Merge remote-tracking branch 'origin/PHP-7.4' into PHP-8.0

Author: TysonAndre

ext/spl/spl_fixedarray.c

@@ -368,8 +368,12 @@ static void spl_fixedarray_object_write_dimension_helper(spl_fixedarray_object *
 		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0);
 		return;
 	} else {
-		zval_ptr_dtor(&(intern->array.elements[index]));
-		ZVAL_COPY_DEREF(&intern->array.elements[index], value);
+		/* Fix #81429 */
+		zval *ptr = &(intern->array.elements[index]);
+		zval tmp;
+		ZVAL_COPY_VALUE(&tmp, ptr);
+		ZVAL_COPY_DEREF(ptr, value);
+		zval_ptr_dtor(&tmp);
 	}
 }
 

ext/spl/tests/SplFixedArray_setSize_destruct.phpt

@@ -0,0 +1,55 @@
+--TEST--
+SplFixedArray::setSize in offsetSet destructor (#81429)
+--FILE--
+<?php
+$values = new SplFixedArray(1);
+$values->offsetSet(0, new HasDestructor());
+$values->offsetSet(0, false);
+echo "Done\n";
+
+class HasDestructor {
+    public function __destruct() {
+        global $values;
+        var_dump($values);
+        $values->setSize($values->getSize() - 1);
+        var_dump($values);
+    }
+}
+
+$values->setSize(5);
+$values->offsetSet(4, new HasDestructor());
+echo "Done\n";
+--EXPECT--
+object(SplFixedArray)#1 (1) {
+  [0]=>
+  bool(false)
+}
+object(SplFixedArray)#1 (1) {
+  [0]=>
+  bool(false)
+}
+Done
+Done
+object(SplFixedArray)#1 (5) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
+  [3]=>
+  NULL
+  [4]=>
+  object(HasDestructor)#2 (0) {
+  }
+}
+object(SplFixedArray)#1 (4) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
+  [3]=>
+  NULL
+}