Merge branch 'PHP-8.0'

* PHP-8.0:
  Fixed bug #80290

Author: nikic

ext/standard/assert.c

@@ -181,15 +181,11 @@ PHP_FUNCTION(assert)
 		if (description_str) {
 			ZVAL_STR(&args[3], description_str);
 			call_user_function(NULL, NULL, &ASSERTG(callback), &retval, 4, args);
-			zval_ptr_dtor(&(args[3]));
-			zval_ptr_dtor(&(args[2]));
-			zval_ptr_dtor(&(args[0]));
 		} else {
 			call_user_function(NULL, NULL, &ASSERTG(callback), &retval, 3, args);
-			zval_ptr_dtor(&(args[2]));
-			zval_ptr_dtor(&(args[0]));
 		}
 
+		zval_ptr_dtor(&args[0]);
 		zval_ptr_dtor(&retval);
 	}
 

ext/standard/tests/assert/bug80290.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #80290: Double free when ASSERT_CALLBACK is used with a dynamic message
+--FILE--
+<?php
+
+assert_options(ASSERT_CALLBACK, function($file, $line, $unused, $message) {
+    var_dump($message);
+});
+
+$x = 'x';
+assert(false, 'Dynamic message: ' . $x);
+
+?>
+--EXPECTF--
+string(18) "Dynamic message: x"
+
+Fatal error: Uncaught AssertionError: Dynamic message: x in %s:%d
+Stack trace:
+#0 %s(%d): assert(false, 'Dynamic message...')
+#1 {main}
+  thrown in %s on line %d