Fix GH-23385: Use-after-free in SplDoublyLinkedList::serialize()

[Alb3e3]

Fixes GH-23385.

The SPL side

SplDoublyLinkedList::serialize() walks the list and passes each element's zval straight to php_var_serialize():

	while (current) {
		next = current->next;
		SPL_LLIST_CHECK_ADDREF(next);
		php_var_serialize(&buf, &current->data, &var_hash);
		SPL_LLIST_CHECK_DELREF_EX(next, break;);
		current = next;
	}

Serializing an element can re-enter userland (__serialize, __sleep, Serializable::serialize), and that code can remove the element that is being serialized. The loop already anticipates this for the next element but not for the current one, so offsetUnset() drops the last reference and frees it while php_var_serialize() still uses &current->data as its struc argument.

The element is already built to outlive its removal from the list, see the "Keep consistency if element is kept alive" branch in offsetUnset(), so taking a reference for the duration of the call is all that is needed.

Why there are two commits

The reproducer in the issue frees two different things, and only one of them is the SPL bug.

offsetUnset() also destroys element->data, which drops the array's last reference while php_var_serialize_nested_data() is iterating it. That half was already fixed on master by cc8abaf (GH-22714), which holds a ref on the HashTable across the walk, but that commit never made it to PHP-8.4/8.5. So on this branch the issue's reproducer still crashes there even with the SPL fix applied.

The first commit is that backport, unchanged apart from the surrounding incomplete_class argument style on this branch, together with its test. Please drop it if you would rather merge cc8abaf up yourself; the second commit stands on its own and merges up cleanly.

Verification

Built PHP-8.4 (--disable-all --enable-debug) with ASan and USE_ZEND_ALLOC=0.

Before, the issue's reproducer:

==1803822==ERROR: AddressSanitizer: heap-use-after-free
READ of size 4 ... php_var_serialize_nested_data var.c:1009
freed by ... zim_SplDoublyLinkedList_offsetUnset spl_dllist.c:758

After, both that reproducer and a variant that hits only the SPL half (a nested array after the object, so the walk dereferences struc again once the element is gone) run clean, with no leaks reported.

ext/spl/ and ext/standard/tests/serialize/: 920 pass, same 4 pre-existing failures as an unpatched checkout of this branch in the same ASan build (RecursiveIteratorIterator_dtor_order, bug79710, bug67247, bug77751). Unpatched: 918 pass, so the delta is exactly the two added tests.

The new gh23385.phpt covers three shapes: an element removing itself, an element removing its successor, and an element clearing the whole list.

Note on AI use

I used Claude Code while working on this. I reproduced the crash, wrote and reviewed the change, and ran the test suites myself.