Commit 89729383e27 for php.net

commit 89729383e270c444ec3220755cbddd8baf3e8242
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Thu Apr 2 15:42:48 2026 +0200

    Fix missing addref for Countable::count()

    Fixes GH-21605

diff --git a/NEWS b/NEWS
index 84ef07ea11e..fcdfd3973d8 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
     destructors). (iliaal)
   . Fixed bug GH-21478 (Forward property operations to real instance for
     initialized lazy proxies). (iliaal)
+  . Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov)

 - Curl:
   . Add support for brotli and zstd on Windows. (Shivam Mathur)
diff --git a/Zend/tests/gh21605.phpt b/Zend/tests/gh21605.phpt
new file mode 100644
index 00000000000..973339ad3bb
--- /dev/null
+++ b/Zend/tests/gh21605.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-21605: Missing addref for Countable::count()
+--CREDITS--
+cnwangjihe
+--FILE--
+<?php
+
+class C implements Countable {
+    public function count(): int {
+        global $c;
+        $c = null;
+        var_dump($this);
+        return 42;
+    }
+}
+
+$c = new C;
+var_dump(count($c));
+
+?>
+--EXPECTF--
+object(C)#%d (0) {
+}
+int(42)
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 4ecd80837b1..34906e1bfcc 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -9419,7 +9419,9 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED)
 				zval retval;

 				zend_function *count_fn = zend_hash_find_ptr(&zobj->ce->function_table, ZSTR_KNOWN(ZEND_STR_COUNT));
+				GC_ADDREF(zobj);
 				zend_call_known_instance_method_with_0_params(count_fn, zobj, &retval);
+				OBJ_RELEASE(zobj);
 				count = zval_get_long(&retval);
 				zval_ptr_dtor(&retval);
 				break;
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d7c14a7cf80..d4b2aff1907 100644
Binary files a/Zend/zend_vm_execute.h and b/Zend/zend_vm_execute.h differ