Fix leak when the added previous exception is already in the chain (#24177)

zend_exception_set_previous() takes ownership of add_previous. When walking
the exception's previous chain reaches add_previous itself, the function
returns without releasing that reference. Release it after the loop, as on
the other paths that discard the added previous exception.

This can happen when an exception thrown in finally already contains the
pending exception in its previous chain. Add regression tests covering
direct and nested chains, destructors during unwinding, generator and fiber
destruction, and GC destructors running in a fiber.

Closes #24177

Author: EdmondDantes

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.28
 
+- Core:
+  . Fixed memory leak when an exception already contains the pending exception
+    in its previous chain. (Edmond)
+
 - DOM:
   . Fixed bug GH-23352 (UAF reading an attribute value node retained across
     DOMDocument::adoptNode()). (David Carlier)

Zend/tests/exception_previous_already_in_chain_destructor.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Exception thrown in a destructor during unwinding that already has the pending exception in its previous chain
+--FILE--
+<?php
+class ThrowsInDestructor {
+    public function __construct(private Throwable $pending) {}
+
+    public function __destruct() {
+        throw new LogicException("thrown", 0, $this->pending);
+    }
+}
+
+function f() {
+    $pending = new RuntimeException("pending");
+    $object = new ThrowsInDestructor($pending);
+    throw $pending;
+}
+
+try {
+    f();
+} catch (Throwable $t) {
+    for (; $t !== null; $t = $t->getPrevious()) {
+        echo $t->getMessage(), "\n";
+    }
+}
+?>
+--EXPECT--
+thrown
+pending

Zend/tests/fibers/gc-destructor-throw-previous-already-in-chain.phpt

@@ -0,0 +1,41 @@
+--TEST--
+Exception thrown by a GC destructor that already has the exception of a previous, suspended destructor in its previous chain
+--FILE--
+<?php
+class Cycle {
+    public static ?Throwable $pending = null;
+    public $self;
+
+    public function __construct() {
+        $this->self = $this;
+    }
+
+    public function __destruct() {
+        if (self::$pending === null) {
+            try {
+                Fiber::suspend();
+            } finally {
+                self::$pending = new RuntimeException("pending");
+                throw self::$pending;
+            }
+        }
+        throw new LogicException("thrown", 0, self::$pending);
+    }
+}
+
+$fiber = new Fiber(function () {
+    new Cycle;
+    new Cycle;
+    try {
+        gc_collect_cycles();
+    } catch (Throwable $t) {
+        for (; $t !== null; $t = $t->getPrevious()) {
+            echo $t->getMessage(), "\n";
+        }
+    }
+});
+$fiber->start();
+?>
+--EXPECT--
+thrown
+pending

Zend/tests/fibers/unfinished-fiber-with-throw-previous-already-in-chain.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Exception thrown in finally of a fiber destroyed during unwinding that already has the pending exception in its previous chain
+--FILE--
+<?php
+function f() {
+    $pending = new RuntimeException("pending");
+    $fiber = new Fiber(function () use ($pending) {
+        try {
+            Fiber::suspend();
+        } finally {
+            throw new LogicException("thrown", 0, $pending);
+        }
+    });
+    $fiber->start();
+    throw $pending;
+}
+
+try {
+    f();
+} catch (Throwable $t) {
+    for (; $t !== null; $t = $t->getPrevious()) {
+        echo $t->getMessage(), "\n";
+    }
+}
+?>
+--EXPECT--
+thrown
+pending

Zend/tests/generators/finally/yield_throw_previous_already_in_chain.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Exception thrown in finally of a generator destroyed during unwinding that already has the pending exception in its previous chain
+--FILE--
+<?php
+function gen(Throwable $pending) {
+    try {
+        yield;
+    } finally {
+        throw new LogicException("thrown", 0, $pending);
+    }
+}
+
+function f() {
+    $pending = new RuntimeException("pending");
+    $generator = gen($pending);
+    $generator->current();
+    throw $pending;
+}
+
+try {
+    f();
+} catch (Throwable $t) {
+    for (; $t !== null; $t = $t->getPrevious()) {
+        echo $t->getMessage(), "\n";
+    }
+}
+?>
+--EXPECT--
+thrown
+pending

Zend/tests/try/try_finally_previous_already_in_chain.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Exception thrown in finally that already has the pending exception in its previous chain
+--FILE--
+<?php
+function direct() {
+    $e = new RuntimeException("pending");
+    try {
+        throw $e;
+    } finally {
+        throw new LogicException("thrown", 0, $e);
+    }
+}
+
+function nested() {
+    $e = new RuntimeException("pending");
+    try {
+        throw $e;
+    } finally {
+        throw new LogicException("thrown", 0, new Exception("middle", 0, $e));
+    }
+}
+
+foreach (['direct', 'nested'] as $function) {
+    try {
+        $function();
+    } catch (Throwable $t) {
+        for (; $t !== null; $t = $t->getPrevious()) {
+            echo $t->getMessage(), "\n";
+        }
+    }
+}
+?>
+--EXPECT--
+thrown
+pending
+thrown
+middle
+pending

Zend/zend_exceptions.c

@@ -135,6 +135,8 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 		}
 		ex = previous;
 	} while (Z_OBJ_P(ex) != add_previous);
+
+	OBJ_RELEASE(add_previous);
 }
 /* }}} */