Fix handling of invalid iterator in zend_weakmap_iterator_get_current_key()

Fixes phpGH-16371
Closes phpGH-16436

Author: arnaud-lb

NEWS

@@ -12,6 +12,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled
     with Xcode 16 clang on macOS 15). (nielsdos)
+  . Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646). (Arnaud)
 
 - Curl:
   . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if

Zend/tests/gh16371.phpt

@@ -0,0 +1,47 @@
+--TEST--
+GH-16371: Assertion failure in zend_weakmap_iterator_get_current_key() for invalid iterator
+--FILE--
+<?php
+
+$map = new WeakMap();
+$it = $map->getIterator();
+
+print "# Empty WeakMap\n";
+
+var_dump($it->key());
+var_dump($it->current());
+var_dump($it->valid());
+
+$map = new WeakMap();
+$obj = new stdClass;
+$map[$obj] = 0;
+
+print "# Valid iterator\n";
+
+$it = $map->getIterator();
+var_dump($it->key());
+var_dump($it->current());
+var_dump($it->valid());
+
+print "# End of iterator\n";
+
+$it->next();
+var_dump($it->key());
+var_dump($it->current());
+var_dump($it->valid());
+
+?>
+--EXPECTF--
+# Empty WeakMap
+NULL
+NULL
+bool(false)
+# Valid iterator
+object(stdClass)#%d (0) {
+}
+int(0)
+bool(true)
+# End of iterator
+NULL
+NULL
+bool(false)

Zend/zend_weakrefs.c

@@ -530,6 +530,10 @@ static void zend_weakmap_iterator_get_current_key(zend_object_iterator *obj_iter
 	zend_string *string_key;
 	zend_ulong num_key;
 	int key_type = zend_hash_get_current_key_ex(&wm->ht, &string_key, &num_key, pos);
+	if (key_type == HASH_KEY_NON_EXISTENT) {
+		ZVAL_NULL(key);
+		return;
+	}
 	if (key_type != HASH_KEY_IS_LONG) {
 		ZEND_ASSERT(0 && "Must have integer key");
 	}