_CLASS_STATIC) {
+		} else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
 			if (Z_TYPE(EX(This)) == IS_OBJECT) {
 				called_scope = Z_OBJCE(EX(This));
 			} else {
@@ -16275,6 +16288,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
 		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		HANDLE_EXCEPTION();
+	}
+
+	if (inner_ce->required_scope) {
+		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
+			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
+			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		}
 	}
 
 	CACHE_PTR(opline->extended_value, inner_ce);
@@ -33908,7 +33932,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 	SAVE_OPLINE();
 
 	zend_string *inner_class_name, *full_class_name;
-	zend_class_entry *outer_ce = NULL, *inner_ce = NULL;
+	zend_class_entry *outer_ce = NULL, *inner_ce = NULL, *scope = NULL;
+
+	scope = EX(func)->op_array.scope;
 
 	if (IS_UNUSED == IS_CONST) {
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
@@ -33919,10 +33945,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 		}
 	} else if (IS_UNUSED == IS_UNUSED) {
 		uint32_t fetch_type;
-		zend_class_entry *called_scope, *scope;
+		zend_class_entry *called_scope;
 
 		fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
-		scope = EX(func)->op_array.scope;
 		if (UNEXPECTED(scope == NULL)) {
 			SAVE_OPLINE();
 			zend_throw_error(NULL, "Cannot use \"%s\" in the global scope",
@@ -33971,6 +33996,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
 		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		HANDLE_EXCEPTION();
+	}
+
+	if (inner_ce->required_scope) {
+		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
+			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
+			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+			HANDLE_EXCEPTION();
+		}
 	}
 
 	CACHE_PTR(opline->extended_value, inner_ce);
@@ -68741,3 +68777,4 @@ ZEND_API int ZEND_FASTCALL zend_vm_call_opcode_handler(zend_execute_data* ex)
 #endif
 	return ret;
 }
+
diff --git a/tests/classes/inner_classes_014.phpt b/tests/classes/inner_classes_014.phpt
new file mode 100644
index 0000000000000..69075dbb5fe01
--- /dev/null
+++ b/tests/classes/inner_classes_014.phpt
@@ -0,0 +1,28 @@
+--TEST--
+private inner class
+--FILE--
+<?php
+
+class Outer {
+    private class Inner {}
+
+    public function getInner(): self:>Inner {
+        return new self:>Inner();
+    }
+}
+
+class Foo extends Outer {
+    public function getInner(): parent:>Inner {
+        var_dump(parent::getInner());
+        return new parent:>Inner();
+    }
+}
+
+$outer = new Foo();
+var_dump($outer->getInner());
+?>
+--EXPECTF--
+object(Outer:>Inner)#2 (0) {
+}
+
+Fatal error: Class 'Outer:>Inner' is private in %s on line %d
diff --git a/tests/classes/inner_classes_015.phpt b/tests/classes/inner_classes_015.phpt
new file mode 100644
index 0000000000000..a13dc62da3b32
--- /dev/null
+++ b/tests/classes/inner_classes_015.phpt
@@ -0,0 +1,31 @@
+--TEST--
+protected inner class
+--FILE--
+<?php
+
+class Outer {
+    protected class Inner {}
+
+    public function getInner(): self:>Inner {
+        return new self:>Inner();
+    }
+}
+
+class Foo extends Outer {
+    public function getInner(): parent:>Inner {
+        var_dump(parent::getInner());
+        return new parent:>Inner();
+    }
+}
+
+$outer = new Foo();
+var_dump($outer->getInner());
+var_dump(new Outer:>Inner());
+?>
+--EXPECTF--
+object(Outer:>Inner)#2 (0) {
+}
+object(Outer:>Inner)#2 (0) {
+}
+
+Fatal error: Class 'Outer:>Inner' is protected in %s on line %d
diff --git a/tests/classes/inner_classes_016.phpt b/tests/classes/inner_classes_016.phpt
new file mode 100644
index 0000000000000..2a068e5e18f66
--- /dev/null
+++ b/tests/classes/inner_classes_016.phpt
@@ -0,0 +1,25 @@
+--TEST--
+private return types
+--FILE--
+<?php
+
+class Outer {
+    private class Inner {}
+
+    public static function getInner(): self:>Inner {
+        return new self:>Inner();
+    }
+}
+
+$r = Outer::getInner();
+function test($r): Outer:>Inner {
+    return $r;
+}
+var_dump($r);
+test($r);
+?>
+--EXPECTF--
+object(Outer:>Inner)#1 (0) {
+}
+
+Fatal error: Private inner class Outer:>Inner cannot be used as a type declaration in the global scope in %s on line %d
diff --git a/tests/classes/inner_classes_017.phpt b/tests/classes/inner_classes_017.phpt
new file mode 100644
index 0000000000000..3ae34f33c852c
--- /dev/null
+++ b/tests/classes/inner_classes_017.phpt
@@ -0,0 +1,25 @@
+--TEST--
+protected return types
+--FILE--
+<?php
+
+class Outer {
+    protected class Inner {}
+
+    public static function getInner(): self:>Inner {
+        return new self:>Inner();
+    }
+}
+
+$r = Outer::getInner();
+function test($r): Outer:>Inner {
+    return $r;
+}
+var_dump($r);
+test($r);
+?>
+--EXPECTF--
+object(Outer:>Inner)#1 (0) {
+}
+
+Fatal error: Protected inner class Outer:>Inner cannot be used as a type declaration in the global scope in %s on line %d

From 025463549ca506eccd3bfe789792d0da9bf55492 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 19:49:08 +0100
Subject: [PATCH 21/37] add tests for autoloading

---
 Zend/zend_compile.c                  |  3 ---
 tests/classes/inner_classes.inc      |  9 +++++++++
 tests/classes/inner_classes_019.phpt | 16 ++++++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 tests/classes/inner_classes.inc
 create mode 100644 tests/classes/inner_classes_019.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 84522d2d957df..b65e5c570655d 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -9205,9 +9205,6 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 			// if a class is private or protected, we need to require the correct scope
 			ce->required_scope = propFlags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED) ? CG(active_class_entry) : NULL;
 			ce->required_scope_absolute = propFlags & ZEND_ACC_PRIVATE ? true : false;
-			if (ce->required_scope) {
-				ce->required_scope->refcount ++;
-			}
 
 			// ensure the class is treated as a top-level class and not an anon class
 			toplevel = true;
diff --git a/tests/classes/inner_classes.inc b/tests/classes/inner_classes.inc
new file mode 100644
index 0000000000000..793804cf6606e
--- /dev/null
+++ b/tests/classes/inner_classes.inc
@@ -0,0 +1,9 @@
+<?php
+
+class inner_classes {
+    public class Point {
+        public function __construct(public int $x, public int $y) {}
+    }
+
+    private class Line {}
+}
diff --git a/tests/classes/inner_classes_019.phpt b/tests/classes/inner_classes_019.phpt
new file mode 100644
index 0000000000000..4259bc8553162
--- /dev/null
+++ b/tests/classes/inner_classes_019.phpt
@@ -0,0 +1,16 @@
+--TEST--
+ensure private autoloading works
+--FILE--
+<?php
+spl_autoload_register(static function ($class_name) {
+    require_once(__DIR__ . '/' . $class_name . '.inc');
+    echo 'autoload(' . $class_name . ")\n";
+});
+
+$line = new inner_classes:>Line();
+var_dump($line);
+?>
+--EXPECTF--
+autoload(inner_classes)
+
+Fatal error: Class 'inner_classes:>Line' is private in %s on line %d

From 458fca87fb2c71f6a8f67ad5e672053f13c70cd6 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 20:17:59 +0100
Subject: [PATCH 22/37] properly persist classes in opcache

---
 ext/opcache/zend_persist.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index 3d45c63a98781..fa82f997ee3a5 100644
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -1121,6 +1121,18 @@ zend_class_entry *zend_persist_class_entry(zend_class_entry *orig_ce)
 	return ce;
 }
 
+void zend_update_required_scope(zend_class_entry *ce)
+{
+	if (ce->required_scope) {
+		zend_class_entry *required_scope = ce->required_scope;
+
+		zend_class_entry *r = zend_shared_alloc_get_xlat_entry(required_scope);
+		if (r) {
+			ce->required_scope = r;
+		}
+	}
+}
+
 void zend_update_parent_ce(zend_class_entry *ce)
 {
 	if (ce->ce_flags & ZEND_ACC_LINKED) {
@@ -1294,6 +1306,7 @@ static void zend_accel_persist_class_table(HashTable *class_table)
 		if (EXPECTED(Z_TYPE(p->val) != IS_ALIAS_PTR)) {
 			ce = Z_PTR(p->val);
 			zend_update_parent_ce(ce);
+			zend_update_required_scope(ce);
 		}
 	} ZEND_HASH_FOREACH_END();
 #ifdef HAVE_JIT

From 7a06f63f17be244be9be04c212e2b86df36a25cf Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Sun, 9 Mar 2025 23:26:42 +0100
Subject: [PATCH 23/37] handle return type visibility enforcement

---
 Zend/zend_vm_def.h                   |  24 ++++-
 Zend/zend_vm_execute.h               | 154 ++++++++++++++++-----------
 tests/classes/inner_classes_014.phpt |   8 +-
 tests/classes/inner_classes_015.phpt |  10 +-
 tests/classes/inner_classes_016.phpt |   9 +-
 tests/classes/inner_classes_017.phpt |   9 +-
 6 files changed, 136 insertions(+), 78 deletions(-)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 298fb982ad09f..76adfe21be468 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1851,10 +1851,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 			HANDLE_EXCEPTION();
 		}
 	} else {
-		outer_ce = CACHED_PTR(opline->extended_value);
-		if (UNEXPECTED(outer_ce == NULL)) {
-			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
-		}
+		outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
 	}
 
 	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
@@ -4518,6 +4515,24 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -8264,6 +8279,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 
 			case ZEND_FETCH_CLASS:
 			case ZEND_DECLARE_ANON_CLASS:
+			case ZEND_FETCH_INNER_CLASS:
 				break; /* return value is zend_class_entry pointer */
 
 			default:
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 0ffc1de667925..cde630e1ab345 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -3310,6 +3310,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 
 			case ZEND_FETCH_CLASS:
 			case ZEND_DECLARE_ANON_CLASS:
+			case ZEND_FETCH_INNER_CLASS:
 				break; /* return value is zend_class_entry pointer */
 
 			default:
@@ -6663,10 +6664,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 			HANDLE_EXCEPTION();
 		}
 	} else {
-		outer_ce = CACHED_PTR(opline->extended_value);
-		if (UNEXPECTED(outer_ce == NULL)) {
-			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
-		}
+		outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
 	}
 
 	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
@@ -7404,10 +7402,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_CONST != IS_CONST &&
-	           IS_CONST == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -9978,10 +9972,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_CONST != IS_CONST &&
-	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -10736,10 +10726,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_CONST != IS_CONST &&
-	           IS_UNUSED == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -10890,6 +10876,24 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYP
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -12470,10 +12474,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_CONST != IS_CONST &&
-	           IS_CV == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
@@ -16271,10 +16271,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 			HANDLE_EXCEPTION();
 		}
 	} else {
-		outer_ce = CACHED_PTR(opline->extended_value);
-		if (UNEXPECTED(outer_ce == NULL)) {
-			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
-		}
+		outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
 	}
 
 	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
@@ -21718,6 +21715,24 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_TMP_UN
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -25597,10 +25612,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_VAR != IS_CONST &&
-	           IS_CONST == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -28530,10 +28541,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_VAR != IS_CONST &&
-	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -30040,10 +30047,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_VAR != IS_CONST &&
-	           IS_UNUSED == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -30194,6 +30197,24 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UN
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -32979,10 +33000,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_VAR != IS_CONST &&
-	           IS_CV == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
@@ -33979,10 +33996,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 			HANDLE_EXCEPTION();
 		}
 	} else {
-		outer_ce = CACHED_PTR(opline->extended_value);
-		if (UNEXPECTED(outer_ce == NULL)) {
-			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
-		}
+		outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
 	}
 
 	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
@@ -35341,10 +35355,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_UNUSED != IS_CONST &&
-	           IS_CONST == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -37510,10 +37520,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_UNUSED != IS_CONST &&
-	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -37921,10 +37927,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_UNUSED != IS_CONST &&
-	           IS_UNUSED == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -38075,6 +38077,24 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_UNUSED
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -40155,10 +40175,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
-	} else if (IS_UNUSED != IS_CONST &&
-	           IS_CV == IS_CONST &&
-	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
-		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
@@ -50876,6 +50892,24 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
diff --git a/tests/classes/inner_classes_014.phpt b/tests/classes/inner_classes_014.phpt
index 69075dbb5fe01..80aab3c3e68b2 100644
--- a/tests/classes/inner_classes_014.phpt
+++ b/tests/classes/inner_classes_014.phpt
@@ -6,14 +6,18 @@ private inner class
 class Outer {
     private class Inner {}
 
-    public function getInner(): self:>Inner {
+    private function getInner(): self:>Inner {
         return new self:>Inner();
     }
+
+    public function getInner2(): mixed {
+        return $this->getInner();
+    }
 }
 
 class Foo extends Outer {
     public function getInner(): parent:>Inner {
-        var_dump(parent::getInner());
+        var_dump(parent::getInner2());
         return new parent:>Inner();
     }
 }
diff --git a/tests/classes/inner_classes_015.phpt b/tests/classes/inner_classes_015.phpt
index a13dc62da3b32..e96529b108d0d 100644
--- a/tests/classes/inner_classes_015.phpt
+++ b/tests/classes/inner_classes_015.phpt
@@ -6,7 +6,7 @@ protected inner class
 class Outer {
     protected class Inner {}
 
-    public function getInner(): self:>Inner {
+    protected function getInner(): self:>Inner {
         return new self:>Inner();
     }
 }
@@ -25,7 +25,9 @@ var_dump(new Outer:>Inner());
 --EXPECTF--
 object(Outer:>Inner)#2 (0) {
 }
-object(Outer:>Inner)#2 (0) {
-}
 
-Fatal error: Class 'Outer:>Inner' is protected in %s on line %d
+Fatal error: Uncaught TypeError: Method getInner is public but returns a protected class: Outer:>Inner in %s:%d
+Stack trace:
+#0 %s(%d): Foo->getInner()
+#1 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes_016.phpt b/tests/classes/inner_classes_016.phpt
index 2a068e5e18f66..efc50b6bca1d5 100644
--- a/tests/classes/inner_classes_016.phpt
+++ b/tests/classes/inner_classes_016.phpt
@@ -19,7 +19,8 @@ var_dump($r);
 test($r);
 ?>
 --EXPECTF--
-object(Outer:>Inner)#1 (0) {
-}
-
-Fatal error: Private inner class Outer:>Inner cannot be used as a type declaration in the global scope in %s on line %d
+Fatal error: Uncaught TypeError: Method getInner is public but returns a private class: Outer:>Inner in %s:%d
+Stack trace:
+#0 %s(%d): Outer::getInner()
+#1 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes_017.phpt b/tests/classes/inner_classes_017.phpt
index 3ae34f33c852c..4e804831479a3 100644
--- a/tests/classes/inner_classes_017.phpt
+++ b/tests/classes/inner_classes_017.phpt
@@ -19,7 +19,8 @@ var_dump($r);
 test($r);
 ?>
 --EXPECTF--
-object(Outer:>Inner)#1 (0) {
-}
-
-Fatal error: Protected inner class Outer:>Inner cannot be used as a type declaration in the global scope in %s on line %d
+Fatal error: Uncaught TypeError: Method getInner is public but returns a protected class: Outer:>Inner in %s:%d
+Stack trace:
+#0 %s(%d): Outer::getInner()
+#1 {main}
+  thrown in %s on line %d

From eea3ad39e7633e56556eb331e5549c54cc622e6f Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Tue, 11 Mar 2025 08:12:59 +0100
Subject: [PATCH 24/37] fix static member access

---
 Zend/zend_compile.c                  |  3 ++-
 tests/classes/inner_classes_018.phpt | 15 +++++++++++++++
 tests/classes/inner_classes_020.phpt | 23 +++++++++++++++++++++++
 tests/classes/inner_classes_021.phpt |  1 +
 4 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 tests/classes/inner_classes_018.phpt
 create mode 100644 tests/classes/inner_classes_020.phpt
 create mode 100644 tests/classes/inner_classes_021.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index b65e5c570655d..4094a22c6ac8b 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2943,7 +2943,8 @@ static void zend_compile_inner_class_ref(znode *result, zend_ast *ast, uint32_t
 	}
 
 	zend_op *opline = zend_emit_op(result, ZEND_FETCH_INNER_CLASS, &outer_node, &inner_node);
-	opline->extended_value = zend_alloc_cache_slot();
+	// ensure we allocate two slots to prevent an issue with static method access
+	opline->extended_value = zend_alloc_cache_slots(2);
 }
 /* }}} */
 
diff --git a/tests/classes/inner_classes_018.phpt b/tests/classes/inner_classes_018.phpt
new file mode 100644
index 0000000000000..eef4cdfa5de09
--- /dev/null
+++ b/tests/classes/inner_classes_018.phpt
@@ -0,0 +1,15 @@
+--TEST--
+ensure autoloading works
+--FILE--
+<?php
+spl_autoload_register(static function ($class_name) {
+    require_once(__DIR__ . '/' . $class_name . '.inc');
+    echo 'autoload(' . $class_name . ")\n";
+});
+
+$point = new inner_classes:>Point(1, 2);
+echo $point->x, ' ', $point->y, "\n";
+?>
+--EXPECT--
+autoload(inner_classes)
+1 2
diff --git a/tests/classes/inner_classes_020.phpt b/tests/classes/inner_classes_020.phpt
new file mode 100644
index 0000000000000..a5366f5b4a3c5
--- /dev/null
+++ b/tests/classes/inner_classes_020.phpt
@@ -0,0 +1,23 @@
+--TEST--
+property types
+--FILE--
+<?php
+
+class Outer {
+    public self:>Inner $inner;
+    private class Inner {}
+    public function test(): void {
+        $this->inner = new self:>Inner();
+    }
+}
+
+$outer = new Outer();
+$outer->test();
+var_dump($outer->inner);
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Method test is public but returns a private class: Outer:>Inner in %s:%d
+Stack trace:
+#0 %s(%d): Outer::test()
+#1 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes_021.phpt b/tests/classes/inner_classes_021.phpt
new file mode 100644
index 0000000000000..7def572cff602
--- /dev/null
+++ b/tests/classes/inner_classes_021.phpt
@@ -0,0 +1 @@
+--TEST--

From d2b325614a70936bfc43bc08334034d23686be3e Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Thu, 13 Mar 2025 17:53:26 +0100
Subject: [PATCH 25/37] move tests

---
 .../access_modifiers_001.phpt}                |  0
 .../access_modifiers_002.phpt}                |  0
 .../access_modifiers_003.phpt}                |  0
 .../access_modifiers_004.phpt}                |  0
 .../access_modifiers_005.phpt}                |  0
 .../access_modifiers_006.phpt}                |  0
 .../inner_classes/access_modifiers_007.phpt   | 18 ++++++++++++++++
 .../autoload_001.phpt}                        |  0
 .../autoload_002.phpt}                        |  0
 tests/classes/inner_classes/inheritance.phpt  | 14 +++++++++++++
 .../{ => inner_classes}/inner_classes.inc     |  0
 .../properties_001.phpt}                      |  0
 .../reflection_001.phpt}                      |  0
 .../return_types_001.phpt}                    |  0
 .../return_types_002.phpt}                    |  0
 .../return_types_003.phpt}                    |  0
 .../return_types_004.phpt}                    |  0
 .../return_types_005.phpt}                    |  0
 .../inner_classes/return_types_006.phpt       | 21 +++++++++++++++++++
 .../simple_declaration_001.phpt}              |  0
 .../simple_declaration_002.phpt}              |  0
 .../simple_declaration_003.phpt}              |  0
 .../simple_declaration_004.phpt}              |  0
 .../static_variables.phpt}                    |  0
 tests/classes/inner_classes_021.phpt          |  1 -
 25 files changed, 53 insertions(+), 1 deletion(-)
 rename tests/classes/{inner_classes_001.phpt => inner_classes/access_modifiers_001.phpt} (100%)
 rename tests/classes/{inner_classes_002.phpt => inner_classes/access_modifiers_002.phpt} (100%)
 rename tests/classes/{inner_classes_003.phpt => inner_classes/access_modifiers_003.phpt} (100%)
 rename tests/classes/{inner_classes_004.phpt => inner_classes/access_modifiers_004.phpt} (100%)
 rename tests/classes/{inner_classes_005.phpt => inner_classes/access_modifiers_005.phpt} (100%)
 rename tests/classes/{inner_classes_006.phpt => inner_classes/access_modifiers_006.phpt} (100%)
 create mode 100644 tests/classes/inner_classes/access_modifiers_007.phpt
 rename tests/classes/{inner_classes_018.phpt => inner_classes/autoload_001.phpt} (100%)
 rename tests/classes/{inner_classes_019.phpt => inner_classes/autoload_002.phpt} (100%)
 create mode 100644 tests/classes/inner_classes/inheritance.phpt
 rename tests/classes/{ => inner_classes}/inner_classes.inc (100%)
 rename tests/classes/{inner_classes_020.phpt => inner_classes/properties_001.phpt} (100%)
 rename tests/classes/{inner_classes_013.phpt => inner_classes/reflection_001.phpt} (100%)
 rename tests/classes/{inner_classes_010.phpt => inner_classes/return_types_001.phpt} (100%)
 rename tests/classes/{inner_classes_014.phpt => inner_classes/return_types_002.phpt} (100%)
 rename tests/classes/{inner_classes_015.phpt => inner_classes/return_types_003.phpt} (100%)
 rename tests/classes/{inner_classes_016.phpt => inner_classes/return_types_004.phpt} (100%)
 rename tests/classes/{inner_classes_017.phpt => inner_classes/return_types_005.phpt} (100%)
 create mode 100644 tests/classes/inner_classes/return_types_006.phpt
 rename tests/classes/{inner_classes_007.phpt => inner_classes/simple_declaration_001.phpt} (100%)
 rename tests/classes/{inner_classes_008.phpt => inner_classes/simple_declaration_002.phpt} (100%)
 rename tests/classes/{inner_classes_009.phpt => inner_classes/simple_declaration_003.phpt} (100%)
 rename tests/classes/{inner_classes_012.phpt => inner_classes/simple_declaration_004.phpt} (100%)
 rename tests/classes/{inner_classes_011.phpt => inner_classes/static_variables.phpt} (100%)
 delete mode 100644 tests/classes/inner_classes_021.phpt

diff --git a/tests/classes/inner_classes_001.phpt b/tests/classes/inner_classes/access_modifiers_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_001.phpt
rename to tests/classes/inner_classes/access_modifiers_001.phpt
diff --git a/tests/classes/inner_classes_002.phpt b/tests/classes/inner_classes/access_modifiers_002.phpt
similarity index 100%
rename from tests/classes/inner_classes_002.phpt
rename to tests/classes/inner_classes/access_modifiers_002.phpt
diff --git a/tests/classes/inner_classes_003.phpt b/tests/classes/inner_classes/access_modifiers_003.phpt
similarity index 100%
rename from tests/classes/inner_classes_003.phpt
rename to tests/classes/inner_classes/access_modifiers_003.phpt
diff --git a/tests/classes/inner_classes_004.phpt b/tests/classes/inner_classes/access_modifiers_004.phpt
similarity index 100%
rename from tests/classes/inner_classes_004.phpt
rename to tests/classes/inner_classes/access_modifiers_004.phpt
diff --git a/tests/classes/inner_classes_005.phpt b/tests/classes/inner_classes/access_modifiers_005.phpt
similarity index 100%
rename from tests/classes/inner_classes_005.phpt
rename to tests/classes/inner_classes/access_modifiers_005.phpt
diff --git a/tests/classes/inner_classes_006.phpt b/tests/classes/inner_classes/access_modifiers_006.phpt
similarity index 100%
rename from tests/classes/inner_classes_006.phpt
rename to tests/classes/inner_classes/access_modifiers_006.phpt
diff --git a/tests/classes/inner_classes/access_modifiers_007.phpt b/tests/classes/inner_classes/access_modifiers_007.phpt
new file mode 100644
index 0000000000000..56da36c49c387
--- /dev/null
+++ b/tests/classes/inner_classes/access_modifiers_007.phpt
@@ -0,0 +1,18 @@
+--TEST--
+abstract inner classes
+--FILE--
+<?php
+
+class Outer {
+    abstract class Inner {}
+}
+
+$extended = new class extends Outer:>Inner{};
+
+var_dump($extended);
+$reflection = new ReflectionClass('Outer:>Inner');
+var_dump($reflection->isAbstract());
+new Outer:>Inner();
+?>
+--EXPECTF--
+last one fails
diff --git a/tests/classes/inner_classes_018.phpt b/tests/classes/inner_classes/autoload_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_018.phpt
rename to tests/classes/inner_classes/autoload_001.phpt
diff --git a/tests/classes/inner_classes_019.phpt b/tests/classes/inner_classes/autoload_002.phpt
similarity index 100%
rename from tests/classes/inner_classes_019.phpt
rename to tests/classes/inner_classes/autoload_002.phpt
diff --git a/tests/classes/inner_classes/inheritance.phpt b/tests/classes/inner_classes/inheritance.phpt
new file mode 100644
index 0000000000000..c84be9d6978e1
--- /dev/null
+++ b/tests/classes/inner_classes/inheritance.phpt
@@ -0,0 +1,14 @@
+--TEST--
+inheritance
+--FILE--
+<?php
+
+class Outer {
+    abstract class Other {}
+    class Middle extends Other {
+        class Inner1 {} // extends Outer:>Middle
+        class Inner2 extends Outer:>Middle {} // extends Outer
+    }
+}
+?>
+--EXPECT--
diff --git a/tests/classes/inner_classes.inc b/tests/classes/inner_classes/inner_classes.inc
similarity index 100%
rename from tests/classes/inner_classes.inc
rename to tests/classes/inner_classes/inner_classes.inc
diff --git a/tests/classes/inner_classes_020.phpt b/tests/classes/inner_classes/properties_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_020.phpt
rename to tests/classes/inner_classes/properties_001.phpt
diff --git a/tests/classes/inner_classes_013.phpt b/tests/classes/inner_classes/reflection_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_013.phpt
rename to tests/classes/inner_classes/reflection_001.phpt
diff --git a/tests/classes/inner_classes_010.phpt b/tests/classes/inner_classes/return_types_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_010.phpt
rename to tests/classes/inner_classes/return_types_001.phpt
diff --git a/tests/classes/inner_classes_014.phpt b/tests/classes/inner_classes/return_types_002.phpt
similarity index 100%
rename from tests/classes/inner_classes_014.phpt
rename to tests/classes/inner_classes/return_types_002.phpt
diff --git a/tests/classes/inner_classes_015.phpt b/tests/classes/inner_classes/return_types_003.phpt
similarity index 100%
rename from tests/classes/inner_classes_015.phpt
rename to tests/classes/inner_classes/return_types_003.phpt
diff --git a/tests/classes/inner_classes_016.phpt b/tests/classes/inner_classes/return_types_004.phpt
similarity index 100%
rename from tests/classes/inner_classes_016.phpt
rename to tests/classes/inner_classes/return_types_004.phpt
diff --git a/tests/classes/inner_classes_017.phpt b/tests/classes/inner_classes/return_types_005.phpt
similarity index 100%
rename from tests/classes/inner_classes_017.phpt
rename to tests/classes/inner_classes/return_types_005.phpt
diff --git a/tests/classes/inner_classes/return_types_006.phpt b/tests/classes/inner_classes/return_types_006.phpt
new file mode 100644
index 0000000000000..1f99b50e165dd
--- /dev/null
+++ b/tests/classes/inner_classes/return_types_006.phpt
@@ -0,0 +1,21 @@
+--TEST--
+returning private inner from inner method
+--FILE--
+<?php
+
+class Outer {
+    private class PrivateInner {
+        public function test() {
+            return new Outer:>PrivateInner();
+        }
+    }
+
+    public function test() { return new self:>PrivateInner()->test(); }
+}
+
+$foo = new Outer()->test();
+var_dump($foo);
+?>
+--EXPECT--
+object(Outer:>PrivateInner)#3 (0) {
+}
diff --git a/tests/classes/inner_classes_007.phpt b/tests/classes/inner_classes/simple_declaration_001.phpt
similarity index 100%
rename from tests/classes/inner_classes_007.phpt
rename to tests/classes/inner_classes/simple_declaration_001.phpt
diff --git a/tests/classes/inner_classes_008.phpt b/tests/classes/inner_classes/simple_declaration_002.phpt
similarity index 100%
rename from tests/classes/inner_classes_008.phpt
rename to tests/classes/inner_classes/simple_declaration_002.phpt
diff --git a/tests/classes/inner_classes_009.phpt b/tests/classes/inner_classes/simple_declaration_003.phpt
similarity index 100%
rename from tests/classes/inner_classes_009.phpt
rename to tests/classes/inner_classes/simple_declaration_003.phpt
diff --git a/tests/classes/inner_classes_012.phpt b/tests/classes/inner_classes/simple_declaration_004.phpt
similarity index 100%
rename from tests/classes/inner_classes_012.phpt
rename to tests/classes/inner_classes/simple_declaration_004.phpt
diff --git a/tests/classes/inner_classes_011.phpt b/tests/classes/inner_classes/static_variables.phpt
similarity index 100%
rename from tests/classes/inner_classes_011.phpt
rename to tests/classes/inner_classes/static_variables.phpt
diff --git a/tests/classes/inner_classes_021.phpt b/tests/classes/inner_classes_021.phpt
deleted file mode 100644
index 7def572cff602..0000000000000
--- a/tests/classes/inner_classes_021.phpt
+++ /dev/null
@@ -1 +0,0 @@
---TEST--

From 861da613f0d396fc181458184bde43ecd8378d1e Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Thu, 13 Mar 2025 20:34:53 +0100
Subject: [PATCH 26/37] add more tests and fix access modifiers

---
 Zend/zend_compile.c                           | 17 ++++++++++----
 Zend/zend_language_parser.y                   | 16 ++++++-------
 .../inner_classes/access_modifiers_007.phpt   | 15 +++++++++---
 tests/classes/inner_classes/inheritance.phpt  |  6 ++---
 .../inner_classes/return_types_006.phpt       |  2 +-
 .../classes/inner_classes/visibility_001.phpt | 23 +++++++++++++++++++
 6 files changed, 60 insertions(+), 19 deletions(-)
 create mode 100644 tests/classes/inner_classes/visibility_001.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 4094a22c6ac8b..a56b42b92e0f5 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -893,12 +893,12 @@ uint32_t zend_modifier_token_to_flag(zend_modifier_target target, uint32_t token
 			}
 			break;
 		case T_READONLY:
-			if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP) {
+			if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP || target == ZEND_MODIFIER_TARGET_INNER_CLASS) {
 				return ZEND_ACC_READONLY;
 			}
 			break;
 		case T_ABSTRACT:
-			if (target == ZEND_MODIFIER_TARGET_METHOD || target == ZEND_MODIFIER_TARGET_PROPERTY) {
+			if (target == ZEND_MODIFIER_TARGET_METHOD || target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_INNER_CLASS) {
 				return ZEND_ACC_ABSTRACT;
 			}
 			break;
@@ -906,6 +906,7 @@ uint32_t zend_modifier_token_to_flag(zend_modifier_target target, uint32_t token
 			if (target == ZEND_MODIFIER_TARGET_METHOD
 				|| target == ZEND_MODIFIER_TARGET_CONSTANT
 				|| target == ZEND_MODIFIER_TARGET_PROPERTY
+				|| target == ZEND_MODIFIER_TARGET_INNER_CLASS
 				|| target == ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {
 				return ZEND_ACC_FINAL;
 			}
@@ -9195,13 +9196,21 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 			// - final
 			// - readonly
 			// - abstract
-			ce->ce_flags |= decl->attr & (ZEND_ACC_FINAL|ZEND_ACC_READONLY|ZEND_ACC_ABSTRACT);
+			decl->flags |= decl->attr & ZEND_ACC_FINAL;
+			if (decl->attr & ZEND_ACC_ABSTRACT) {
+				decl->flags |= ZEND_ACC_EXPLICIT_ABSTRACT_CLASS;
+			}
+			if (decl->attr & ZEND_ACC_READONLY) {
+				decl->flags |= ZEND_ACC_READONLY_CLASS & ZEND_ACC_NO_DYNAMIC_PROPERTIES;
+			}
 
-			// configure the const stand-ins for a nested class. This should only include:
+			// configure for a nested class. This should only include:
 			// - public
 			// - private
 			// - protected
 			int propFlags = decl->attr & (ZEND_ACC_PUBLIC|ZEND_ACC_PROTECTED|ZEND_ACC_PRIVATE);
+			// remove the flags from attrs
+			decl->attr &= ~(ZEND_ACC_PUBLIC|ZEND_ACC_PROTECTED|ZEND_ACC_PRIVATE|ZEND_ACC_FINAL|ZEND_ACC_ABSTRACT|ZEND_ACC_READONLY);
 
 			// if a class is private or protected, we need to require the correct scope
 			ce->required_scope = propFlags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED) ? CG(active_class_entry) : NULL;
diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index bc2082c5cc73e..533a1efd3562e 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -627,6 +627,14 @@ class_modifier:
 	|	T_READONLY 		{ $$ = ZEND_ACC_READONLY_CLASS|ZEND_ACC_NO_DYNAMIC_PROPERTIES; }
 ;
 
+inner_class_modifiers:
+		non_empty_member_modifiers
+			{ $$ = zend_modifier_list_to_flags(ZEND_MODIFIER_TARGET_INNER_CLASS, $1);
+			  if (!$$) { YYERROR; } }
+	|	%empty
+			{ $$ = ZEND_ACC_PUBLIC; }
+;
+
 trait_declaration_statement:
 		T_TRAIT { $<num>$ = CG(zend_lineno); }
 		T_STRING backup_doc_comment '{' class_statement_list '}'
@@ -954,14 +962,6 @@ inner_class_statement:
 			{ $$ = zend_ast_create_decl(ZEND_AST_CLASS, 0, $<num>3, $6, zend_ast_get_str($2), $4, $5, $8, NULL, NULL); }
 ;
 
-inner_class_modifiers:
-		non_empty_member_modifiers
-			{ $$ = zend_modifier_list_to_flags(ZEND_MODIFIER_TARGET_INNER_CLASS, $1);
-			  if (!$$) { YYERROR; } }
-	|	%empty
-			{ $$ = ZEND_ACC_PUBLIC; }
-;
-
 attributed_class_statement:
 		property_modifiers optional_type_without_static property_list ';'
 			{ $$ = zend_ast_create(ZEND_AST_PROP_GROUP, $2, $3, NULL);
diff --git a/tests/classes/inner_classes/access_modifiers_007.phpt b/tests/classes/inner_classes/access_modifiers_007.phpt
index 56da36c49c387..d1177412939f1 100644
--- a/tests/classes/inner_classes/access_modifiers_007.phpt
+++ b/tests/classes/inner_classes/access_modifiers_007.phpt
@@ -4,10 +4,12 @@ abstract inner classes
 <?php
 
 class Outer {
-    abstract class Inner {}
+    public abstract class Inner {}
 }
 
-$extended = new class extends Outer:>Inner{};
+class Extended extends Outer:>Inner {}
+
+$extended = new Extended();
 
 var_dump($extended);
 $reflection = new ReflectionClass('Outer:>Inner');
@@ -15,4 +17,11 @@ var_dump($reflection->isAbstract());
 new Outer:>Inner();
 ?>
 --EXPECTF--
-last one fails
+object(Extended)#1 (0) {
+}
+bool(true)
+
+Fatal error: Uncaught Error: Cannot instantiate abstract class Outer:>Inner in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes/inheritance.phpt b/tests/classes/inner_classes/inheritance.phpt
index c84be9d6978e1..4addb7b02f61d 100644
--- a/tests/classes/inner_classes/inheritance.phpt
+++ b/tests/classes/inner_classes/inheritance.phpt
@@ -5,9 +5,9 @@ inheritance
 
 class Outer {
     abstract class Other {}
-    class Middle extends Other {
-        class Inner1 {} // extends Outer:>Middle
-        class Inner2 extends Outer:>Middle {} // extends Outer
+    class Middle extends Outer:>Other {
+        class Inner1 extends Outer:>Other {}
+        class Inner2 extends Outer:>Middle {}
     }
 }
 ?>
diff --git a/tests/classes/inner_classes/return_types_006.phpt b/tests/classes/inner_classes/return_types_006.phpt
index 1f99b50e165dd..cff19b727ad54 100644
--- a/tests/classes/inner_classes/return_types_006.phpt
+++ b/tests/classes/inner_classes/return_types_006.phpt
@@ -10,7 +10,7 @@ class Outer {
         }
     }
 
-    public function test() { return new self:>PrivateInner()->test(); }
+    public function test(): mixed { return new self:>PrivateInner()->test(); }
 }
 
 $foo = new Outer()->test();
diff --git a/tests/classes/inner_classes/visibility_001.phpt b/tests/classes/inner_classes/visibility_001.phpt
new file mode 100644
index 0000000000000..6c880452326ef
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_001.phpt
@@ -0,0 +1,23 @@
+--TEST--
+outer class visibility
+--FILE--
+<?php
+
+class Outer {
+    private class Inner {}
+    private class Other {
+        public function __construct(private Outer:>Inner $inner) {}
+
+        public function reset(): void {
+            $prev = $this->inner;
+            $this->inner = new Outer:>Inner();
+            var_dump($prev === $this->inner);
+        }
+    }
+    public static function test(): void {
+        new self:>Other(new Outer:>Inner());
+    }
+}
+Outer::test();
+?>
+--EXPECT--

From bf196a845b4b987043d37fbbe181c2ddcbeeb975 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Thu, 13 Mar 2025 21:22:46 +0100
Subject: [PATCH 27/37] add support for lexical scope

---
 Zend/zend.h         | 1 +
 Zend/zend_compile.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Zend/zend.h b/Zend/zend.h
index 81ced0cf41a1d..912008d43d997 100644
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -165,6 +165,7 @@ struct _zend_class_entry {
 	HashTable constants_table;
 
 	zend_class_entry *required_scope;
+	zend_class_entry *lexical_scope;
 	char required_scope_absolute;
 
 	ZEND_MAP_PTR_DEF(zend_class_mutable_data*, mutable_data);
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index a56b42b92e0f5..e05ba4ef55f13 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -9215,6 +9215,7 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 			// if a class is private or protected, we need to require the correct scope
 			ce->required_scope = propFlags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED) ? CG(active_class_entry) : NULL;
 			ce->required_scope_absolute = propFlags & ZEND_ACC_PRIVATE ? true : false;
+			ce->lexical_scope = CG(active_class_entry);
 
 			// ensure the class is treated as a top-level class and not an anon class
 			toplevel = true;

From 05aecfddd8c4eea5a7965b1efe3b08839cacd3ca Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 09:02:42 +0100
Subject: [PATCH 28/37] handle type visibility

---
 Zend/zend_execute.c                           | 45 +++++++++++++++++++
 Zend/zend_object_handlers.c                   |  4 ++
 Zend/zend_vm_def.h                            | 22 ++++++---
 .../classes/inner_classes/properties_001.phpt | 23 ----------
 .../classes/inner_classes/visibility_001.phpt | 28 ++++++------
 .../classes/inner_classes/visibility_002.phpt | 30 +++++++++++++
 .../classes/inner_classes/visibility_003.phpt | 30 +++++++++++++
 .../classes/inner_classes/visibility_004.phpt | 25 +++++++++++
 8 files changed, 165 insertions(+), 42 deletions(-)
 delete mode 100644 tests/classes/inner_classes/properties_001.phpt
 create mode 100644 tests/classes/inner_classes/visibility_002.phpt
 create mode 100644 tests/classes/inner_classes/visibility_003.phpt
 create mode 100644 tests/classes/inner_classes/visibility_004.phpt

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index efa759f334ef8..3a983e7086885 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1045,12 +1045,57 @@ static zend_always_inline bool i_zend_check_property_type(const zend_property_in
 	return zend_verify_scalar_type_hint(type_mask, property, strict, 0);
 }
 
+static zend_always_inline bool zend_check_class_visibility(const zend_class_entry *ce, const zend_property_info *info, uint32_t current_visibility) {
+	// a public class is always visible
+	if (!ce->required_scope) {
+		return 1;
+	}
+
+	// a protected class is visible if it is a subclass of the lexical scope and the current visibility is protected or private
+	if (!ce->required_scope_absolute) {
+		if (current_visibility & ZEND_ACC_PUBLIC) {
+			zend_type_error("Cannot assign private %s to higher visibile property %s::%s",
+				ZSTR_VAL(ce->name),
+				ZSTR_VAL(info->ce->name),
+				zend_get_unmangled_property_name(info->name));
+			return 0;
+		}
+
+		return 0;
+	}
+
+	// a private class is visible if it is the same class as the lexical scope and the current visibility is private
+	if (ce->required_scope_absolute && current_visibility & ZEND_ACC_PRIVATE) {
+		return 1;
+	}
+
+	zend_type_error("Cannot assign private %s to higher visibile property %s::%s",
+		ZSTR_VAL(ce->name),
+		ZSTR_VAL(info->ce->name),
+		zend_get_unmangled_property_name(info->name));
+
+	return 0;
+}
+
 static zend_always_inline bool i_zend_verify_property_type(const zend_property_info *info, zval *property, bool strict)
 {
+	if(Z_TYPE_P(property) == IS_OBJECT && !zend_check_class_visibility(Z_OBJCE_P(property), info, info->flags)) {
+		zend_verify_property_type_error(info, property);
+		return 0;
+	}
+
 	if (i_zend_check_property_type(info, property, strict)) {
 		return 1;
 	}
 
+        // todo:
+        // 1: add a flag to the type so we can tell the type is an inner class
+        // 2: use said flag to flag the property info
+        // 3: same with parameters/args too
+        // 4: create a simple function to take a visibility flag and ce, it should return SUCCESS if the ce can be used
+        // 5: if we have an inner class in a prop/arg, we validate it can be returned (do not autoload) by looping over types
+        //    that are inner classes and looking up the ce. If it is not autoloaded, then it is not going to match the type anyway.
+
 	zend_verify_property_type_error(info, property);
 	return 0;
 }
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index f2c2886eeb2be..9956c3f70e320 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -401,6 +401,10 @@ static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *c
 				if (property_info->ce != ce) {
 					goto dynamic;
 				} else {
+					if (scope && scope->lexical_scope && scope->lexical_scope == ce) {
+						// Allow access to private properties from within the same outer class
+						goto found;
+					}
 wrong:
 					/* Information was available, but we were denied access.  Error out. */
 					if (!silent) {
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 76adfe21be468..aa96e1c98a5ff 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1869,12 +1869,22 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 	}
 
 	if (inner_ce->required_scope) {
-		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
-			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
-		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
-			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
+		if (inner_ce->required_scope_absolute) {
+			// for private classes, we check if the scope we are currently in has access
+			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
+		} else {
+			// for protected classes, we check if the scope is an instance of the required scope
+			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
 		}
 	}
 
diff --git a/tests/classes/inner_classes/properties_001.phpt b/tests/classes/inner_classes/properties_001.phpt
deleted file mode 100644
index a5366f5b4a3c5..0000000000000
--- a/tests/classes/inner_classes/properties_001.phpt
+++ /dev/null
@@ -1,23 +0,0 @@
---TEST--
-property types
---FILE--
-<?php
-
-class Outer {
-    public self:>Inner $inner;
-    private class Inner {}
-    public function test(): void {
-        $this->inner = new self:>Inner();
-    }
-}
-
-$outer = new Outer();
-$outer->test();
-var_dump($outer->inner);
-?>
---EXPECTF--
-Fatal error: Uncaught TypeError: Method test is public but returns a private class: Outer:>Inner in %s:%d
-Stack trace:
-#0 %s(%d): Outer::test()
-#1 {main}
-  thrown in %s on line %d
diff --git a/tests/classes/inner_classes/visibility_001.phpt b/tests/classes/inner_classes/visibility_001.phpt
index 6c880452326ef..0473686689403 100644
--- a/tests/classes/inner_classes/visibility_001.phpt
+++ b/tests/classes/inner_classes/visibility_001.phpt
@@ -4,20 +4,22 @@ outer class visibility
 <?php
 
 class Outer {
-    private class Inner {}
-    private class Other {
-        public function __construct(private Outer:>Inner $inner) {}
+        private class Inner {}
+        public Outer:>Inner $illegal;
 
-        public function reset(): void {
-            $prev = $this->inner;
-            $this->inner = new Outer:>Inner();
-            var_dump($prev === $this->inner);
+        public function test(): void {
+                $this->illegal = new Outer:>Inner();
         }
-    }
-    public static function test(): void {
-        new self:>Other(new Outer:>Inner());
-    }
 }
-Outer::test();
+
+$x = new Outer();
+$x->test();
+
+var_dump($x);
 ?>
---EXPECT--
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot assign private Outer:>Inner to higher visibile property Outer::illegal in %s:%d
+Stack trace:
+#0 %s(%d): Outer->test()
+#1 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes/visibility_002.phpt b/tests/classes/inner_classes/visibility_002.phpt
new file mode 100644
index 0000000000000..8e99b87d15a15
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_002.phpt
@@ -0,0 +1,30 @@
+--TEST--
+accessing outer class private vars
+--FILE--
+<?php
+
+class Outer {
+        private class Inner {
+                public function test(Outer $i) {
+                        $i->illegal = $this;
+                }
+        }
+        private Outer:>Inner $illegal;
+
+        public function test(): void {
+                new Outer:>Inner()->test($this);
+        }
+}
+
+$x = new Outer();
+$x->test();
+
+var_dump($x);
+
+?>
+--EXPECT--
+object(Outer)#1 (1) {
+  ["illegal":"Outer":private]=>
+  object(Outer:>Inner)#2 (0) {
+  }
+}
diff --git a/tests/classes/inner_classes/visibility_003.phpt b/tests/classes/inner_classes/visibility_003.phpt
new file mode 100644
index 0000000000000..66f42b2707838
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_003.phpt
@@ -0,0 +1,30 @@
+--TEST--
+accessing outer protected vars
+--FILE--
+<?php
+
+class Outer {
+        private class Inner {
+                public function test(Outer $i) {
+                        $i->illegal = $this;
+                }
+        }
+        private Outer:>Inner $illegal;
+
+        public function test(): void {
+                new Outer:>Inner()->test($this);
+        }
+}
+
+$x = new Outer();
+$x->test();
+
+var_dump($x);
+
+?>
+--EXPECT--
+object(Outer)#1 (1) {
+  ["illegal":"Outer":private]=>
+  object(Outer:>Inner)#2 (0) {
+  }
+}
diff --git a/tests/classes/inner_classes/visibility_004.phpt b/tests/classes/inner_classes/visibility_004.phpt
new file mode 100644
index 0000000000000..3115858fee756
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_004.phpt
@@ -0,0 +1,25 @@
+--TEST--
+outer class visibility
+--FILE--
+<?php
+
+class Outer {
+        protected class Inner {}
+        public Outer:>Inner $illegal;
+
+        public function test(): void {
+                $this->illegal = new Outer:>Inner();
+        }
+}
+
+$x = new Outer();
+$x->test();
+
+var_dump($x);
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot assign private Outer:>Inner to higher visibile property Outer::illegal in %s:%d
+Stack trace:
+#0 %s(%d): Outer->test()
+#1 {main}
+  thrown in %s on line %d

From 51f2fc5d890dfb16b74c9357a032e70fdf925859 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 09:46:20 +0100
Subject: [PATCH 29/37] fix opcache

---
 Zend/zend_compile.c        |   5 +-
 Zend/zend_execute.c        |  10 +---
 Zend/zend_vm_execute.h     | 114 +++++++++++++++++++++++++++++++------
 ext/opcache/zend_persist.c |   9 +++
 4 files changed, 108 insertions(+), 30 deletions(-)

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index e05ba4ef55f13..6ac33082df41c 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2943,9 +2943,7 @@ static void zend_compile_inner_class_ref(znode *result, zend_ast *ast, uint32_t
 		zend_compile_expr(&inner_node, inner_class);
 	}
 
-	zend_op *opline = zend_emit_op(result, ZEND_FETCH_INNER_CLASS, &outer_node, &inner_node);
-	// ensure we allocate two slots to prevent an issue with static method access
-	opline->extended_value = zend_alloc_cache_slots(2);
+	zend_emit_op(result, ZEND_FETCH_INNER_CLASS, &outer_node, &inner_node);
 }
 /* }}} */
 
@@ -9222,6 +9220,7 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 		} else {
 			name = zend_prefix_with_ns(unqualified_name);
 			ce->required_scope = NULL;
+			ce->lexical_scope = NULL;
 		}
 		name = zend_new_interned_string(name);
 		lcname = zend_string_tolower(name);
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 3a983e7086885..aba772bb9d13c 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1061,7 +1061,7 @@ static zend_always_inline bool zend_check_class_visibility(const zend_class_entr
 			return 0;
 		}
 
-		return 0;
+		return 1;
 	}
 
 	// a private class is visible if it is the same class as the lexical scope and the current visibility is private
@@ -1088,14 +1088,6 @@ static zend_always_inline bool i_zend_verify_property_type(const zend_property_i
 		return 1;
 	}
 
-        // todo:
-        // 1: add a flag to the type so we can tell the type is an inner class
-        // 2: use said flag to flag the property info
-        // 3: same with parameters/args too
-        // 4: create a simple function to take a visibility flag and ce, it should return SUCCESS if the ce can be used
-        // 5: if we have an inner class in a prop/arg, we validate it can be returned (do not autoload) by looping over types
-        //    that are inner classes and looking up the ce. If it is not autoloaded, then it is not going to match the type anyway.
-
 	zend_verify_property_type_error(info, property);
 	return 0;
 }
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cde630e1ab345..eab173b2a7ffc 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6682,12 +6682,22 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 	}
 
 	if (inner_ce->required_scope) {
-		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
-			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
-		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
-			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
+		if (inner_ce->required_scope_absolute) {
+			// for private classes, we check if the scope we are currently in has access
+			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
+		} else {
+			// for protected classes, we check if the scope is an instance of the required scope
+			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
 		}
 	}
 
@@ -7402,6 +7412,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_CONST != IS_CONST &&
+	           IS_CONST == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -9972,6 +9986,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_CONST != IS_CONST &&
+	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -10726,6 +10744,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_CONST != IS_CONST &&
+	           IS_UNUSED == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -12474,6 +12496,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_CONST != IS_CONST &&
+	           IS_CV == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
@@ -16289,12 +16315,22 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 	}
 
 	if (inner_ce->required_scope) {
-		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
-			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
-		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
-			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
+		if (inner_ce->required_scope_absolute) {
+			// for private classes, we check if the scope we are currently in has access
+			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
+		} else {
+			// for protected classes, we check if the scope is an instance of the required scope
+			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
 		}
 	}
 
@@ -25612,6 +25648,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_VAR != IS_CONST &&
+	           IS_CONST == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -28541,6 +28581,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_VAR != IS_CONST &&
+	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -30047,6 +30091,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_VAR != IS_CONST &&
+	           IS_UNUSED == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -33000,6 +33048,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_VAR != IS_CONST &&
+	           IS_CV == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
@@ -34014,12 +34066,22 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 	}
 
 	if (inner_ce->required_scope) {
-		if (inner_ce->required_scope_absolute && inner_ce->required_scope != scope) {
-			zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
-		} else if (scope == NULL || !instanceof_function(scope, inner_ce->required_scope)) {
-			zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
-			HANDLE_EXCEPTION();
+		if (inner_ce->required_scope_absolute) {
+			// for private classes, we check if the scope we are currently in has access
+			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
+		} else {
+			// for protected classes, we check if the scope is an instance of the required scope
+			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
+				// we are in the correct scope
+			} else {
+				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				HANDLE_EXCEPTION();
+			}
 		}
 	}
 
@@ -35355,6 +35417,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_CONST == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_UNUSED != IS_CONST &&
+	           IS_CONST == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CONST != IS_UNUSED) {
 		function_name = RT_CONSTANT(opline, opline->op2);
 		if (IS_CONST != IS_CONST) {
@@ -37520,6 +37586,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    (IS_TMP_VAR|IS_VAR) == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_UNUSED != IS_CONST &&
+	           (IS_TMP_VAR|IS_VAR) == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_UNUSED) {
 		function_name = _get_zval_ptr_var(opline->op2.var EXECUTE_DATA_CC);
 		if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -37927,6 +37997,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_UNUSED == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_UNUSED != IS_CONST &&
+	           IS_UNUSED == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_UNUSED != IS_UNUSED) {
 		function_name = NULL;
 		if (IS_UNUSED != IS_CONST) {
@@ -40175,6 +40249,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 	    IS_CV == IS_CONST &&
 	    EXPECTED((fbc = CACHED_PTR(opline->result.num + sizeof(void*))) != NULL)) {
 		/* nothing to do */
+	} else if (IS_UNUSED != IS_CONST &&
+	           IS_CV == IS_CONST &&
+	           EXPECTED(CACHED_PTR(opline->result.num) == ce)) {
+		fbc = CACHED_PTR(opline->result.num + sizeof(void*));
 	} else if (IS_CV != IS_UNUSED) {
 		function_name = EX_VAR(opline->op2.var);
 		if (IS_CV != IS_CONST) {
diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index fa82f997ee3a5..771101462b510 100644
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -1131,6 +1131,15 @@ void zend_update_required_scope(zend_class_entry *ce)
 			ce->required_scope = r;
 		}
 	}
+
+	if (ce->lexical_scope) {
+		zend_class_entry *lexical_scope = ce->lexical_scope;
+
+		zend_class_entry *l = zend_shared_alloc_get_xlat_entry(lexical_scope);
+		if (l) {
+			ce->lexical_scope = l;
+		}
+	}
 }
 
 void zend_update_parent_ce(zend_class_entry *ce)

From 4fda62bf0aa4bb6f864a5649087c480c52772def Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 09:49:03 +0100
Subject: [PATCH 30/37] fix test

---
 Zend/zend_execute.c                             | 2 +-
 tests/classes/inner_classes/visibility_004.phpt | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index aba772bb9d13c..d734b590bc3f7 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1054,7 +1054,7 @@ static zend_always_inline bool zend_check_class_visibility(const zend_class_entr
 	// a protected class is visible if it is a subclass of the lexical scope and the current visibility is protected or private
 	if (!ce->required_scope_absolute) {
 		if (current_visibility & ZEND_ACC_PUBLIC) {
-			zend_type_error("Cannot assign private %s to higher visibile property %s::%s",
+			zend_type_error("Cannot assign protected %s to higher visibile property %s::%s",
 				ZSTR_VAL(ce->name),
 				ZSTR_VAL(info->ce->name),
 				zend_get_unmangled_property_name(info->name));
diff --git a/tests/classes/inner_classes/visibility_004.phpt b/tests/classes/inner_classes/visibility_004.phpt
index 3115858fee756..38390f65c830e 100644
--- a/tests/classes/inner_classes/visibility_004.phpt
+++ b/tests/classes/inner_classes/visibility_004.phpt
@@ -18,7 +18,7 @@ $x->test();
 var_dump($x);
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Cannot assign private Outer:>Inner to higher visibile property Outer::illegal in %s:%d
+Fatal error: Uncaught TypeError: Cannot assign protected Outer:>Inner to higher visibile property Outer::illegal in %s:%d
 Stack trace:
 #0 %s(%d): Outer->test()
 #1 {main}

From 2053a50bc1d85c965130acc7663a25a8a8ccdff9 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 10:18:45 +0100
Subject: [PATCH 31/37] refine some error messages

---
 Zend/zend_vm_def.h                            | 14 ++---
 Zend/zend_vm_execute.h                        | 54 +++++++++----------
 tests/classes/inner_classes/autoload_002.phpt |  2 +-
 tests/classes/inner_classes/errors_001.phpt   |  9 ++++
 tests/classes/inner_classes/errors_002.phpt   | 12 +++++
 .../inner_classes/return_types_002.phpt       |  2 +-
 .../inner_classes/return_types_003.phpt       |  2 +-
 .../inner_classes/return_types_004.phpt       |  2 +-
 .../inner_classes/return_types_005.phpt       |  2 +-
 9 files changed, 60 insertions(+), 39 deletions(-)
 create mode 100644 tests/classes/inner_classes/errors_001.phpt
 create mode 100644 tests/classes/inner_classes/errors_002.phpt

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index aa96e1c98a5ff..a965706371adb 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1812,7 +1812,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
 		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
 		if (!outer_ce) {
-			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			zend_error(E_ERROR, "Outer class '%s' not found for inner class %s:>%s", Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
 			HANDLE_EXCEPTION();
 		}
 	} else if (OP1_TYPE == IS_UNUSED) {
@@ -1864,7 +1864,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
-		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		zend_error(E_ERROR, "Inner class '%s' not found in outer class %s", ZSTR_VAL(full_class_name), ZSTR_VAL(outer_ce->name));
 		HANDLE_EXCEPTION();
 	}
 
@@ -1874,7 +1874,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access private inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		} else {
@@ -1882,7 +1882,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access protected inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		}
@@ -4529,15 +4529,15 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index eab173b2a7ffc..2e6a66fd0730b 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6625,7 +6625,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
 		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
 		if (!outer_ce) {
-			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			zend_error(E_ERROR, "Outer class '%s' not found for inner class %s:>%s", Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
 			HANDLE_EXCEPTION();
 		}
 	} else if (IS_CONST == IS_UNUSED) {
@@ -6677,7 +6677,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
-		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		zend_error(E_ERROR, "Inner class '%s' not found in outer class %s", ZSTR_VAL(full_class_name), ZSTR_VAL(outer_ce->name));
 		HANDLE_EXCEPTION();
 	}
 
@@ -6687,7 +6687,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access private inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		} else {
@@ -6695,7 +6695,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access protected inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		}
@@ -10902,15 +10902,15 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYP
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
@@ -16258,7 +16258,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
 		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
 		if (!outer_ce) {
-			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			zend_error(E_ERROR, "Outer class '%s' not found for inner class %s:>%s", Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
 			HANDLE_EXCEPTION();
 		}
 	} else if ((IS_TMP_VAR|IS_VAR) == IS_UNUSED) {
@@ -16310,7 +16310,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
-		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		zend_error(E_ERROR, "Inner class '%s' not found in outer class %s", ZSTR_VAL(full_class_name), ZSTR_VAL(outer_ce->name));
 		HANDLE_EXCEPTION();
 	}
 
@@ -16320,7 +16320,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access private inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		} else {
@@ -16328,7 +16328,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access protected inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		}
@@ -21755,15 +21755,15 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_TMP_UN
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
@@ -30249,15 +30249,15 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UN
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
@@ -34009,7 +34009,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 		zval *outer_class_zv = RT_CONSTANT(opline, opline->op1);
 		outer_ce = zend_lookup_class(Z_STR_P(outer_class_zv));
 		if (!outer_ce) {
-			zend_error(E_ERROR, "Class '%s' not found", Z_STRVAL_P(outer_class_zv));
+			zend_error(E_ERROR, "Outer class '%s' not found for inner class %s:>%s", Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(outer_class_zv), Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
 			HANDLE_EXCEPTION();
 		}
 	} else if (IS_UNUSED == IS_UNUSED) {
@@ -34061,7 +34061,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 
 	inner_ce = zend_lookup_class(full_class_name);
 	if (!inner_ce) {
-		zend_error(E_ERROR, "Class '%s' not found", ZSTR_VAL(full_class_name));
+		zend_error(E_ERROR, "Inner class '%s' not found in outer class %s", ZSTR_VAL(full_class_name), ZSTR_VAL(outer_ce->name));
 		HANDLE_EXCEPTION();
 	}
 
@@ -34071,7 +34071,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 			if (scope != NULL && (inner_ce->required_scope == scope || scope->lexical_scope == inner_ce->required_scope)) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is private", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access private inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		} else {
@@ -34079,7 +34079,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 			if (scope != NULL && (instanceof_function(scope, inner_ce->required_scope) || instanceof_function(scope->lexical_scope, inner_ce->required_scope))) {
 				// we are in the correct scope
 			} else {
-				zend_error(E_ERROR, "Class '%s' is protected", ZSTR_VAL(full_class_name));
+				zend_error(E_ERROR, "Cannot access protected inner class '%s'", ZSTR_VAL(full_class_name));
 				HANDLE_EXCEPTION();
 			}
 		}
@@ -38155,15 +38155,15 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_UNUSED
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
@@ -50974,15 +50974,15 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
 		if (Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
-					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				} else {
-					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Public method %s cannot return protected class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
-					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					zend_type_error("Protected method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
 					HANDLE_EXCEPTION();
 				}
 			}
diff --git a/tests/classes/inner_classes/autoload_002.phpt b/tests/classes/inner_classes/autoload_002.phpt
index 4259bc8553162..f2cbd1fc6cc74 100644
--- a/tests/classes/inner_classes/autoload_002.phpt
+++ b/tests/classes/inner_classes/autoload_002.phpt
@@ -13,4 +13,4 @@ var_dump($line);
 --EXPECTF--
 autoload(inner_classes)
 
-Fatal error: Class 'inner_classes:>Line' is private in %s on line %d
+Fatal error: Cannot access private inner class 'inner_classes:>Line' in %s
diff --git a/tests/classes/inner_classes/errors_001.phpt b/tests/classes/inner_classes/errors_001.phpt
new file mode 100644
index 0000000000000..f4817e95351ce
--- /dev/null
+++ b/tests/classes/inner_classes/errors_001.phpt
@@ -0,0 +1,9 @@
+--TEST--
+no outer class
+--FILE--
+<?php
+
+new Outer:>Inner();
+?>
+--EXPECTF--
+Fatal error: Outer class 'Outer' not found for inner class Outer:>Inner in %s on line %d
diff --git a/tests/classes/inner_classes/errors_002.phpt b/tests/classes/inner_classes/errors_002.phpt
new file mode 100644
index 0000000000000..c9e1c08147675
--- /dev/null
+++ b/tests/classes/inner_classes/errors_002.phpt
@@ -0,0 +1,12 @@
+--TEST--
+inner class not found
+--FILE--
+<?php
+
+class Outer {
+}
+
+new Outer:>Inner();
+?>
+--EXPECTF--
+Fatal error: Inner class 'Outer:>Inner' not found in outer class Outer in %s on line %d
diff --git a/tests/classes/inner_classes/return_types_002.phpt b/tests/classes/inner_classes/return_types_002.phpt
index 80aab3c3e68b2..b2929a6fdd148 100644
--- a/tests/classes/inner_classes/return_types_002.phpt
+++ b/tests/classes/inner_classes/return_types_002.phpt
@@ -29,4 +29,4 @@ var_dump($outer->getInner());
 object(Outer:>Inner)#2 (0) {
 }
 
-Fatal error: Class 'Outer:>Inner' is private in %s on line %d
+Fatal error: Cannot access private inner class 'Outer:>Inner' in %s on line %d
diff --git a/tests/classes/inner_classes/return_types_003.phpt b/tests/classes/inner_classes/return_types_003.phpt
index e96529b108d0d..4326566956ca2 100644
--- a/tests/classes/inner_classes/return_types_003.phpt
+++ b/tests/classes/inner_classes/return_types_003.phpt
@@ -26,7 +26,7 @@ var_dump(new Outer:>Inner());
 object(Outer:>Inner)#2 (0) {
 }
 
-Fatal error: Uncaught TypeError: Method getInner is public but returns a protected class: Outer:>Inner in %s:%d
+Fatal error: Uncaught TypeError: Public method getInner cannot return protected class Outer:>Inner in %s:%d
 Stack trace:
 #0 %s(%d): Foo->getInner()
 #1 {main}
diff --git a/tests/classes/inner_classes/return_types_004.phpt b/tests/classes/inner_classes/return_types_004.phpt
index efc50b6bca1d5..0fbeacd246297 100644
--- a/tests/classes/inner_classes/return_types_004.phpt
+++ b/tests/classes/inner_classes/return_types_004.phpt
@@ -19,7 +19,7 @@ var_dump($r);
 test($r);
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Method getInner is public but returns a private class: Outer:>Inner in %s:%d
+Fatal error: Uncaught TypeError: Public method getInner cannot return private class Outer:>Inner in %s:%d
 Stack trace:
 #0 %s(%d): Outer::getInner()
 #1 {main}
diff --git a/tests/classes/inner_classes/return_types_005.phpt b/tests/classes/inner_classes/return_types_005.phpt
index 4e804831479a3..5c2ed4ae7de86 100644
--- a/tests/classes/inner_classes/return_types_005.phpt
+++ b/tests/classes/inner_classes/return_types_005.phpt
@@ -19,7 +19,7 @@ var_dump($r);
 test($r);
 ?>
 --EXPECTF--
-Fatal error: Uncaught TypeError: Method getInner is public but returns a protected class: Outer:>Inner in %s:%d
+Fatal error: Uncaught TypeError: Public method getInner cannot return protected class Outer:>Inner in %s:%d
 Stack trace:
 #0 %s(%d): Outer::getInner()
 #1 {main}

From 5f9db7bfb2c3760ea2820649bd65d082174ebdea Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 10:47:12 +0100
Subject: [PATCH 32/37] add type check to return type

---
 Zend/zend_vm_def.h     |  2 +-
 Zend/zend_vm_execute.h | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index a965706371adb..ffc12909d68d2 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4526,7 +4526,7 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 2e6a66fd0730b..5f25118af52d4 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -10899,7 +10899,7 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYP
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
@@ -21752,7 +21752,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_TMP_UN
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
@@ -30246,7 +30246,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UN
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
@@ -38152,7 +38152,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_UNUSED
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
@@ -50971,7 +50971,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
 
 		SAVE_OPLINE();
 
-		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+		if (Z_TYPE_P(retval_ptr) == IS_OBJECT && Z_OBJCE_P(retval_ptr)->required_scope) {
 			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
 				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
 					zend_type_error("Public method %s cannot return private class %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));

From 7376eff4f23a3667af5413a15f426846391a3e61 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 11:20:37 +0100
Subject: [PATCH 33/37] fix tests

---
 Zend/tests/errmsg/errmsg_027.phpt             |  2 +-
 Zend/zend_compile.c                           |  2 ++
 .../tests/ReflectionClass_toString_001.phpt   | 30 ++++++++++++++++++-
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/Zend/tests/errmsg/errmsg_027.phpt b/Zend/tests/errmsg/errmsg_027.phpt
index 3d96ec27b4d64..a30e1269453f9 100644
--- a/Zend/tests/errmsg/errmsg_027.phpt
+++ b/Zend/tests/errmsg/errmsg_027.phpt
@@ -13,4 +13,4 @@ class test {
 echo "Done\n";
 ?>
 --EXPECTF--
-Fatal error: Class declarations may not be nested in %s on line %d
+Fatal error: Class declarations may not be declared inside functions in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 6ac33082df41c..034e6ed1edea2 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -9239,6 +9239,8 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 		/* Find an anon class name that is not in use yet. */
 		name = NULL;
 		lcname = NULL;
+		ce->required_scope = NULL;
+		ce->lexical_scope = NULL;
 		do {
 			zend_tmp_string_release(name);
 			zend_tmp_string_release(lcname);
diff --git a/ext/reflection/tests/ReflectionClass_toString_001.phpt b/ext/reflection/tests/ReflectionClass_toString_001.phpt
index fd5d83e917419..2a77633245d03 100644
--- a/ext/reflection/tests/ReflectionClass_toString_001.phpt
+++ b/ext/reflection/tests/ReflectionClass_toString_001.phpt
@@ -30,7 +30,7 @@ Class [ <internal:Reflection> class ReflectionClass implements Stringable, Refle
     Property [ public string $name ]
   }
 
-  - Methods [64] {
+  - Methods [68] {
     Method [ <internal:Reflection> private method __clone ] {
 
       - Parameters [0] {
@@ -514,5 +514,33 @@ Class [ <internal:Reflection> class ReflectionClass implements Stringable, Refle
       }
       - Return [ array ]
     }
+
+    Method [ <internal:Reflection> public method isInnerClass ] {
+
+      - Parameters [0] {
+      }
+      - Return [ bool ]
+    }
+
+    Method [ <internal:Reflection> public method isPrivate ] {
+
+      - Parameters [0] {
+      }
+      - Return [ bool ]
+    }
+
+    Method [ <internal:Reflection> public method isProtected ] {
+
+      - Parameters [0] {
+      }
+      - Return [ bool ]
+    }
+
+    Method [ <internal:Reflection> public method isPublic ] {
+
+      - Parameters [0] {
+      }
+      - Return [ bool ]
+    }
   }
 }

From 20929102dd54c12174e039eda6dfc24ce9fa3ac2 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 11:21:14 +0100
Subject: [PATCH 34/37] temporarily fix this test -- might want to undo this

---
 ext/reflection/tests/bug74454.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/reflection/tests/bug74454.phpt b/ext/reflection/tests/bug74454.phpt
index 272409339c479..f1116becf6ce8 100644
--- a/ext/reflection/tests/bug74454.phpt
+++ b/ext/reflection/tests/bug74454.phpt
@@ -14,4 +14,4 @@ function load_file() {
 }
 ?>
 --EXPECT--
-ParseError: syntax error, unexpected token "if", expecting "function"
+ParseError: syntax error, unexpected token "if", expecting "class"

From 5f5d53f77ae05021533ffab1c3ecb5ba2e13841c Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 12:38:37 +0100
Subject: [PATCH 35/37] clean up a bit and check readonly

---
 Zend/zend_compile.c                           |  2 +-
 Zend/zend_execute.c                           |  8 +++----
 tests/classes/inner_classes/readonly_001.phpt | 23 +++++++++++++++++++
 3 files changed, 28 insertions(+), 5 deletions(-)
 create mode 100644 tests/classes/inner_classes/readonly_001.phpt

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 034e6ed1edea2..02034c2838b98 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -9199,7 +9199,7 @@ static void zend_compile_class_decl(znode *result, zend_ast *ast, bool toplevel)
 				decl->flags |= ZEND_ACC_EXPLICIT_ABSTRACT_CLASS;
 			}
 			if (decl->attr & ZEND_ACC_READONLY) {
-				decl->flags |= ZEND_ACC_READONLY_CLASS & ZEND_ACC_NO_DYNAMIC_PROPERTIES;
+				decl->flags |= ZEND_ACC_READONLY_CLASS | ZEND_ACC_NO_DYNAMIC_PROPERTIES;
 			}
 
 			// configure for a nested class. This should only include:
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index d734b590bc3f7..36a9174c5dc0c 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1239,14 +1239,14 @@ static zend_always_inline bool zend_check_type_slow(
 				zend_class_entry *scope = zend_get_executed_scope();
 				if (ce->required_scope_absolute && scope != ce->required_scope) {
 					if (scope == NULL) {
-						zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the global scope", ce->name->val);
+						zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the global scope", ZSTR_VAL(ce->name));
 					}
 
-					zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the scope of %s", ce->name->val, scope->name->val);
+					zend_error(E_ERROR, "Private inner class %s cannot be used as a type declaration in the scope of %s", ZSTR_VAL(ce->name), ZSTR_VAL(scope->name));
 				} else if (scope == NULL) {
-					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the global scope", ce->name->val);
+					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the global scope", ZSTR_VAL(ce->name));
 				} else if (!instanceof_function(scope, ce->required_scope)) {
-					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the scope of %s", ce->name->val, scope->name->val);
+					zend_error(E_ERROR, "Protected inner class %s cannot be used as a type declaration in the scope of %s", ZSTR_VAL(ce->name), ZSTR_VAL(scope->name));
 				}
 			}
 
diff --git a/tests/classes/inner_classes/readonly_001.phpt b/tests/classes/inner_classes/readonly_001.phpt
new file mode 100644
index 0000000000000..189c9bcb23b7d
--- /dev/null
+++ b/tests/classes/inner_classes/readonly_001.phpt
@@ -0,0 +1,23 @@
+--TEST--
+readonly should work
+--FILE--
+<?php
+
+class Outer {
+    public readonly class Inner { public function __construct(public int $t) {} }
+}
+
+var_dump($foo = new Outer:>Inner(1));
+$foo->t = 42;
+var_dump($foo);
+?>
+--EXPECTF--
+object(Outer:>Inner)#1 (1) {
+  ["t"]=>
+  int(1)
+}
+
+Fatal error: Uncaught Error: Cannot modify readonly property Outer:>Inner::$t in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

From 0ff7a33718360bbcd76e2d6433e4d6d7ad1ba0d0 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 15:30:19 +0100
Subject: [PATCH 36/37] handle visibility of methods

---
 Zend/zend_object_handlers.c                   | 11 ++++++++
 .../classes/inner_classes/visibility_005.phpt | 27 ++++++++++++++++++
 .../classes/inner_classes/visibility_006.phpt | 28 +++++++++++++++++++
 .../classes/inner_classes/visibility_007.phpt | 27 ++++++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 tests/classes/inner_classes/visibility_005.phpt
 create mode 100644 tests/classes/inner_classes/visibility_006.phpt
 create mode 100644 tests/classes/inner_classes/visibility_007.phpt

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 9956c3f70e320..b3193f220b5e9 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1819,6 +1819,7 @@ ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *
 	/* Check access level */
 	if (fbc->op_array.fn_flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
 		scope = zend_get_executed_scope();
+check_lexical_scope:
 
 		if (fbc->common.scope != scope) {
 			if (fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
@@ -1836,6 +1837,10 @@ ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *
 				if (zobj->ce->__call) {
 					fbc = zend_get_user_call_function(zobj->ce, method_name);
 				} else {
+					if (scope->lexical_scope) {
+						scope = scope->lexical_scope;
+						goto check_lexical_scope;
+					}
 					zend_bad_method_call(fbc, method_name, scope);
 					fbc = NULL;
 				}
@@ -1895,11 +1900,17 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_st
 		fbc = Z_FUNC_P(func);
 		if (!(fbc->op_array.fn_flags & ZEND_ACC_PUBLIC)) {
 			zend_class_entry *scope = zend_get_executed_scope();
+check_lexical_scope:
 			if (UNEXPECTED(fbc->common.scope != scope)) {
 				if (UNEXPECTED(fbc->op_array.fn_flags & ZEND_ACC_PRIVATE)
 				 || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
 					zend_function *fallback_fbc = get_static_method_fallback(ce, function_name);
 					if (!fallback_fbc) {
+						if (scope->lexical_scope) {
+							scope = scope->lexical_scope;
+							goto check_lexical_scope;
+						}
+
 						zend_bad_method_call(fbc, function_name, scope);
 					}
 					fbc = fallback_fbc;
diff --git a/tests/classes/inner_classes/visibility_005.phpt b/tests/classes/inner_classes/visibility_005.phpt
new file mode 100644
index 0000000000000..32737d6cbc5ee
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_005.phpt
@@ -0,0 +1,27 @@
+--TEST--
+accessing outer private methods
+--FILE--
+<?php
+
+class Outer {
+    private function test() {
+        echo __METHOD__ . "\n";
+    }
+    class Middle {
+        private static function test() {
+            echo __METHOD__ . "\n";
+        }
+        class Inner {
+            public function test() {
+                Outer:>Middle::test();
+                $t = new Outer();
+                $t->test();
+            }
+        }
+    }
+}
+new Outer:>Middle:>Inner()->test();
+?>
+--EXPECT--
+Outer:>Middle::test
+Outer::test
diff --git a/tests/classes/inner_classes/visibility_006.phpt b/tests/classes/inner_classes/visibility_006.phpt
new file mode 100644
index 0000000000000..b5f1cc13a8a38
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_006.phpt
@@ -0,0 +1,28 @@
+--TEST--
+scope doesn't bypass scope
+--FILE--
+<?php
+
+class Outer {
+    private function test() {
+        echo __METHOD__ . "\n";
+    }
+    class Middle {
+        private static function test() {
+            echo __METHOD__ . "\n";
+        }
+        class Inner {
+            public function testit() {
+                $this->test();
+            }
+        }
+    }
+}
+new Outer:>Middle:>Inner()->testit();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Call to undefined method Outer:>Middle:>Inner::test() in %s:%d
+Stack trace:
+#0 %s(%d): Outer:>Middle:>Inner->testit()
+#1 {main}
+  thrown in %s on line %d
diff --git a/tests/classes/inner_classes/visibility_007.phpt b/tests/classes/inner_classes/visibility_007.phpt
new file mode 100644
index 0000000000000..5ed1ebcae5bca
--- /dev/null
+++ b/tests/classes/inner_classes/visibility_007.phpt
@@ -0,0 +1,27 @@
+--TEST--
+accessing outer protected methods
+--FILE--
+<?php
+
+class Outer {
+    protected function test() {
+        echo __METHOD__ . "\n";
+    }
+    class Middle {
+        protected static function test() {
+            echo __METHOD__ . "\n";
+        }
+        class Inner {
+            public function test() {
+                Outer:>Middle::test();
+                $t = new Outer();
+                $t->test();
+            }
+        }
+    }
+}
+new Outer:>Middle:>Inner()->test();
+?>
+--EXPECT--
+Outer:>Middle::test
+Outer::test

From b62121a5b7e7a8779b198bbd9068439a0a876b17 Mon Sep 17 00:00:00 2001
From: Robert Landers <landers.robert@gmail.com>
Date: Fri, 14 Mar 2025 15:30:43 +0100
Subject: [PATCH 37/37] just do not cache -- more trouble than it is worth
 right now

---
 Zend/zend_vm_def.h     | 1 -
 Zend/zend_vm_execute.h | 3 ---
 2 files changed, 4 deletions(-)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index ffc12909d68d2..af0c78dd928ad 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1888,7 +1888,6 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 		}
 	}
 
-	CACHE_PTR(opline->extended_value, inner_ce);
 	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
 
 	zend_string_release(full_class_name);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 5f25118af52d4..ce08a891e59de 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6701,7 +6701,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_CONST_C
 		}
 	}
 
-	CACHE_PTR(opline->extended_value, inner_ce);
 	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
 
 	zend_string_release(full_class_name);
@@ -16334,7 +16333,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_TMPVAR_
 		}
 	}
 
-	CACHE_PTR(opline->extended_value, inner_ce);
 	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
 
 	zend_string_release(full_class_name);
@@ -34085,7 +34083,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_INNER_CLASS_SPEC_UNUSED_
 		}
 	}
 
-	CACHE_PTR(opline->extended_value, inner_ce);
 	Z_CE_P(EX_VAR(opline->result.var)) = inner_ce;
 
 	zend_string_release(full_class_name);