Fix concat_function use-after-free on out-of-memory error

Introduced by phpGH-10049

Author: iluuu1994

Zend/zend_operators.c

@@ -2048,13 +2048,16 @@ has_op2_string:;
 		}
 
 		if (result == op1) {
+			/* special case, perform operations on result */
+			result_str = zend_string_extend(op1_string, result_len, 0);
+			/* Free result after zend_string_extend(), as it may throw an out-of-memory error. If we
+			 * free it before we would leave the released variable on the stack with shutdown trying
+			 * to freeing it again. */
 			if (free_op1_string) {
 				/* op1_string will be used as the result, so we should not free it */
 				i_zval_ptr_dtor(result);
 				free_op1_string = false;
 			}
-			/* special case, perform operations on result */
-			result_str = zend_string_extend(op1_string, result_len, 0);
 			/* account for the case where result_str == op1_string == op2_string and the realloc is done */
 			if (op1_string == op2_string) {
 				if (free_op2_string) {