Commit 8275b522d2b for php.net
commit 8275b522d2bdbe7c54039507dc7711c4ae961df4
Merge: 6f6543e9b9e e912c022fda
Author: Gina Peter Banyard <girgias@php.net>
Date: Thu Mar 26 10:59:30 2026 +0000
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
Revert 49b2ff5dbb94b76b265fd5909881997e1d95c6b3 to fix bug GH-21499
diff --cc NEWS
index c0f47d0e07c,dc0e430775f..597e93bf081
--- a/NEWS
+++ b/NEWS
@@@ -6,11 -6,16 +6,15 @@@ PH
. Fixed bug GH-19983 (GC assertion failure with fibers, generators and
destructors). (iliaal)
+ - SPL:
+ . Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent
+ free). (Girgias)
+
-09 Apr 2026, PHP 8.4.20
-
-- Bz2:
- . Fix truncation of total output size causing erroneous errors. (ndossche)
+26 Mar 2026, PHP 8.5.5
- Core:
+ . Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed
+ trait properties). (ilutov)
. Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in
get_property_ptr_ptr for lazy proxies). (iliaal)
diff --cc ext/spl/spl_array.c
index ea21b422229,01fdccf251b..bfc6c4b1d6e
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@@ -974,23 -936,8 +937,14 @@@ static void spl_array_set_array(zval *o
} else {
//??? TODO: try to avoid array duplication
ZVAL_ARR(&intern->array, zend_array_dup(Z_ARR_P(array)));
-
- if (intern->is_child) {
- Z_TRY_DELREF(intern->bucket->val);
- /*
- * replace bucket->val with copied array, so the changes between
- * parent and child object can affect each other.
- */
- ZVAL_COPY(&intern->bucket->val, &intern->array);
- }
}
} else {
+ php_error_docref(NULL, E_DEPRECATED,
+ "Using an object as a backing array for %s is deprecated, as it allows violating class constraints and invariants",
+ instanceof_function(Z_OBJCE_P(object), spl_ce_ArrayIterator) ? "ArrayIterator" : "ArrayObject");
+ if (UNEXPECTED(EG(exception))) {
+ return;
+ }
if (Z_OBJ_HT_P(array) == &spl_handler_ArrayObject) {
ZVAL_COPY_VALUE(&garbage, &intern->array);
if (just_array) {