From 17bffbffb3eac726441dea618adc1c65c7fd6dd6 Mon Sep 17 00:00:00 2001
From: Daniel Scherzer <daniel.e.scherzer@gmail.com>
Date: Wed, 2 Oct 2024 22:35:53 -0700
Subject: [PATCH 1/2] GH-16187: fix ReflectionClass::__toString() with packed
 properties hash table

---
 ext/reflection/php_reflection.c   |  2 +-
 ext/reflection/tests/gh16187.phpt | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 ext/reflection/tests/gh16187.phpt

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index f24b00a2857f9..3faf8ed78681e 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -477,7 +477,7 @@ static void _class_string(smart_str *str, zend_class_entry *ce, zval *obj, char
 
 		count = 0;
 		if (properties && zend_hash_num_elements(properties)) {
-			ZEND_HASH_MAP_FOREACH_STR_KEY(properties, prop_name) {
+			ZEND_HASH_FOREACH_STR_KEY(properties, prop_name) {
 				if (prop_name && ZSTR_LEN(prop_name) && ZSTR_VAL(prop_name)[0]) { /* skip all private and protected properties */
 					if (!zend_hash_exists(&ce->properties_info, prop_name)) {
 						count++;
diff --git a/ext/reflection/tests/gh16187.phpt b/ext/reflection/tests/gh16187.phpt
new file mode 100644
index 0000000000000..64aec52de93ba
--- /dev/null
+++ b/ext/reflection/tests/gh16187.phpt
@@ -0,0 +1,14 @@
+--TEST--
+GH-16187 (ReflectionClass::__toString() with unpacked properties)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+$xml = '<form name="test"></form>';
+$simplexml = simplexml_load_string($xml);
+$reflector = new ReflectionObject($simplexml['name']);
+$reflector->__toString();
+?>
+DONE
+--EXPECT--
+DONE

From e67813204fbe6bca6b5af0ad6cc54cbcb78814cb Mon Sep 17 00:00:00 2001
From: Daniel Scherzer <daniel.e.scherzer@gmail.com>
Date: Thu, 3 Oct 2024 17:44:55 -0700
Subject: [PATCH 2/2] Add NEWS

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index de78eabdadb08..d492c9761842e 100644
--- a/NEWS
+++ b/NEWS
@@ -51,6 +51,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
     (cmb)
 
+- Reflection:
+  . Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
+    (DanielEScherzer)
+
 - SimpleXML:
   . Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
     (nielsdos)