Fix trampoline leak in array_map

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 2fd465acec01c9b3096e2570d0c13fedb53c1270..373f3e0669726e00680aa0eb86ca46bcb64d2b3e 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -420,6 +420,9 @@ void shutdown_executor(void) /* {{{ */
        }
 #endif
 
+       /* Check whether anyone is hogging the trampoline. */
+       ZEND_ASSERT(EG(trampoline).common.function_name == NULL || CG(unclean_shutdown));
+
        EG(ht_iterators_used) = 0;
 
        zend_shutdown_fpu();

diff --git a/ext/standard/array.c b/ext/standard/array.c
index d20e7977818376093d2b1220e90b137d2b5cd7b8..82b34673fffb878cfcac02b57225c4e678828f2c 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -6092,6 +6092,7 @@ PHP_FUNCTION(array_map)
                int ret;
 
                if (Z_TYPE(arrays[0]) != IS_ARRAY) {
+                       zend_release_fcall_info_cache(&fci_cache);
                        zend_argument_type_error(2, "must be of type array, %s given", zend_zval_type_name(&arrays[0]));
                        RETURN_THROWS();
                }

diff --git a/ext/standard/tests/array/bug74345.phpt b/ext/standard/tests/array/bug74345.phpt
index 144d257f55e999e8dfb256140d49fb1e9116789d..5b2bdba95f612d08812dee397f39da6771f96ad7 100644 (file)
--- a/ext/standard/tests/array/bug74345.phpt
+++ b/ext/standard/tests/array/bug74345.phpt
@@ -13,6 +13,11 @@ $name = "foo" . ($x = "bar");
 $cb = [new Test, $name];
 array_map($cb, []);
 array_map($cb, [], []);
+try {
+    array_map($cb, null);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
 array_filter([], $cb);
 array_reduce([], $cb);
 
@@ -24,4 +29,5 @@ usort($array, $cb);
 ?>
 ===DONE===
 --EXPECT--
+array_map(): Argument #2 ($array1) must be of type array, null given
 ===DONE===