Fix GH-13998: Manage refcount of agg_context->val correctly (#14004)

When step_callback fails, agg_context->val is passed dtor, but agg_context->val
is also used in final_callback regardless of the success/failure of step_callback,
so should not call dtor.

closes #14004
fixes #13998

Author: SakiTakamachi

NEWS

@@ -36,6 +36,8 @@ PHP                                                                        NEWS
 
 - PDO SQLite:
   . Fix GH-13984 (Buffer size is now checked before memcmp). (Saki Takamachi)
+  . Fix GH-13998 (Manage refcount of agg_context->val correctly).
+    (Saki Takamachi)
 
 - Phar:
   . Fixed bug GH-13836 (Renaming a file in a Phar to an already existing

ext/pdo_sqlite/sqlite_driver.c

@@ -441,7 +441,6 @@ static int do_callback(struct pdo_sqlite_fci *fc, zval *cb,
 		 * the context */
 		if (agg_context) {
 			if (Z_ISUNDEF(retval)) {
-				zval_ptr_dtor(&agg_context->val);
 				return FAILURE;
 			}
 			zval_ptr_dtor(Z_REFVAL(agg_context->val));

ext/pdo_sqlite/tests/gh13998.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Fix GH-13998: Manage refcount of agg_context->val correctly
+--EXTENSIONS--
+pdo_sqlite
+--FILE--
+<?php
+$step = function () {
+    throw new Exception();
+};
+$finalize = function () {
+};
+
+$db = new PDO('sqlite::memory:');
+$db->query('CREATE TABLE test (a int, b int)');
+$stmt = $db->query('INSERT INTO test VALUES (1, 1), (2, 2), (3, 3)');
+$db->sqliteCreateAggregate('S', $step, $finalize, 1);
+
+try {
+    $db->query('SELECT S(a) FROM test');
+} catch (Exception $e) {
+    echo 'done!';
+}
+?>
+--EXPECT--
+done!