Accessing the object after WeakRef unreferencing results in use-after-free

Description

The following code:

<?php

$w = new WeakMap;

$o = new stdClass;
$w[$o] = new class($r) {
	function __construct(public &$r) {}
	function __destruct() {
		$o = $this->r->get();
		register_shutdown_function(function() use ($o) {
			var_dump($o);
		});
	}
};
$r = WeakReference::create($o);

Resulted in this output:

==36789== Invalid read of size 4
==36789==    at 0x54C4404: zend_gc_delref (zend_types.h:1342)
==36789==    by 0x54BFAC7: i_zval_ptr_dtor (zend_variables.h:43)
==36789==    by 0x54BF86B: zend_array_destroy (/usr/local/src/php/Zend/zend_hash.c:1840)
==36789==    by 0x54862CF: zend_destroy_static_vars (/usr/local/src/php/Zend/zend_opcode.c:532)
==36789==    by 0x55C4DE7: zend_closure_free_storage (/usr/local/src/php/Zend/zend_closures.c:522)
==36789==    by 0xBA0918F: dd_uhook_closure_free_wrapper (uhook.c:1158)
==36789==    by 0x55EA76F: zend_objects_store_del (/usr/local/src/php/Zend/zend_objects_API.c:200)
==36789==    by 0x5499757: rc_dtor_func (/usr/local/src/php/Zend/zend_variables.c:57)
==36789==    by 0x54997F3: i_zval_ptr_dtor (zend_variables.h:44)
==36789==    by 0x5499793: zval_ptr_dtor (/usr/local/src/php/Zend/zend_variables.c:84)
==36789==    by 0x52333E3: fci_release (/usr/local/src/php/ext/standard/basic_functions.c:1611)
==36789==    by 0x522B973: user_shutdown_function_dtor (/usr/local/src/php/ext/standard/basic_functions.c:1622)
==36789==  Address 0xe813150 is 0 bytes inside a block of size 40 free'd
==36789==    at 0x604B614: free (m_replacemalloc/vg_replace_malloc.c:989)
==36789==    by 0x544D673: _efree_custom (/usr/local/src/php/Zend/zend_alloc.c:2500)
==36789==    by 0x544D5C7: _efree (/usr/local/src/php/Zend/zend_alloc.c:2620)
==36789==    by 0x55EA7DF: zend_objects_store_del (/usr/local/src/php/Zend/zend_objects_API.c:204)
==36789==    by 0x5499757: rc_dtor_func (/usr/local/src/php/Zend/zend_variables.c:57)
==36789==    by 0x54997F3: i_zval_ptr_dtor (zend_variables.h:44)
==36789==    by 0x5499793: zval_ptr_dtor (/usr/local/src/php/Zend/zend_variables.c:84)
==36789==    by 0x54BE46F: _zend_hash_del_el_ex (/usr/local/src/php/Zend/zend_hash.c:1488)
==36789==    by 0x54BDF6B: _zend_hash_del_el (/usr/local/src/php/Zend/zend_hash.c:1515)
==36789==    by 0x54C15C3: zend_hash_reverse_apply (/usr/local/src/php/Zend/zend_hash.c:2231)
==36789==    by 0x547A843: shutdown_destructors (/usr/local/src/php/Zend/zend_execute_API.c:260)
==36789==    by 0x549C227: zend_call_destructors (/usr/local/src/php/Zend/zend.c:1281)
==36789==  Block was alloc'd at
==36789==    at 0x60485D4: malloc (m_replacemalloc/vg_replace_malloc.c:446)
==36789==    by 0x544DA1B: __zend_malloc (/usr/local/src/php/Zend/zend_alloc.c:3128)
==36789==    by 0x544D54F: _malloc_custom (/usr/local/src/php/Zend/zend_alloc.c:2491)
==36789==    by 0x544D493: _emalloc (/usr/local/src/php/Zend/zend_alloc.c:2610)
==36789==    by 0x55E0907: zend_objects_new (/usr/local/src/php/Zend/zend_objects.c:189)
==36789==    by 0x54A6143: _object_and_properties_init (/usr/local/src/php/Zend/zend_API.c:1773)
==36789==    by 0x54A621B: object_init_ex (/usr/local/src/php/Zend/zend_API.c:1796)
==36789==    by 0x552F62F: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10557)
==36789==    by 0x54E2073: execute_ex (zend_vm_execute.h:57037)
==36789==    by 0x54E2483: zend_execute (zend_vm_execute.h:61634)
==36789==    by 0x549E34B: zend_execute_scripts (/usr/local/src/php/Zend/zend.c:1895)
==36789==    by 0x53CB8E3: php_execute_script (/usr/local/src/php/main/main.c:2529)

Not exactly sure what to expect - either we just decide to make WeakReference->get() return NULL when the targeted object has IS_OBJ_FREE_CALLED. Which would fix #20404 trivially as well.
But it would be a BC break and render the object inaccessible in "externally associated destructors" (I mean dummy classes with destructors in weakmaps to observe an object to be freed). Because simply accessing as long as it lives is currently fine (i.e. within the destructor). Just persisting it outside of the destructor is problematic.

Or we strip the IS_OBJ_FREE_CALLED flag in the case the refcount is increased again in zend_object_std_dtor and skip freeing the object in case the flag is no longer present after the free_obj() call.

The latter solution is more flexible and does not have a BC break.

PHP Version

PHP 8.2+

Operating System

No response

Bắt đầu với reproducer WeakMap và WeakReference được cung cấp, sau đó kiểm tra WeakReference->get() và zend_object_std_dtor, hai entry point được thảo luận trong issue. Theo dõi vòng đời của đối tượng trong quá trình hủy và xác minh rằng hành vi được chọn loại bỏ lần đọc không hợp lệ đã được báo cáo mà không làm hỏng việc truy cập trong quá trình hủy. Phần hoàn thành phải bao gồm một regression test cho reproducer này.