Commit 8eb02dbaa33 for php

commit 8eb02dbaa339613075d1c9db9f130eb7e4c8af73
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Mon Nov 9 08:32:46 2026 -0500

    Fix GH-13230: phpdbg use-after-free at shutdown

    phpdbg_clean_watch_element() left element->watch pointing at the
    watchpoint that phpdbg_remove_watchpoint() had just freed, so a later
    phpdbg_backup_watch_element() on the same chain copied from freed
    memory. Clear the pointer and skip the backup for a detached element.
    Drop the SKIP_ASAN guard from bug73927.phpt, which reproduces the read.

    The fix was reduced to these two changes by Kamil Tekiela.

    Fixes GH-13230
    Closes GH-22111

diff --git a/NEWS b/NEWS
index ddcb2487e78..5acaf162608 100644
--- a/NEWS
+++ b/NEWS
@@ -114,6 +114,10 @@ PHP                                                                        NEWS
 - PGSQL:
   . Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)

+- phpdbg:
+  . Fixed bug GH-13230 (use-after-free at phpdbg shutdown).
+    (Kamil Tekiela, Ilia Alshanetsky)
+
 - Posix:
   . Reverted the validity check on the flags argument of posix_access().
     (David Carlier)
diff --git a/sapi/phpdbg/phpdbg_watch.c b/sapi/phpdbg/phpdbg_watch.c
index a2e39e15a6c..e617a7b73cb 100644
--- a/sapi/phpdbg/phpdbg_watch.c
+++ b/sapi/phpdbg/phpdbg_watch.c
@@ -979,6 +979,9 @@ void phpdbg_remove_watch_element(phpdbg_watch_element *element) {
 }

 void phpdbg_backup_watch_element(phpdbg_watch_element *element) {
+	if (!element->watch) {
+		return;
+	}
 	memcpy(&element->backup, &element->watch->backup, /* element->watch->size */ sizeof(element->backup));
 }

@@ -1097,6 +1100,7 @@ void phpdbg_clean_watch_element(phpdbg_watch_element *element) {
 		if (zend_hash_num_elements(elements) == 0) {
 			phpdbg_remove_watchpoint(element->watch);
 		}
+		element->watch = NULL;
 	}
 }

diff --git a/sapi/phpdbg/tests/bug73927.phpt b/sapi/phpdbg/tests/bug73927.phpt
index bb54f4e1761..81a1d2fa47f 100644
--- a/sapi/phpdbg/tests/bug73927.phpt
+++ b/sapi/phpdbg/tests/bug73927.phpt
@@ -1,11 +1,5 @@
 --TEST--
 Bug #73927 (phpdbg fails with windows error prompt at "watch array")
---SKIPIF--
-<?php
-if (getenv('SKIP_ASAN')) {
-    die("skip intentionally causes segfaults");
-}
-?>
 --PHPDBG--
 b 19
 r