Fix iterator relocation at the current element during rehash

When one iterator points at a hole and another at the next live bucket,
the relocation loop must include the iterator at that bucket's original
position. Otherwise it is moved to the following bucket's destination,
causing a nested by-reference foreach to skip an element.

Add regression coverage for packed-to-hash conversion and compaction of
a full mixed table.

Author: LamentXU123

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     n_scale. (Ilia Alshanetsky)
 
 - Core:
+  . Fixed incorrect foreach iterator positions when compacting arrays with
+    holes. (Weilin Du)
   . Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or
     next() call on the inner generator). (iliaal)
   . Fixed bug GH-23232 (lone namespace separator asks the autoloader for an

Zend/tests/rehash_multiple_iterators.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Rehashing updates iterators at both a hole and the next defined element
+--FILE--
+<?php
+function test(array $values, $firstKey, $secondKey, $newKey, int $newValue): void {
+    $outerVisits = [];
+    $innerVisits = [];
+    $first = true;
+    foreach ($values as $outerKey => &$outerValue) {
+        $outerVisits[] = "$outerKey=>$outerValue";
+        if ($first) {
+            $first = false;
+            foreach ($values as $innerKey => &$innerValue) {
+                $innerVisits[] = "$innerKey=>$innerValue";
+                if ($innerValue === 11) {
+                    // The outer cursor is at a hole, the inner at the next value.
+                    unset($values[$firstKey], $values[$secondKey]);
+                    $values[$newKey] = $newValue;
+                }
+            }
+            unset($innerValue);
+        }
+    }
+    unset($outerValue);
+    echo 'outer: ', implode(' ', $outerVisits), "\n";
+    echo 'inner: ', implode(' ', $innerVisits), "\n";
+}
+
+// Adding a string key converts packed storage and compacts its holes.
+test([10, 11, 12, 13, 14], 0, 1, 'new', 15);
+
+// Inserting into a full mixed table compacts its holes without growing it.
+test(['a' => 10, 'b' => 11, 'c' => 12, 'd' => 13,
+      'e' => 14, 'f' => 15, 'g' => 16, 'h' => 17], 'a', 'b', 'i', 18);
+?>
+--EXPECT--
+outer: 0=>10 2=>12 3=>13 4=>14 new=>15
+inner: 0=>10 1=>11 2=>12 3=>13 4=>14 new=>15
+outer: a=>10 c=>12 d=>13 e=>14 f=>15 g=>16 h=>17 i=>18
+inner: a=>10 b=>11 c=>12 d=>13 e=>14 f=>15 g=>16 h=>17 i=>18

Zend/zend_hash.c

@@ -1412,7 +1412,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht)
 								do {
 									zend_hash_iterators_update(ht, iter_pos, j);
 									iter_pos = zend_hash_iterators_lower_pos(ht, iter_pos + 1);
-								} while (iter_pos < i);
+								} while (iter_pos <= i);
 							}
 							q++;
 							j++;