Stale EG(opline_before_exception) pointer through eval

[iluuu1994]

Description

Credits to @vi3tL0u1s et al. for the original report.

The following code:

class A {
    function __destruct() {
        // Store dangling pointer in EG(opline_before_exception)
        eval('try { throw new Error(); } catch (Error $e) {}');
        debug_print_backtrace();
    }
}

B::$b = new A;

Resulted in this output:

heap-use-after-free

But I expected this output instead:

#0 %s(10): A->__destruct()

Fatal error: Uncaught Error: Class "B" not found in %s:10
Stack trace:
#0 {main}
  thrown in %s on line 10

PHP Version

PHP 8.3

Operating System

No response