Fix some increment/decrement bugs

Zend/tests/in-de-crement/object_cannot_incdec.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Cannot increment/decrement objects
+--FILE--
+<?php
+class Foo { }
+$o = new Foo;
+
+try {
+    $o++;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $o--;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    ++$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    --$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+?>
+--EXPECT--
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}

Zend/tests/in-de-crement/object_cannot_incdec_use_result_op.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Cannot increment/decrement objects
+--FILE--
+<?php
+class Foo { }
+$o = new Foo;
+
+try {
+    $y = $o++;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = $o--;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = ++$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = --$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+?>
+--EXPECT--
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}

Zend/tests/in-de-crement/oss-fuzz-60709_globals.phpt

@@ -0,0 +1,36 @@
+--TEST--
+oss-fuzz #60709: Test
+--FILE--
+<?php
+set_error_handler(function($_, $m) {
+    echo "$m\n";
+    unset($GLOBALS['x']);
+});
+
+echo "POST DEC\n";
+var_dump($x--);
+unset($x);
+echo "POST INC\n";
+var_dump($x++);
+unset($x);
+echo "PRE DEC\n";
+var_dump(--$x);
+unset($x);
+echo "PRE INC\n";
+var_dump(++$x);
+?>
+--EXPECT--
+POST DEC
+Undefined variable $x
+Decrement on type null has no effect, this will change in the next major version of PHP
+NULL
+POST INC
+Undefined variable $x
+NULL
+PRE DEC
+Undefined variable $x
+Decrement on type null has no effect, this will change in the next major version of PHP
+NULL
+PRE INC
+Undefined variable $x
+int(1)

Zend/tests/in-de-crement/oss-fuzz-60734_predec-object.phpt

@@ -0,0 +1,14 @@
+--TEST--
+OSS Fuzz #60734: use-after-free visible in ASAN build pre decrement.
+--FILE--
+<?php
+class Foo{
+}
+$test = new Foo;
+$y = --$test;
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot decrement Foo in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/in-de-crement/oss-fuzz-60734_preinc-object.phpt

@@ -0,0 +1,14 @@
+--TEST--
+OSS Fuzz #60734: use-after-free visible in ASAN build pre increment.
+--FILE--
+<?php
+class Foo{
+}
+$test = new Foo;
+$y = ++$test;
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot increment Foo in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/in-de-crement/unset_globals_in_error_handler.phpt

@@ -0,0 +1,130 @@
+--TEST--
+Unset variable via $GLOBALS array in error_handler
+--FILE--
+<?php
+set_error_handler(function($_, $m) {
+    echo "$m\n";
+    unset($GLOBALS['x']);
+});
+echo "NULL (only --)\n";
+echo "POST DEC\n";
+$x = null;
+var_dump($x--);
+unset($x);
+echo "PRE DEC\n";
+$x = null;
+var_dump(--$x);
+unset($x);
+echo "Empty string\n";
+echo "POST INC\n";
+$x = "";
+var_dump($x++);
+unset($x);
+echo "POST DEC\n";
+$x = "";
+var_dump($x--);
+unset($x);
+echo "PRE INC\n";
+$x = "";
+var_dump(++$x);
+unset($x);
+echo "PRE DEC\n";
+$x = "";
+var_dump(--$x);
+unset($x);
+echo "Non fill ASCII (only ++)\n";
+echo "POST INC\n";
+$x = " ad ";
+var_dump($x++);
+unset($x);
+echo "PRE INC\n";
+$x = " ad ";
+var_dump(++$x);
+unset($x);
+echo "Bool\n";
+echo "POST INC\n";
+$x = false;
+var_dump($x++);
+unset($x);
+echo "POST DEC\n";
+$x = false;
+var_dump($x--);
+unset($x);
+echo "PRE INC\n";
+$x = false;
+var_dump(++$x);
+unset($x);
+echo "PRE DEC\n";
+$x = false;
+var_dump(--$x);
+unset($x);
+echo "POST INC\n";
+$x = true;
+var_dump($x++);
+unset($x);
+echo "POST DEC\n";
+$x = true;
+var_dump($x--);
+unset($x);
+echo "PRE INC\n";
+$x = true;
+var_dump(++$x);
+unset($x);
+echo "PRE DEC\n";
+$x = true;
+var_dump(--$x);
+unset($x);
+?>
+--EXPECT--
+NULL (only --)
+POST DEC
+Decrement on type null has no effect, this will change in the next major version of PHP
+NULL
+PRE DEC
+Decrement on type null has no effect, this will change in the next major version of PHP
+NULL
+Empty string
+POST INC
+Increment on non-alphanumeric string is deprecated
+string(0) ""
+POST DEC
+Decrement on empty string is deprecated as non-numeric
+string(0) ""
+PRE INC
+Increment on non-alphanumeric string is deprecated
+string(1) "1"
+PRE DEC
+Decrement on empty string is deprecated as non-numeric
+int(-1)
+Non fill ASCII (only ++)
+POST INC
+Increment on non-alphanumeric string is deprecated
+string(4) " ad "
+PRE INC
+Increment on non-alphanumeric string is deprecated
+string(4) " ad "
+Bool
+POST INC
+Increment on type bool has no effect, this will change in the next major version of PHP
+bool(false)
+POST DEC
+Decrement on type bool has no effect, this will change in the next major version of PHP
+bool(false)
+PRE INC
+Increment on type bool has no effect, this will change in the next major version of PHP
+bool(false)
+PRE DEC
+Decrement on type bool has no effect, this will change in the next major version of PHP
+bool(false)
+POST INC
+Increment on type bool has no effect, this will change in the next major version of PHP
+bool(true)
+POST DEC
+Decrement on type bool has no effect, this will change in the next major version of PHP
+bool(true)
+PRE INC
+Increment on type bool has no effect, this will change in the next major version of PHP
+bool(true)
+PRE DEC
+Decrement on type bool has no effect, this will change in the next major version of PHP
+bool(true)