fix #24635: clean hash before putting into cache

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 0b394d758a8ab065f15869cc8c55d83b28f1927f..9baab66271a353de5e59288dccc55a42ab1b8b94 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2555,8 +2555,10 @@ int zend_do_fcall_common_helper(ZEND_OPCODE_HANDLER_ARGS)
                        zend_hash_destroy(EX(function_state).function_symbol_table);
                        FREE_HASHTABLE(EX(function_state).function_symbol_table);
                } else {
-                       *(++EG(symtable_cache_ptr)) = EX(function_state).function_symbol_table;
+                       /* clean before putting into the cache, since clean
+                          could call dtors, which could use cached hash */
                        zend_hash_clean(*EG(symtable_cache_ptr));
+                       *(++EG(symtable_cache_ptr)) = EX(function_state).function_symbol_table;
                }
                EG(active_symbol_table) = calling_symbol_table;
        } else { /* ZEND_OVERLOADED_FUNCTION */