Commit 62a96e1791e for php

commit 62a96e1791ee2329b7ae268a6d8f18452e7ea21f
Author: ndossche <nora.dossche@ugent.be>
Date:   Mon Nov 9 16:05:15 2026 +0100

    Reflection: Fix trampoline leak when object construction fails for lazy object

    Closes GH-25342.

diff --git a/NEWS b/NEWS
index 100a5cddcbe..facc4a1d003 100644
--- a/NEWS
+++ b/NEWS
@@ -55,6 +55,10 @@ PHP                                                                        NEWS
   . Fixed incorrect handling of non-ASCII pending_input bytes in readline_info(),
     which could cause readline() to return false prematurely. (Weilin Du)

+- Reflection:
+  . Fix trampoline leak when object construction fails for lazy object.
+    (ndossche)
+
 - Streams:
   . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during
     callback). (Ilia Alshanetsky)
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 2c94a6e80d1..c0a8b11e0cf 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -5415,6 +5415,7 @@ void reflection_class_new_lazy(INTERNAL_FUNCTION_PARAMETERS,
 			strategy | options);

 	if (!obj) {
+		zend_release_fcall_info_cache(&fcc);
 		RETURN_THROWS();
 	}

diff --git a/ext/reflection/tests/ReflectionClass_makeLazyGhost_no_trampoline_leak.phpt b/ext/reflection/tests/ReflectionClass_makeLazyGhost_no_trampoline_leak.phpt
new file mode 100644
index 00000000000..dee9b56e5cd
--- /dev/null
+++ b/ext/reflection/tests/ReflectionClass_makeLazyGhost_no_trampoline_leak.phpt
@@ -0,0 +1,16 @@
+--TEST--
+ReflectionClass::makeLazyGhost() no trampoline leak
+--FILE--
+<?php
+class Helper {
+    public function __call($name, $args) {}
+}
+
+try {
+    (new ReflectionClass('ReflectionClass'))->newLazyGhost([new Helper, 'foo']);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Cannot make instance of internal class lazy: ReflectionClass is internal