Fix GH-19926: preserve COW violation flags when copying a hashtable while splicing

Author: alexandre-daubois

ext/standard/array.c

@@ -3376,6 +3376,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
 	HT_SET_ITERATORS_COUNT(in_hash, 0);
 	in_hash->pDestructor = NULL;
 
+	/* Reset internal pointer while COW violation flag is still set */
+	zend_hash_internal_pointer_reset(in_hash);
+
 	if (UNEXPECTED(GC_DELREF(in_hash) == 0)) {
 		/* Array was completely deallocated during the operation */
 		zend_array_destroy(in_hash);
@@ -3394,8 +3397,6 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
 	in_hash->nNextFreeElement  = out_hash.nNextFreeElement;
 	in_hash->arData            = out_hash.arData;
 	in_hash->pDestructor       = out_hash.pDestructor;
-
-	zend_hash_internal_pointer_reset(in_hash);
 }
 /* }}} */
 

ext/standard/tests/array/gh19926.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-19926 (Assertion failure zend_hash_internal_pointer_reset_ex)
+--FILE--
+<?php
+function exception_error_handler() {
+    throw new Exception();
+}
+
+set_error_handler("exception_error_handler");
+
+class MultiDestructor {
+    function __destruct() {
+        if ($this->id == 2) {
+        }
+    }
+}
+
+$arr = ["start", new MultiDestructor(1), new MultiDestructor(2), "end"];
+
+try {
+    array_splice($arr, 1, 2);
+} catch (Exception $e) {
+    echo "Exception caught, no assertion failure\n";
+}
+?>
+--EXPECT--
+Exception caught, no assertion failure