[php-src] Issue #24615: ArrayObject backing storage cycle causes unbounded recursion in spl_array_get_hash_table_ptr()

Issue: https://github.com/php/php-src/issues/24615 Author: Marti2203 ### Description ArrayObject::exchangeArray() (and the constructor) accept another ArrayObject as backing storage and only reject an object backing itself. Two objects that back each other are accepted silently, and the first operation that needs the storage recurses without limit in spl_array_get_hash_table_ptr() until the process crashes. The following code: ```php <?php $a = new ArrayObject([1]); $b = new ArrayObject($a); // $b uses $a's storage $a->exchangeArray($b); // $a now uses $b's storage: a cycle echo "cycle built\n"; var_dump(count($a)); ``` Resulted in this output (AddressSanitizer build): ``` ==ERROR: AddressSanitizer: stack-overflow on address ... #0 spl_array_get_hash_table_ptr ext/spl/spl_array.c:65 #1 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71 #2 spl_array_get_hash_table_ptr ext/spl/spl_array.c:71 ... ``` But I expected this output instead: an error when the cycle is created (for example an InvalidArgumentException from exchangeArray()), as for other unsupported backing objects. spl_array_set_array() sets SPL_ARRAY_USE_OTHER for any other ArrayObject/ArrayIterator and only special-cases Z_OBJ_P(object) == Z_OBJ_P(array); following the chain of SPL_ARRAY_USE_OTHER objects before accepting one would catch longer cycles too. Object backing storage is deprecated on master, but it is still accepted there. Reproduced on 8.2.34-dev (512c04e39f) and 8.4.28-dev; the same code is on master. This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually. ### PHP Version ``` PHP 8.4.28-dev, PHP 8.2.34-dev ``` ### Operating System Linux (Ubuntu 20.04, x86_64)