Commit 8275b522d2b for php.net

commit 8275b522d2bdbe7c54039507dc7711c4ae961df4
Merge: 6f6543e9b9e e912c022fda
Author: Gina Peter Banyard <girgias@php.net>
Date:   Thu Mar 26 10:59:30 2026 +0000

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Revert 49b2ff5dbb94b76b265fd5909881997e1d95c6b3 to fix bug GH-21499

diff --cc NEWS
index c0f47d0e07c,dc0e430775f..597e93bf081
--- a/NEWS
+++ b/NEWS
@@@ -6,11 -6,16 +6,15 @@@ PH
    . Fixed bug GH-19983 (GC assertion failure with fibers, generators and
      destructors). (iliaal)

+ - SPL:
+   . Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent
+     free). (Girgias)
+
 -09 Apr 2026, PHP 8.4.20
 -
 -- Bz2:
 -  . Fix truncation of total output size causing erroneous errors. (ndossche)
 +26 Mar 2026, PHP 8.5.5

  - Core:
 +  . Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed
 +    trait properties). (ilutov)
    . Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in
      get_property_ptr_ptr for lazy proxies). (iliaal)

diff --cc ext/spl/spl_array.c
index ea21b422229,01fdccf251b..bfc6c4b1d6e
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@@ -974,23 -936,8 +937,14 @@@ static void spl_array_set_array(zval *o
  		} else {
  			//??? TODO: try to avoid array duplication
  			ZVAL_ARR(&intern->array, zend_array_dup(Z_ARR_P(array)));
-
- 			if (intern->is_child) {
- 				Z_TRY_DELREF(intern->bucket->val);
- 				/*
- 				 * replace bucket->val with copied array, so the changes between
- 				 * parent and child object can affect each other.
- 				 */
- 				ZVAL_COPY(&intern->bucket->val, &intern->array);
- 			}
  		}
  	} else {
 +		php_error_docref(NULL, E_DEPRECATED,
 +			"Using an object as a backing array for %s is deprecated, as it allows violating class constraints and invariants",
 +			instanceof_function(Z_OBJCE_P(object), spl_ce_ArrayIterator) ? "ArrayIterator" : "ArrayObject");
 +		if (UNEXPECTED(EG(exception))) {
 +			return;
 +		}
  		if (Z_OBJ_HT_P(array) == &spl_handler_ArrayObject) {
  			ZVAL_COPY_VALUE(&garbage, &intern->array);
  			if (just_array)	{