Fix GH-19926: preserve COW violation flags when copying a hashtable while splicing

Author: alexandre-daubois

ext/standard/array.c

@@ -3395,7 +3395,14 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
 	in_hash->arData            = out_hash.arData;
 	in_hash->pDestructor       = out_hash.pDestructor;
 
-	zend_hash_internal_pointer_reset(in_hash);
+	/* Temporarily allow COW violation for pointer reset when refcount > 1 */
+	if (GC_REFCOUNT(in_hash) > 1) {
+		HT_ALLOW_COW_VIOLATION(in_hash);
+		zend_hash_internal_pointer_reset(in_hash);
+		HT_FLAGS(in_hash) &= ~HASH_FLAG_ALLOW_COW_VIOLATION;
+	} else {
+		zend_hash_internal_pointer_reset(in_hash);
+	}
 }
 /* }}} */
 

ext/standard/tests/array/gh19926.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-19926 (Assertion failure zend_hash_internal_pointer_reset_ex)
+--FILE--
+<?php
+function exception_error_handler() {
+    throw new Exception();
+}
+
+set_error_handler("exception_error_handler");
+
+class MultiDestructor {
+    function __destruct() {
+        if ($this->id == 2) {
+        }
+    }
+}
+
+$arr = ["start", new MultiDestructor(1), new MultiDestructor(2), "end"];
+
+try {
+    array_splice($arr, 1, 2);
+} catch (Exception $e) {
+    echo "Exception caught, no assertion failure\n";
+}
+?>
+--EXPECT--
+Exception caught, no assertion failure