[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: David Carlier (devnexen) Date: 2026-10-22T13:27:21+01:00 Commit: https://github.com/php/php-src/commit/e4576ef7a4101de149986a890547d8f374e2992f Raw diff: https://github.com/php/php-src/commit/e4576ef7a4101de149986a890547d8f374e2992f.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: Fix GH-24488: GC double-frees the SimpleXMLElement properties table Changed paths: A ext/simplexml/tests/gh24488.phpt M ext/simplexml/simplexml.c Diff: diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index ca1216257759..ae722d09aa30 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -2180,7 +2180,7 @@ static void sxe_object_free_storage(zend_object *object) if (sxe->properties) { ZEND_ASSERT(!(GC_FLAGS(sxe->properties) & IS_ARRAY_IMMUTABLE)); - zend_hash_release(sxe->properties); + zend_array_release(sxe->properties); } } /* }}} */ diff --git a/ext/simplexml/tests/gh24488.phpt b/ext/simplexml/tests/gh24488.phpt new file mode 100644 index 000000000000..c8eaf25d489e --- /dev/null +++ b/ext/simplexml/tests/gh24488.phpt @@ -0,0 +1,24 @@ +--TEST-- +GH-24488 (GC double-frees the SimpleXMLElement properties table) +--EXTENSIONS-- +simplexml +--FILE-- +<?php + +for ($i = 0; $i < 2; $i++) { + $xml = new SimpleXMLElement('<a><b/></a>'); + get_object_vars($xml); + + $holder = new stdClass; + $holder->xml = $xml; + $holder->self = $holder; + unset($xml, $holder); + + gc_collect_cycles(); + $junk[] = str_repeat('x', 100); +} + +echo "Done\n"; +?> +--EXPECT-- +Done