Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
  Fixed bug #80719

Author: nikic

NEWS

@@ -23,6 +23,10 @@ PHP                                                                        NEWS
   . Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives). (cmb)
   . Fixed bug #53467 (Phar cannot compress large archives). (cmb, lserni)
 
+- SPL:
+  . Fixed bug#80719 (Iterating after failed ArrayObject::setIteratorClass()
+    causes Segmentation fault). (Nikita)
+
 - Standard:
   . Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
     (cmb)

ext/spl/spl_array.c

@@ -1175,7 +1175,7 @@ PHP_METHOD(ArrayObject, __construct)
 	spl_array_object *intern;
 	zval *array;
 	zend_long ar_flags = 0;
-	zend_class_entry *ce_get_iterator = spl_ce_Iterator;
+	zend_class_entry *ce_get_iterator = spl_ce_ArrayIterator;
 
 	if (ZEND_NUM_ARGS() == 0) {
 		return; /* nothing to do */
@@ -1226,7 +1226,7 @@ PHP_METHOD(ArrayObject, setIteratorClass)
 {
 	zval *object = ZEND_THIS;
 	spl_array_object *intern = Z_SPLARRAY_P(object);
-	zend_class_entry * ce_get_iterator = spl_ce_Iterator;
+	zend_class_entry *ce_get_iterator = spl_ce_ArrayIterator;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_CLASS(ce_get_iterator)

ext/spl/tests/arrayObject___construct_error1.phpt

@@ -20,6 +20,6 @@ try {
 ?>
 --EXPECT--
 Bad iterator type:
-ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from Iterator, Exception given(6)
+ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from ArrayIterator, Exception given(6)
 Non-existent class:
-ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from Iterator, nonExistentClassName given(13)
+ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from ArrayIterator, nonExistentClassName given(13)

ext/spl/tests/arrayObject_setIteratorClass_error1.phpt

@@ -43,7 +43,7 @@ try {
 
 ?>
 --EXPECT--
-string(128) "ArrayObject::setIteratorClass(): Argument #1 ($iteratorClass) must be a class name derived from Iterator, nonExistentClass given"
-string(120) "ArrayObject::setIteratorClass(): Argument #1 ($iteratorClass) must be a class name derived from Iterator, stdClass given"
-string(123) "ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from Iterator, nonExistentClass given"
-string(115) "ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from Iterator, stdClass given"
+string(133) "ArrayObject::setIteratorClass(): Argument #1 ($iteratorClass) must be a class name derived from ArrayIterator, nonExistentClass given"
+string(125) "ArrayObject::setIteratorClass(): Argument #1 ($iteratorClass) must be a class name derived from ArrayIterator, stdClass given"
+string(128) "ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from ArrayIterator, nonExistentClass given"
+string(120) "ArrayObject::__construct(): Argument #3 ($iteratorClass) must be a class name derived from ArrayIterator, stdClass given"

ext/spl/tests/bug80719.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #80719: Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault
+--FILE--
+<?php
+
+$array = new ArrayObject([42]);
+try {
+    $array->setIteratorClass(FilterIterator::class);
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+foreach ($array as $v) {
+    var_dump($v);
+}
+
+?>
+--EXPECT--
+ArrayObject::setIteratorClass(): Argument #1 ($iteratorClass) must be a class name derived from ArrayIterator, FilterIterator given
+int(42)