[php-src] Issue #14296: Indexing an array with a persistent string triggers an assertion failure during destruction

Issue: https://github.com/php/php-src/issues/14296 Author: TimWolla ### Description The following code: ```php static ZEND_FUNCTION(zend_test_crasher) { ZEND_PARSE_PARAMETERS_NONE(); zval array; array_init(&array); zval value; ZVAL_LONG(&value, 1); zend_string *key = zend_string_init("foo", strlen("foo"), 1); zend_hash_update(Z_ARR(array), key, &value); zend_string_release(key); zval_ptr_dtor(&array); } ``` Resulted in this output: ``` php: php-src/Zend/zend_string.h:361: zend_string_release_ex: Assertion `!(zval_gc_flags((s)->gc.u.type_info) & (1<<7))' failed. Program received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007ffff78428e6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007ffff78268b7 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007ffff78267db in __assert_fail_base (fmt=0x7ffff79c5168 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555569b33e8 "!(zval_gc_flags((s)->gc.u.type_info) & (1<<7))", file=file@entry=0x5555569b3380 "php-src/Zend/zend_string.h", line=line@entry=361, function=function@entry=0x5555569b3d40 <__PRETTY_FUNCTION__.24> "zend_string_release_ex") at ./assert/assert.c:92 #6 0x00007ffff7839206 in __assert_fail (assertion=0x5555569b33e8 "!(zval_gc_flags((s)->gc.u.type_info) & (1<<7))", file=0x5555569b3380 "php-src/Zend/zend_string.h", line=361, function=0x5555569b3d40 <__PRETTY_FUNCTION__.24> "zend_string_release_ex") at ./assert/assert.c:101 #7 0x0000555555b570af in zend_string_release_ex (s=0x5555570abd70, persistent=false) at php-src/Zend/zend_string.h:361 #8 0x0000555555b5d722 in zend_array_destroy (ht=0x7ffff505c7e0) at php-src/Zend/zend_hash.c:1840 #9 0x0000555555b3bcfc in rc_dtor_func (p=0x7ffff505c7e0) at php-src/Zend/zend_variables.c:57 #10 0x0000555555b3bc72 in i_zval_ptr_dtor (zval_ptr=0x7fffffffb7e0) at php-src/Zend/zend_variables.h:45 #11 0x0000555555b3becc in zval_ptr_dtor (zval_ptr=0x7fffffffb7e0) at php-src/Zend/zend_variables.c:84 #12 0x0000555555a7d315 in zif_zend_test_crasher (execute_data=0x7ffff5017080, return_value=0x7fffffffb840) at php-src/ext/zend_test/test.c:756 #13 0x0000555555b87c66 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at php-src/Zend/zend_vm_execute.h:1287 #14 0x0000555555c06ac2 in execute_ex (ex=0x7ffff5017020) at php-src/Zend/zend_vm_execute.h:57367 #15 0x0000555555c0c44c in zend_execute (op_array=0x7ffff5087000, return_value=0x0) at php-src/Zend/zend_vm_execute.h:62779 #16 0x0000555555b40f0a in zend_execute_script (type=8, retval=0x0, file_handle=0x7fffffffcfc0) at php-src/Zend/zend.c:1899 #17 0x0000555555a8ca60 in php_execute_script_ex (primary_file=0x7fffffffcfc0, retval=0x0) at php-src/main/main.c:2507 #18 0x0000555555a8cbe6 in php_execute_script (primary_file=0x7fffffffcfc0) at php-src/main/main.c:2547 #19 0x0000555555cd343a in do_cli (argc=2, argv=0x555556e882d0) at php-src/sapi/cli/php_cli.c:966 #20 0x0000555555cd419b in main (argc=2, argv=0x555556e882d0) at php-src/sapi/cli/php_cli.c:1340 ``` But I expected this output instead: ``` No error. ``` ### PHP Version git master ### Operating System Ubuntu 23.10