Fix GH-17935: ArrayObject unserialize assertion failure on later modification

Author: alexandre-daubois

NEWS

@@ -109,6 +109,8 @@ PHP                                                                        NEWS
 - SPL:
   . Fixed bug GH-20614 (SplFixedArray incorrectly handles references
     in deserialization). (ndossche)
+  . Fixed bug GH-17935 (ArrayObject unserialize assertion failure on later
+    modification). (alexandre-daubois)
 
 - Standard:
   . Fix memory leak in array_diff() with custom type checks. (ndossche)

ext/spl/spl_array.c

@@ -1779,6 +1779,8 @@ PHP_METHOD(ArrayObject, __serialize)
 	/* storage */
 	if (intern->ar_flags & SPL_ARRAY_IS_SELF) {
 		ZVAL_NULL(&tmp);
+	} else if (Z_TYPE(intern->array) == IS_ARRAY) {
+		ZVAL_ARR(&tmp, zend_array_dup(Z_ARR(intern->array)));
 	} else {
 		ZVAL_COPY(&tmp, &intern->array);
 	}

ext/spl/tests/bug45826.phpt

@@ -94,7 +94,16 @@ array(4) {
     [2]=>
     object(ArrayObject2)#5 (1) {
       ["storage":"ArrayObject":private]=>
-      *RECURSION*
+      array(3) {
+        [0]=>
+        object(stdClass)#8 (0) {
+        }
+        [1]=>
+        object(stdClass)#8 (0) {
+        }
+        [2]=>
+        *RECURSION*
+      }
     }
   }
   [2]=>

ext/spl/tests/gh17935.phpt

@@ -0,0 +1,11 @@
+--TEST--
+GH-17935 (ArrayObject __serialize() should not cause assertion failure on modification)
+--FILE--
+<?php
+$o = new ArrayObject();
+$s2 = $o->__serialize();
+$o['a'] = 'b';
+echo "Success\n";
+?>
+--EXPECT--
+Success