[php-src] Issue #24518: Failed `session_decode()` still runs `__wakeup()` and `__destruct()`

Issue: https://github.com/php/php-src/issues/24518 Author: sybrew ### Description The following code: ```php <?php class Boom { public function __wakeup() { echo "wakeup\n"; } public function __destruct() { echo "dtor\n"; } } session_start(); var_dump(session_decode('x|O:4:"Boom":0:{}TRAILING')); echo "rejected\n"; session_start(); var_dump(session_decode('y|O:4:"Boom":0:{}')); echo "kept\n"; ``` Run it with session.serialize_handler=php, session.use_cookies=0, and session.cache_limiter empty. Resulted in this output: ``` wakeup dtor bool(false) rejected wakeup bool(true) kept dtor Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d ``` But I expected this output instead: ``` Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d bool(false) rejected wakeup bool(true) kept dtor ``` The trailing bytes make the first decode fail, and the session is destroyed. __wakeup() and __destruct() still run on the object parsed before that failure. The second decode is valid, and those methods should keep running in that case. session_start() reading a php_serialize session through the php handler can produce the same failed decode, because that handler splits on |. ### PHP Version ```plain PHP 8.5.12 (cli) (built: Oct 21 2026 22:48:15) (NTS) Copyright (c) The PHP Group Zend Engine v4.5.12, Copyright (c) Zend Technologies with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies ``` ### Operating System Ubuntu 24.04 under WSL2