Crash in unserialize()

Description

Originally reported by @calysteon.

<?php
class Trigger {
    public function __destruct() {
        @unserialize('i:1;');
    }
}

$payload = 'a:1019:{';
for ($i = 0; $i < 1017; $i++) {
    $payload .= "i:$i;s:1:\"A\";";
}
// Entry that overflows into a second var_entries block
$payload .= 'i:1017;O:7:"Trigger":0:{}';
// Duplicate key overwrites Trigger, pushing it to dtor list (refcount stays at 1)
$payload .= 'i:1017;i:0;}';

$result = @unserialize($payload);

PHP Version

-

Operating System

No response

Start by running the supplied PHP reproducer and tracing the unserialize() entry point, including the destructor-triggering behavior shown in the example. Done means this payload no longer crashes PHP and the regression is covered by an appropriate test.