Merge branch 'PHP-8.2'

Zend/tests/gh11222.phpt

@@ -0,0 +1,29 @@
+--TEST--
+GH-112222: foreach by-ref may jump over keys during a rehash
+--FILE--
+<?php
+
+// Not packed
+$a = ["k" => 0, 1 => 1, 2, 3, 4, 5, 6];
+foreach ($a as $k => &$v) {
+    if ($k == 1) {
+        // force that it'll be rehashed by adding enough holes
+        unset($a[4], $a[5]);
+        // actually make the array larger than 8 elements to trigger rehash
+        $a[] = 8; $a[] = 9; $a[] = 10;
+
+    }
+    // observe the iteration jumping from key 1 to key 6, skipping keys 2 and 3
+    echo "$k => $v\n";
+}
+
+?>
+--EXPECTF--
+k => 0
+1 => 1
+2 => 2
+3 => 3
+6 => 6
+7 => 8
+8 => 9
+9 => 10

Zend/zend_hash.c

@@ -1312,7 +1312,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht)
 						}
 					}
 				} else {
-					uint32_t iter_pos = zend_hash_iterators_lower_pos(ht, 0);
+					uint32_t iter_pos = zend_hash_iterators_lower_pos(ht, i + 1);
 
 					while (++i < ht->nNumUsed) {
 						p++;