Fix GH-16187: ReflectionClass::__toString() with packed properties hash table

Closes GH-16192.

Author: DanielEScherzer

NEWS

@@ -51,6 +51,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
     (cmb)
 
+- Reflection:
+  . Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
+    (DanielEScherzer)
+
 - SimpleXML:
   . Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
     (nielsdos)

ext/reflection/php_reflection.c

@@ -477,7 +477,7 @@ static void _class_string(smart_str *str, zend_class_entry *ce, zval *obj, char
 
 		count = 0;
 		if (properties && zend_hash_num_elements(properties)) {
-			ZEND_HASH_MAP_FOREACH_STR_KEY(properties, prop_name) {
+			ZEND_HASH_FOREACH_STR_KEY(properties, prop_name) {
 				if (prop_name && ZSTR_LEN(prop_name) && ZSTR_VAL(prop_name)[0]) { /* skip all private and protected properties */
 					if (!zend_hash_exists(&ce->properties_info, prop_name)) {
 						count++;

ext/reflection/tests/gh16187.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-16187 (ReflectionClass::__toString() with unpacked properties)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+$xml = '<form name="test"></form>';
+$simplexml = simplexml_load_string($xml);
+$reflector = new ReflectionObject($simplexml['name']);
+$reflector->__toString();
+?>
+DONE
+--EXPECT--
+DONE