Fixed bug #43175 (__destruct() throwing an exception with __call() causes segfault)

NEWS

@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2008, PHP 5.2.6
+- Fixed bug #43175 (__destruct() throwing an exception with __call() causes
+  segfault). (Dmitry)
 
 08 Nov 2007, PHP 5.2.5
 - Upgraded PCRE to version 7.3 (Nuno)

Zend/tests/bug43175.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #43175 (__destruct() throwing an exception with __call() causes segfault)
+--FILE--
+<?php
+
+class foobar {
+    public function __destruct() {
+        throw new Exception();
+    }
+    public function __call($m, $a) {
+        return $this;
+    }
+}
+function foobar() {
+    return new foobar();
+}
+try {
+    foobar()->unknown();
+} catch (Exception $e) {
+    echo "__call via traditional factory should be caught\n";
+}
+?>
+--EXPECT--
+__call via traditional factory should be caught

Zend/zend_vm_def.h

@@ -1995,6 +1995,8 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 		}
 	}
 
+	EX(function_state).function = (zend_function *) EX(op_array);
+	EG(function_state_ptr) = &EX(function_state);
 	ctor_opline = (zend_op*)zend_ptr_stack_pop(&EG(arg_types_stack));
 
 	if (EG(This)) {
@@ -2017,8 +2019,6 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 	}
 	zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
 
-	EX(function_state).function = (zend_function *) EX(op_array);
-	EG(function_state_ptr) = &EX(function_state);
 	zend_ptr_stack_clear_multiple(TSRMLS_C);
 
 	if (EG(exception)) {

Zend/zend_vm_execute.h

@@ -280,6 +280,8 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 
+	EX(function_state).function = (zend_function *) EX(op_array);
+	EG(function_state_ptr) = &EX(function_state);
 	ctor_opline = (zend_op*)zend_ptr_stack_pop(&EG(arg_types_stack));
 
 	if (EG(This)) {
@@ -302,8 +304,6 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 	}
 	zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
 
-	EX(function_state).function = (zend_function *) EX(op_array);
-	EG(function_state_ptr) = &EX(function_state);
 	zend_ptr_stack_clear_multiple(TSRMLS_C);
 
 	if (EG(exception)) {