Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
  [ci skip] NEWS
  Fix GH-13612: Corrupted memory in destructor with weak references

Author: ndossche

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when
     scanning WeakMaps). (Arnaud)
+  . Fixed bug GH-13612 (Corrupted memory in destructor with weak references).
+    (nielsdos)
 
 - Gettext:
   . Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5

Zend/tests/weakrefs/gh13612.phpt

@@ -0,0 +1,39 @@
+--TEST--
+GH-13612 (Corrupted memory in destructor with weak references)
+--FILE--
+<?php
+
+class WeakAnalysingMapRepro
+{
+    public array $destroyed = [];
+    public array $ownerDestructorHandlers = [];
+
+    public function __construct()
+    {
+        $handler = new class($this) {
+            private \WeakReference $weakAnalysingMap;
+
+            public function __construct(WeakAnalysingMapRepro $analysingMap)
+            {
+                $this->weakAnalysingMap = \WeakReference::create($analysingMap);
+            }
+
+            public function __destruct()
+            {
+                var_dump($this->weakAnalysingMap->get());
+            }
+        };
+
+        $this->destroyed[] = 1;
+        $this->ownerDestructorHandlers[] = $handler;
+    }
+}
+
+new WeakAnalysingMapRepro();
+
+echo "Done\n";
+
+?>
+--EXPECT--
+NULL
+Done

Zend/zend_objects.c

@@ -50,6 +50,10 @@ ZEND_API void zend_object_std_dtor(zend_object *object)
 {
 	zval *p, *end;
 
+	if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) {
+		zend_weakrefs_notify(object);
+	}
+
 	if (object->properties) {
 		if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
 			if (EXPECTED(GC_DELREF(object->properties) == 0)
@@ -88,10 +92,6 @@ ZEND_API void zend_object_std_dtor(zend_object *object)
 			FREE_HASHTABLE(guards);
 		}
 	}
-
-	if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) {
-		zend_weakrefs_notify(object);
-	}
 }
 
 ZEND_API void zend_objects_destroy_object(zend_object *object)