From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 31 Aug 2020 08:14:39 +0000 (+0200)
Subject: Fix trampoline leak in array_map
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e81becce08aa2a4a73fd421c1ad01aeeeeedf277;p=php

Fix trampoline leak in array_map
---

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 2fd465acec..373f3e0669 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -420,6 +420,9 @@ void shutdown_executor(void) /* {{{ */
 	}
 #endif
 
+	/* Check whether anyone is hogging the trampoline. */
+	ZEND_ASSERT(EG(trampoline).common.function_name == NULL || CG(unclean_shutdown));
+
 	EG(ht_iterators_used) = 0;
 
 	zend_shutdown_fpu();
diff --git a/ext/standard/array.c b/ext/standard/array.c
index d20e797781..82b34673ff 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -6092,6 +6092,7 @@ PHP_FUNCTION(array_map)
 		int ret;
 
 		if (Z_TYPE(arrays[0]) != IS_ARRAY) {
+			zend_release_fcall_info_cache(&fci_cache);
 			zend_argument_type_error(2, "must be of type array, %s given", zend_zval_type_name(&arrays[0]));
 			RETURN_THROWS();
 		}
diff --git a/ext/standard/tests/array/bug74345.phpt b/ext/standard/tests/array/bug74345.phpt
index 144d257f55..5b2bdba95f 100644
--- a/ext/standard/tests/array/bug74345.phpt
+++ b/ext/standard/tests/array/bug74345.phpt
@@ -13,6 +13,11 @@ $name = "foo" . ($x = "bar");
 $cb = [new Test, $name];
 array_map($cb, []);
 array_map($cb, [], []);
+try {
+    array_map($cb, null);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
 array_filter([], $cb);
 array_reduce([], $cb);
 
@@ -24,4 +29,5 @@ usort($array, $cb);
 ?>
 ===DONE===
 --EXPECT--
+array_map(): Argument #2 ($array1) must be of type array, null given
 ===DONE===