Commit 7ab1c1a1b4e for php

commit 7ab1c1a1b4e7d8e8a4c868969ee46ab526957348
Merge: 0fcc9cd9783 422cded68df
Author: David Carlier <devnexen@gmail.com>
Date:   Thu Oct 29 18:17:22 2026 +0000

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix GH-24989: Use-after-free in GC when an exception is thrown.

diff --cc Zend/zend_execute.c
index 4e82fa20759,dfe08ac18a9..bac0095d1c4
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@@ -4999,10 -4942,13 +5002,13 @@@ static void cleanup_live_vars(zend_exec
  					if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
  						zend_hash_iterator_del(Z_FE_ITER_P(var));
  					}
- 					zval_ptr_dtor_nogc(var);
+ 					zval tmp;
+ 					ZVAL_COPY_VALUE(&tmp, var);
+ 					ZVAL_UNDEF(var);
+ 					zval_ptr_dtor_nogc(&tmp);
  				} else if (kind == ZEND_LIVE_ROPE) {
  					zend_string **rope = (zend_string **)var;
 -					zend_op *last = EX(func)->op_array.opcodes + op_num;
 +					const zend_op *last = EX(func)->op_array.opcodes + op_num;
  					while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT)
  							|| last->result.var != var_num) {
  						ZEND_ASSERT(last >= EX(func)->op_array.opcodes);