[php-src] Issue #20656: HashTable use-after-destroy in function table via stream wrapper magic __call() with nested redeclaration

[email protected] (vi3tL0u1s)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/20656
Author: vi3tL0u1s

### Description

The following code:

```php
<?php
class Loader {
    function stream_open() {
        return true;
    }
    function __call($m, $a) {
        $map[$obj] = putenv("LA=Gx$g_lang");
        function __call($m, $a) {}
    }
}
stream_wrapper_register('abc', 'Loader');
require 'abc://';
```

Resulted in this output:
```
/path/to/php-src/Zend/zend_hash.c(1555) : ht=0x5589df607568 is already destroyed
php: /path/to/php-src/Zend/zend_hash.c:73: _zend_is_inconsistent: Assertion `0' failed.
Aborted
```

Commit:
```
824c3891281bb4deb5a1aa245313a6c6b0ea786f
```

Build configuration:
```
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib
```


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Dec  6 2025 16:29:29) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```

### Operating System

Ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.