[php-src] Issue #9244: Segfault with array_multisort + array_shift (packed arrays?)

Issue: https://github.com/php/php-src/issues/9244 Author: chschneider ### Description The following code: ```php <?php $items = ['foo' => 1, 'bar' => 2]; $order = [4, 3]; array_multisort($order, $items); var_dump(array_shift($items)); ``` Resulted in this output: ``` Segmentation fault (core dumped) ``` But I expected this output instead: ``` int(2) ``` After bisecting the relevant commit seems to be ``` commit 90b7bde61507cee1c6b37f153909d72f5b203b8c Author: Dmitry Stogov <dmitry@zend.com> Date: Wed Nov 3 15:18:26 2021 +0300 Use more compact representation for packed arrays. - for packed arrays we store just an array of zvals without keys. - the elements of packed array are accessible throuf as ht->arPacked[i] instead of ht->arData[i] - in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes (ZEND_HASH_MAP_FOREACH_*) - introduced an additional family of macros to access elements of array (packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX, ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT - zend_hash_minmax() prototype was changed to compare only values Because of smaller data set, this patch may show performance improvement on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser) TODO: - sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET). - zend_hash_sort_ex() may require converting packed arrays to hash. ``` This commit is too complex for me to come up with a fix. But the last TODO mentioned in the commit message could be an indication of what is going wrong. ### PHP Version PHP 8.2.0-dev ### Operating System openSUSE Leap 15.3