mirror of
https://github.com/php/php-src.git
synced 2026-10-29 10:22:06 +08:00
Ilia Alshanetsky
934d4ff95f
zend_call_function() ran the callback with fci_cache->object as $this without holding a reference, so a callback that released the last reference to its own receiver (an autoloader unregistering itself, a SQLite3 authorizer calling setAuthorizer(null)) freed $this while its frame was still executing. Take the reference where the receiver is selected rather than after argument setup, so the error handlers reachable from the deprecation notice and the by-reference warning cannot free it first, and release it on every early exit. Fixes GH-22060 Fixes GH-22122