[GIT-PULLS] [php-src] PR #23221: ext/pcre: preg_replace() use-after-free when __toString() destroys an…

Pull Request: https://github.com/php/php-src/pull/23221
Author: devnexen

… array argument.

Fix #23204

Follow-up on GH-23207.

preg_replace() has a frameless handler, so the pattern, replacement and subject arrays reached _preg_replace_common() with a refcount of one. Stringifying an entry runs __toString(), which freed arData under the iterator or rehashed it in place. Taking a reference on each table for the duration of the read keeps it alive and turns a mutation into a separation.