From cc9dddea38c248e01d0947c220c3cfbb2fff6e84 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Thu, 3 Nov 2022 13:20:30 +0100
Subject: [PATCH] Fix fake closure leaking when called from internal func

Introduced in 8e49d7f32f3bf8e20a699bfef5c2b2591a56e8ec.

ZEND_CALL_RELEASE_THIS was previously not handled for internal calls but
just for user calls in the zend_leave_helper.

Closes GH-9884
---
 .../fake_closure_in_internal_func_leaks.phpt      | 15 +++++++++++++++
 Zend/zend_execute_API.c                           |  4 ++++
 2 files changed, 19 insertions(+)
 create mode 100644 Zend/tests/fake_closure_in_internal_func_leaks.phpt

diff --git a/Zend/tests/fake_closure_in_internal_func_leaks.phpt b/Zend/tests/fake_closure_in_internal_func_leaks.phpt
new file mode 100644
index 00000000000..e12b4b6253f
--- /dev/null
+++ b/Zend/tests/fake_closure_in_internal_func_leaks.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Fake closure called from internal function leaks
+--FILE--
+<?php
+
+$c = \is_array(...);
+var_dump(array_filter([[]], $c));
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(0) {
+  }
+}
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 82c38366d89..0d9c357b463 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -973,6 +973,10 @@ cleanup_args:
 				zend_interrupt_function(EG(current_execute_data));
 			}
 		}
+
+		if (UNEXPECTED(ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS)) {
+			OBJ_RELEASE(Z_OBJ(call->This));
+		}
 	}
 	EG(fake_scope) = orig_fake_scope;