Do not mark multiplication op as commutative

As it might not be when an internal object overloads the multiplication operation

Author: Girgias

Zend/zend_vm_def.h

@@ -162,7 +162,7 @@ ZEND_VM_HELPER(zend_mul_helper, ANY, ANY, zval *op_1, zval *op_2)
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_COLD_CONSTCONST_HANDLER(3, ZEND_MUL, CONST|TMPVARCV, CONST|TMPVARCV, SPEC(COMMUTATIVE))
+ZEND_VM_COLD_CONSTCONST_HANDLER(3, ZEND_MUL, CONST|TMPVARCV, CONST|TMPVARCV)
 {
 	USE_OPLINE
 	zval *op1, *op2, *result;
@@ -7591,7 +7591,7 @@ ZEND_VM_HOT_NOCONST_HANDLER(198, ZEND_JMP_NULL, CONST|TMP|VAR|CV, JMP_ADDR)
 	uint32_t short_circuiting_type = opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK;
 	if (EXPECTED(short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EXPR)) {
 		ZVAL_NULL(result);
-		if (OP1_TYPE == IS_CV 
+		if (OP1_TYPE == IS_CV
 			&& UNEXPECTED(Z_TYPE_P(val) == IS_UNDEF)
 			&& (opline->extended_value & ZEND_JMP_NULL_BP_VAR_IS) == 0
 		) {

Zend/zend_vm_execute.h

@@ -33,6 +33,9 @@
 	_(48, ZEND_SUB_SPEC_TMPVARCV_TMPVARCV) \
 	_(50, ZEND_SUB_SPEC_TMPVARCV_TMPVARCV) \
 	_(51, ZEND_MUL_SPEC_CONST_CONST) \
+	_(52, ZEND_MUL_SPEC_CONST_TMPVARCV) \
+	_(53, ZEND_MUL_SPEC_CONST_TMPVARCV) \
+	_(55, ZEND_MUL_SPEC_CONST_TMPVARCV) \
 	_(56, ZEND_MUL_SPEC_TMPVARCV_CONST) \
 	_(57, ZEND_MUL_SPEC_TMPVARCV_TMPVARCV) \
 	_(58, ZEND_MUL_SPEC_TMPVARCV_TMPVARCV) \

Zend/zend_vm_handlers.h

@@ -232,7 +232,7 @@ static uint32_t zend_vm_opcodes_flags[203] = {
 	0x00000000,
 	0x00000b0b,
 	0x00000b0b,
-	0x80000b0b,
+	0x00000b0b,
 	0x00000707,
 	0x00000b0b,
 	0x00000b0b,

Zend/zend_vm_opcodes.c

@@ -2,8 +2,6 @@
 Zend: test non commutative multiplication object handler
 --EXTENSIONS--
 zend_test
---XFAIL--
-Broken non commutative multiplication with more than 2 ops
 --FILE--
 <?php