Fix missing addref for Countable::count()

Fixes GH-21605

Author: iluuu1994

NEWS

@@ -7,6 +7,7 @@ PHP                                                                        NEWS
     destructors). (iliaal)
   . Fixed bug GH-21478 (Forward property operations to real instance for
     initialized lazy proxies). (iliaal)
+  . Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov)
 
 - Curl:
   . Add support for brotli and zstd on Windows. (Shivam Mathur)

Zend/tests/gh21605.phpt

@@ -0,0 +1,24 @@
+--TEST--
+GH-21605: Missing addref for Countable::count()
+--CREDITS--
+cnwangjihe
+--FILE--
+<?php
+
+class C implements Countable {
+    public function count(): int {
+        global $c;
+        $c = null;
+        var_dump($this);
+        return 42;
+    }
+}
+
+$c = new C;
+var_dump(count($c));
+
+?>
+--EXPECTF--
+object(C)#%d (0) {
+}
+int(42)

Zend/zend_vm_def.h

@@ -9419,7 +9419,9 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED)
 				zval retval;
 
 				zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT));
+				GC_ADDREF(zobj);
 				zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval);
+				OBJ_RELEASE(zobj);
 				count = zval_get_long(&retval);
 				zval_ptr_dtor(&retval);
 				break;