Tracing JIT: Fixed possible memory-leak or missed destructor call.

Reference-counter of return_value may be indirectly decremented to 1.
php · Sep 28, 2021 · c30298b · c30298b
1 parent 97b5eee
commit c30298b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
@@ -1786,6 +1786,11 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 							return_value_info.type &= ~MAY_BE_UNDEF;
 							return_value_info.type |= MAY_BE_NULL;
 						}
+						if (return_value_info.type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
+							/* CVs are going to be destructed and the reference-counter
+							   of return value may be decremented to 1 */
+							return_value_info.type |= MAY_BE_RC1;
+						}
 						return_value_info.type &= ~MAY_BE_GUARD;
 					}
 					break;