Trampoline crash on error

[YuanchengJiang]

Description

The following code:

<?php
class TrampolineTest {
public function __call(string $name, array $arguments) {
}
}
$o = new TrampolineTest();
$callback = [$o, 'trampoline'];
$arrays = array (
array("str1", "array" => array("hello", 'world'), array(1, 2))
);
foreach($arrays as $arr1) {
}
forward_static_call_array($callback,$arr1);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:518: void shutdown_executor(void): Assertion `(((zend_executor_globals *) (((char*) _tsrm_ls_cache)+(executor_globals_offset)))->trampoline).common.function_name == ((void*)0) || (((zend_compiler_globals *) (((char*) _tsrm_ls_cache)+(compiler_globals_offset)))->unclean_shutdown)' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

[nielsdos]

Simplified:

<?php
class TrampolineTest {
    public function __call(string $name, array $arguments) {
    }
}
$o = new TrampolineTest();
$callback = [$o, 'trampoline'];
$array = ["a" => "b", 1];
forward_static_call_array($callback, $array);

[nielsdos]

Probably this, but need to check better later:

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 9ebc15f3a43..8b3d2618112 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -884,7 +884,11 @@ zend_result zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_
 						ZEND_CALL_NUM_ARGS(call) = i;
 cleanup_args:
 						zend_vm_stack_free_args(call);
+						if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
+							zend_free_extra_named_params(call->extra_named_params);
+						}
 						zend_vm_stack_free_call_frame(call);
+						zend_release_fcall_info_cache(fci_cache);
 						return SUCCESS;
 					}
 				}