- Fixed Karl's bug report. It's not really a thorough fix, we really need to rethink the INIT_FCALL/DO_FCALL issue.

- Fixed numerous AiCount problems

Zend/zend-scanner.l

@@ -1081,11 +1081,11 @@ ESCAPED_AND_WHITESPACE [\n\t\r #'.:;,()|^&+-/*=%!~<>?@]+
 
 
 <ST_COMMENT>[^*]+ {
-	HANDLE_NEWLINES(yytext, yyleng);
 	yymore();
 }
 
 <ST_COMMENT>"*/" {
+	HANDLE_NEWLINES(yytext, yyleng);
 	BEGIN(ST_IN_SCRIPTING);
 	return T_COMMENT;
 }

Zend/zend_compile.c

@@ -724,6 +724,7 @@ void do_begin_dynamic_function_call(znode *function_name CLS_DC)
 
 	if (last_op_number>=0 && CG(active_op_array)->opcodes[last_op_number].opcode == ZEND_FETCH_OBJ_R) {
 		CG(active_op_array)->opcodes[last_op_number].opcode = ZEND_INIT_FCALL_BY_NAME;
+		CG(active_op_array)->opcodes[last_op_number].extended_value = ZEND_MEMBER_FUNC_CALL;
 	} else {
 		zend_op *opline = get_next_op(CG(active_op_array) CLS_CC);
 	

Zend/zend_execute.c

@@ -378,6 +378,9 @@ static inline void zend_fetch_var_address(znode *result, znode *op1, znode *op2,
 			target_symbol_table = EG(active_symbol_table);
 			break;
 		case ZEND_FETCH_GLOBAL:
+			if (op1->op_type == IS_VAR) {
+				EG(AiCount)++;
+			}
 			target_symbol_table = &EG(symbol_table);
 			break;
 		case ZEND_FETCH_STATIC:
@@ -550,7 +553,7 @@ static inline void zend_fetch_dimension_address(znode *result, znode *op1, znode
 		return;
 	}
 
-	if (container->type == IS_STRING && container->value.str.val == undefined_variable_string) {
+	if (container->type == IS_STRING && container->value.str.len==0) {
 		switch (type) {
 			case BP_VAR_RW:
 			case BP_VAR_W:
@@ -718,7 +721,7 @@ static inline void zend_fetch_property_address(znode *result, znode *op1, znode
 
 
 
-	if (container->type == IS_STRING && container->value.str.val == undefined_variable_string) {
+	if (container->type == IS_STRING && container->value.str.len==0) {
 		switch (type) {
 			case BP_VAR_RW:
 			case BP_VAR_W:
@@ -1383,6 +1386,7 @@ overloaded_function_call_cont:
 						call_overloaded_function(opline->extended_value, &Ts[opline->result.u.var].tmp_var, &EG(regular_list), &EG(persistent_list) ELS_CC);
 						efree(function_being_called);
 					}
+					function_being_called = NULL;
 					function_state.function = (zend_function *) op_array;
 					EG(function_state_ptr) = &function_state;
 					zend_ptr_stack_clear_multiple(ELS_C);