Handle reallocated root buffer during GC destroy phase (v2)

We no longer protect GC during the destroy phase, so we need to
deal with buffer reallocation.

Note that the implementation of spl_SplObjectStorage_free_storage
will call the destructor of SplObjectStorage, and free the instance properties,
which I think is what caused the root buffer to be reallocated.

This fixes bug #78811 for me.

Author: TysonAndre

Zend/zend_gc.c

@@ -1555,6 +1555,8 @@ ZEND_API int zend_gc_collect_cycles(void)
 						GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
 						GC_ADDREF(obj);
 						obj->handlers->free_obj(obj);
+						current = GC_IDX2PTR(idx);  // bug #78811: free_obj() can cause the root buffer to be reallocated.
+						obj = (zend_object*)GC_GET_PTR(current->ref);
 						GC_DELREF(obj);
 					}