[GIT-PULLS] [php-src] PR #22805: Free pending named positions on partial-argument compile errors

[email protected] (iliaal) Sun, 19 Jul 2026 14:28:52 +0000
Newsgroups php.git-pulls
Message-ID <Hy8vCFoFaaa1r78SARwtF9GyfYxfvSh6uQcwpdjvoSo@main.internal.php.net>
Pull Request: https://github.com/php/php-src/pull/22805
Author: iliaal

A partial application that uses a named placeholder (`foo(x: ?, ...)`) lazily allocates a named-positions table in `zend_compile_args_ex`, consumed only after argument compilation succeeds. A following argument that is itself a compile error (a positional or unpack after the named placeholder, or a misplaced variadic placeholder) `longjmp`s out of the function before the table is consumed and leaks it.

This frees the table before the four reachable errors. The leak is on a `zend_bailout` path, so ZEND_MM's leak reporter never sees it; it shows only under valgrind/ASAN. Verified with `USE_ZEND_ALLOC=0 valgrind`: 376 bytes to 0 on `foo(x: ?, ?)`, and 0 on the unpack, named-after-variadic, and variadic-twice variants. The added test exercises the path for CI valgrind; the error output is identical before and after, so it is a path check, not an output red/green.