[php-src] master: Merge branch 'PHP-8.6'

Author: David Carlier (devnexen) Date: 2026-10-22T13:27:22+01:00 Commit: https://github.com/php/php-src/commit/05d164f3066ec88e25f03d1bfd60dcf4c89696f7 Raw diff: https://github.com/php/php-src/commit/05d164f3066ec88e25f03d1bfd60dcf4c89696f7.diff Merge branch 'PHP-8.6' * PHP-8.6: Fix GH-24488: GC double-frees the SimpleXMLElement properties table Changed paths: A ext/simplexml/tests/gh24488.phpt M ext/simplexml/simplexml.c Diff: diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index 98a959425694..0e02a843e95a 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -2183,7 +2183,7 @@ static void sxe_object_free_storage(zend_object *object) if (sxe->properties) { ZEND_ASSERT(!(GC_FLAGS(sxe->properties) & IS_ARRAY_IMMUTABLE)); - zend_hash_release(sxe->properties); + zend_array_release(sxe->properties); } } /* }}} */ diff --git a/ext/simplexml/tests/gh24488.phpt b/ext/simplexml/tests/gh24488.phpt new file mode 100644 index 000000000000..c8eaf25d489e --- /dev/null +++ b/ext/simplexml/tests/gh24488.phpt @@ -0,0 +1,24 @@ +--TEST-- +GH-24488 (GC double-frees the SimpleXMLElement properties table) +--EXTENSIONS-- +simplexml +--FILE-- +<?php + +for ($i = 0; $i < 2; $i++) { + $xml = new SimpleXMLElement('<a><b/></a>'); + get_object_vars($xml); + + $holder = new stdClass; + $holder->xml = $xml; + $holder->self = $holder; + unset($xml, $holder); + + gc_collect_cycles(); + $junk[] = str_repeat('x', 100); +} + +echo "Done\n"; +?> +--EXPECT-- +Done