[php-src] PR #24494: Fix GH-24488: GC double-frees the SimpleXMLElement properties table

Pull Request: https://github.com/php/php-src/pull/24494 Author: evankford Fixes #24488. The explanation below was written with an LLM (Claude) and checked by me. > Since the GH-24050 fix (7b75d71ca3f6), gc_collect_white() adds > the table returned by get_gc to the garbage buffer. > sxe_get_gc() returns > sxe->properties, and > sxe_object_free_storage() releases it with > zend_hash_release(). Unlike > zend_array_release(), that does not call > GC_REMOVE_FROM_BUFFER(), so the table is freed while still linked in > the GC buffer, and the GC then reads and frees it again. > > sxe->properties is a plain non-persistent zval array, so > zend_array_release() is the right release function. SimpleXML is the > only bundled extension whose get_gc returns a table it frees itself. > > Tested on 8.4.27 built from the release tarball: the new test fails without the patch and > passes with it. ext/simplexml/tests, > Zend/tests/gc_*.phpt and > Zend/tests/gh24050*.phpt all pass (215 passed, 3 skipped). 🤖 Generated with [Claude Code](https://claude.com/claude-code)