Enabling debug output in php_add_var_hash(),
with (type, zend_objects_get_address, handle): var_no

+ add var (5, f6e11b18,        6): 1
+ add var (4,        0,        0): 2
+ add var (5, f6e1169c,        7): 3
+ add var (5, f6e13d94,        b): 4
+ add var (1,        0,        0): 5
+ add var (5, f6e1175c,        9): 6
- had var (5, f6e13d94,        b): 4

This test is failing since introduced in 5.4.22

This first patch seems to fix this runtime issue, and don't break other serialize tests.

This is not a perfect solution, as handle free list is ignored.

Bug was reproducted on NetBSD i386. The patch fixes the issue.

Apart from the free_list issue, the patch has the additional problems that object R refs will not be created for objects created in serialize(). Consider the following script:

<?php

class Test implements Serializable {
    public function serialize() {
        $obj = new stdClass;
        return serialize([$obj, $obj]);
    }
    public function unserialize($str) {
        var_dump(unserialize($str));
    }
}

unserialize(serialize(new Test));

Here an array with two identical objects is serialized and as such it also should unserialize to the same object.

Current behavior:

~/dev/php-5.6$ sapi/cli/php t18.php 
array(2) {
  [0]=>
  object(stdClass)#2 (0) {
  }
  [1]=>
  object(stdClass)#2 (0) {
  }
}

After patch:

~/dev/php-5.6$ sapi/cli/php t18.php 
array(2) {
  [0]=>
  object(stdClass)#2 (0) {
  }
  [1]=>
  object(stdClass)#3 (0) {
  }
}

So just excluding objects created during serialize() might solve the test failure, but will introduce problems in other cases.

I think the only way to fix this issue is to retain a reference to all objects that are serialized and drop it after serialization is finished. This avoids the possibility that object handles or memory addresses are reused during serialization. This is how this was fixed in PHP 7:

    https://github.com/php/php-src/commit/8be73f2650582423ec1d3c4b65a77c450f6683a0
    https://github.com/php/php-src/commit/75860fa8e1d8ce0c9fd2b505bf7663a4936a7a39

However the same approach is likely not feasible in 5.x due to ABI restrictions.

I haven't looked at this patch but from discussion it looks related to #66085 https://bugs.php.net/bug.php?id=66085 I had an experimental fix for that IIRC in the 5.6 line:

https://github.com/ahamid/php-src/commit/cfe3a0f543fb104d52cf684ddd65e68c3f521375

>I think the only way to fix this issue is to retain a reference to all objects that are serialized and drop it after serialization is finished. This avoids the possibility that object handles or memory addresses are reused during serialization.

Yes, I came to the same conclusion.

For completeness my pull request with some questions regarding impl: https://github.com/php/php-src/pull/550

As mentioned in comments, this is a duplicate of bug #66085.