Fixed bug #80045

Applying the obvious fix ... however, I think we may need to
rething how we handle trampoline fcc for "f" zpp. It might make
sense to use fcc->function_handler == NULL for that case and
force it to be fetched in zend_call_function instead (it will
be reset to that after the call anyway). Otherwise we will keep
chasing these leaks, as it's the only instance where it's
necessary to free a zpp result.

diff --git a/NEWS b/NEWS
index 045e7b72f00091330e4316f8d77a870da32aaf92..34a8805503f2b0d003c70fa6510d8a69e619adc0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Implement #[Attr] Attribute syntax as per final vote in RFC
     https://wiki.php.net/rfc/shorter_attribute_syntax_change
+  . Fixed bug #80045 (memleak after two set_exception_handler calls with
+    __call). (Nikita)
 
 03 Sep 2020, PHP 8.0.0beta3
 

diff --git a/Zend/tests/bug80045.phpt b/Zend/tests/bug80045.phpt
new file mode 100644 (file)
index 0000000..b53b8b0
--- /dev/null
+++ b/Zend/tests/bug80045.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #80045: memleak after two set_exception_handler calls with __call
+--FILE--
+<?php
+
+class x {
+    public function __construct(){
+        set_exception_handler([$this, 'dummyExceptionHandler']);
+        set_exception_handler([$this, 'dummyExceptionHandler']);
+        set_error_handler([$this, 'dummyErrorHandler']);
+        set_error_handler([$this, 'dummyErrorHandler']);
+    }
+
+    public function __call($m, $p) {}
+}
+
+new x;
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index c3a2a1b63f33199cb01facba770e375ac78a1b4c..906f0666edcff63274669952e686ef6e9a543a42 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1198,6 +1198,7 @@ ZEND_FUNCTION(set_error_handler)
 
        ZVAL_COPY(&EG(user_error_handler), &(fci.function_name));
        EG(user_error_handler_error_reporting) = (int)error_type;
+       zend_release_fcall_info_cache(&fcc);
 }
 /* }}} */
 
@@ -1253,6 +1254,7 @@ ZEND_FUNCTION(set_exception_handler)
        }
 
        ZVAL_COPY(&EG(user_exception_handler), &(fci.function_name));
+       zend_release_fcall_info_cache(&fcc);
 }
 /* }}} */