Fix memory leaks

Author: arnaud-lb

Zend/tests/partial_application/constexpr_011.phpt

@@ -3,10 +3,16 @@ PFA in constexpr: error during arg list evaluation
 --FILE--
 <?php
 
-function f($a = g(1, a: 2, ...)) {
+function f($a = g(strlen(?), e: strlen(?), a: strlen(?), ...)) {
 }
 
-function g($a, $b) {
+function g($a, $b, $c, $d, $e) {
+}
+
+function h($a = i(strlen(?), a: strlen(?), b: invalid(?), ...)) {
+}
+
+function i(...$args) {
 }
 
 try {
@@ -15,6 +21,13 @@ try {
     echo $e::class, ": ", $e->getMessage(), "\n";
 }
 
+try {
+    h();
+} catch (Error $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+
 ?>
 --EXPECT--
 Error: Named parameter $a overwrites previous argument
+Error: Call to undefined function invalid()

Zend/zend_ast.c

@@ -699,9 +699,6 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			arg_name = zend_ast_get_str(arg_ast->child[0]);
 			arg = zend_handle_named_arg(&frame, arg_name, &arg_num, (void**)&cache_slot);
 			if (!arg) {
-				for (uint32_t j = 0; j < i; j++) {
-					zval_ptr_dtor(ZEND_CALL_VAR_NUM(frame, j));
-				}
 				goto fail;
 			}
 			if (named_positions_ptr) {
@@ -728,9 +725,6 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			}
 		} else {
 			if (zend_ast_evaluate_ex(arg, arg_ast, scope, short_circuited_ptr, ctx) == FAILURE) {
-				for (uint32_t j = 0; j < i; j++) {
-					zval_ptr_dtor(ZEND_CALL_VAR_NUM(frame, j));
-				}
 				goto fail;
 			}
 		}
@@ -742,6 +736,12 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 	return frame;
 
 fail:
+	for (uint32_t i = 0, num_args = ZEND_CALL_NUM_ARGS(frame); i < num_args; i++) {
+		zval_ptr_dtor(ZEND_CALL_VAR_NUM(frame, i));
+	}
+	if (ZEND_CALL_INFO(frame) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
+		zend_array_destroy(frame->extra_named_params);
+	}
 	zend_vm_stack_free_call_frame(frame);
 	if (named_positions_ptr && *named_positions_ptr) {
 		zend_array_destroy(*named_positions_ptr);