Commit dfcc0433fcd for php

commit dfcc0433fcda7fb732cba8d7ee8c857d23f9a9e7
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date:   Sat Oct 31 16:24:05 2026 +0100

    Fix leak of duplicate named argument in new in initializer

    Closes GH-25059

diff --git a/NEWS b/NEWS
index 4ff44252837..529f07daccb 100644
--- a/NEWS
+++ b/NEWS
@@ -42,6 +42,8 @@ PHP                                                                        NEWS
     abstract on properties. (Jorg Sowa)
   . Fixed AST export of readonly anonymous classes dropping the readonly
     modifier. (Jorg Sowa)
+  . Fixed memory leak of a duplicate named argument in new in initializer.
+    (Jorg Sowa)

 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).
diff --git a/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt b/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt
new file mode 100644
index 00000000000..244b670ab1c
--- /dev/null
+++ b/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Duplicate named param in new in const expr does not leak the argument
+--FILE--
+<?php
+
+class D {}
+class C {
+    public function __construct(public $a) {}
+}
+
+function f($x = new C(a: new D, a: new D)) {}
+
+try {
+    f();
+} catch (Error $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Error: Named parameter $a overwrites previous argument
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index abd90dd2234..e0606dbb041 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -942,6 +942,7 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
 							zend_throw_error(NULL,
 								"Named parameter $%s overwrites previous argument",
 								ZSTR_VAL(name));
+							zval_ptr_dtor(&arg);
 							zend_array_destroy(args);
 							zval_ptr_dtor(result);
 							return FAILURE;