zend_ast: Fix leak of duplicate named argument in new in initializer

NEWS

@@ -36,6 +36,8 @@ PHP                                                                        NEWS
     (Marti2203).
   . Fixed bug GH-24989 (Use-after-free in GC when an exception is thrown).
     (David Carlier)
+  . Fixed memory leak of a duplicate named argument in new in initializer.
+    (Jorg Sowa)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).

Zend/tests/constexpr/new_named_params_duplicate_leak.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Duplicate named param in new in const expr does not leak the argument
+--FILE--
+<?php
+
+class D {}
+class C {
+    public function __construct(public $a) {}
+}
+
+function f($x = new C(a: new D, a: new D)) {}
+
+try {
+    f();
+} catch (Error $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Error: Named parameter $a overwrites previous argument

Zend/zend_ast.c

@@ -942,6 +942,7 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
 							zend_throw_error(NULL,
 								"Named parameter $%s overwrites previous argument",
 								ZSTR_VAL(name));
+							zval_ptr_dtor(&arg);
 							zend_array_destroy(args);
 							zval_ptr_dtor(result);
 							return FAILURE;