Safe destruction (variables and arguments may need to be cuptured by exception)

2 files changed, 25 insertions, 3 deletions

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 04c33f8415..a0bd3bd897 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1806,7 +1806,15 @@ static zend_always_inline void i_free_compiled_variables(zend_execute_data *exec
 	zval *cv = EX_VAR_NUM(0);
 	zval *end = cv + EX(func)->op_array.last_var;
 	while (EXPECTED(cv != end)) {
-		zval_ptr_dtor(cv);
+		if (Z_REFCOUNTED_P(cv)) {
+			if (!Z_DELREF_P(cv)) {
+				zend_refcounted *r = Z_COUNTED_P(cv);
+				ZVAL_NULL(cv);
+				zval_dtor_func_for_ptr(r);
+			} else {
+				GC_ZVAL_CHECK_POSSIBLE_ROOT(cv);
+			}
+		}
 		cv++;
  	}
 }
diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h
index 4dfed1830d..67958cf32c 100644
--- a/Zend/zend_execute.h
+++ b/Zend/zend_execute.h
@@ -199,7 +199,15 @@ static zend_always_inline void zend_vm_stack_free_extra_args_ex(uint32_t call_in
  		zval *p = end + (ZEND_CALL_NUM_ARGS(call) - call->func->op_array.num_args);
 		do {
 			p--;
-			i_zval_ptr_dtor(p ZEND_FILE_LINE_CC);
+			if (Z_REFCOUNTED_P(p)) {
+				if (!Z_DELREF_P(p)) {
+					zend_refcounted *r = Z_COUNTED_P(p);
+					ZVAL_NULL(p);
+					zval_dtor_func_for_ptr(r);
+				} else {
+					GC_ZVAL_CHECK_POSSIBLE_ROOT(p);
+				}
+			}
 		} while (p != end);
  	}
 }
@@ -219,7 +227,13 @@ static zend_always_inline void zend_vm_stack_free_args(zend_execute_data *call)
 
 		do {
 			p--;
-			zval_ptr_dtor_nogc(p);
+			if (Z_REFCOUNTED_P(p)) {
+				if (!Z_DELREF_P(p)) {
+					zend_refcounted *r = Z_COUNTED_P(p);
+					ZVAL_NULL(p);
+					zval_dtor_func_for_ptr(r);
+				}
+			}
 		} while (p != end);
 	}
 }