fix #35821 (array_map() segfaults when exception is throwed from the callback)

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
 - Fixed segfault/leak in imagecolormatch(). (Pierre)
 - Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.
   (Andrey)
+- Fixed bug #35821 (array_map() segfaults when exception is throwed from 
+  the callback). (Tony)
 - Fixed bug #35781 (stream_filter_append() can cause segfault). (Tony)
 - Fixed bug #35759 (mysqli_stmt_bind_result() makes huge allocation when
   column empty). (Andrey)

ext/standard/array.c

@@ -4347,7 +4347,7 @@ PHP_FUNCTION(array_map)
 			fci.params = &params[1];
 			fci.no_separation = 0;
 
-			if (!zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && result) {
+			if (!zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS || !result) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the map callback");
 				efree(array_len);
 				efree(args);

ext/standard/tests/array/bug35821.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #35821 (array_map() segfaults when exception is throwed from the callback)
+--FILE--
+<?php
+
+class Element
+{
+	public function ThrowException ()
+	{
+		throw new Exception();
+	}
+
+	public static function CallBack(Element $elem)
+	{
+		$elem->ThrowException();
+	}
+}
+
+$arr = array(new Element(), new Element(), new Element());
+array_map(array('Element', 'CallBack'), $arr);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Warning: array_map(): An error occurred while invoking the map callback in %s on line %d
+
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 %s(%d): Element->ThrowException()
+#1 [internal function]: Element::CallBack(Object(Element))
+#2 %s(%d): array_map(Array, Array)
+#3 {main}
+  thrown in %s on line %d