From 331da7e8693ffb028c6678b5182f3436444d1c3b Mon Sep 17 00:00:00 2001
From: Daniel Scherzer <daniel.e.scherzer@gmail.com>
Date: Wed, 2 Oct 2024 22:35:53 -0700
Subject: [PATCH] Fix GH-16187: ReflectionClass::__toString() with packed
 properties hash table

Closes GH-16192.
---
 NEWS                              |  4 ++++
 ext/reflection/php_reflection.c   |  2 +-
 ext/reflection/tests/gh16187.phpt | 14 ++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 ext/reflection/tests/gh16187.phpt

diff --git a/NEWS b/NEWS
index de78eabdadb..d492c976184 100644
--- a/NEWS
+++ b/NEWS
@@ -51,6 +51,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
     (cmb)
 
+- Reflection:
+  . Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
+    (DanielEScherzer)
+
 - SimpleXML:
   . Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
     (nielsdos)
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index f24b00a2857..3faf8ed7868 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -477,7 +477,7 @@ static void _class_string(smart_str *str, zend_class_entry *ce, zval *obj, char
 
 		count = 0;
 		if (properties && zend_hash_num_elements(properties)) {
-			ZEND_HASH_MAP_FOREACH_STR_KEY(properties, prop_name) {
+			ZEND_HASH_FOREACH_STR_KEY(properties, prop_name) {
 				if (prop_name && ZSTR_LEN(prop_name) && ZSTR_VAL(prop_name)[0]) { /* skip all private and protected properties */
 					if (!zend_hash_exists(&ce->properties_info, prop_name)) {
 						count++;
diff --git a/ext/reflection/tests/gh16187.phpt b/ext/reflection/tests/gh16187.phpt
new file mode 100644
index 00000000000..64aec52de93
--- /dev/null
+++ b/ext/reflection/tests/gh16187.phpt
@@ -0,0 +1,14 @@
+--TEST--
+GH-16187 (ReflectionClass::__toString() with unpacked properties)
+--EXTENSIONS--
+simplexml
+--FILE--
+<?php
+$xml = '<form name="test"></form>';
+$simplexml = simplexml_load_string($xml);
+$reflector = new ReflectionObject($simplexml['name']);
+$reflector->__toString();
+?>
+DONE
+--EXPECT--
+DONE