preserves HASH_FLAG_ALLOW_COW_VIOLATION in zend_hash_real_init_ex()

Zend/zend_hash.c

@@ -149,6 +149,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
 static zend_always_inline void zend_hash_real_init_packed_ex(HashTable *ht)
 {
 	void *data;
+	uint8_t prev_flags = HT_FLAGS(ht) & HASH_FLAG_ALLOW_COW_VIOLATION;
 
 	if (UNEXPECTED(GC_FLAGS(ht) & IS_ARRAY_PERSISTENT)) {
 		data = pemalloc(HT_PACKED_SIZE_EX(ht->nTableSize, HT_MIN_MASK), 1);
@@ -160,14 +161,15 @@ static zend_always_inline void zend_hash_real_init_packed_ex(HashTable *ht)
 	}
 	HT_SET_DATA_ADDR(ht, data);
 	/* Don't overwrite iterator count. */
-	ht->u.v.flags = HASH_FLAG_PACKED | HASH_FLAG_STATIC_KEYS;
+	ht->u.v.flags = prev_flags | HASH_FLAG_PACKED | HASH_FLAG_STATIC_KEYS;
 	HT_HASH_RESET_PACKED(ht);
 }
 
 static zend_always_inline void zend_hash_real_init_mixed_ex(HashTable *ht)
 {
 	void *data;
 	uint32_t nSize = ht->nTableSize;
+	uint8_t prev_flags = HT_FLAGS(ht) & HASH_FLAG_ALLOW_COW_VIOLATION;
 
 	ZEND_ASSERT(HT_SIZE_TO_MASK(nSize));
 
@@ -178,7 +180,7 @@ static zend_always_inline void zend_hash_real_init_mixed_ex(HashTable *ht)
 		ht->nTableMask = HT_SIZE_TO_MASK(HT_MIN_SIZE);
 		HT_SET_DATA_ADDR(ht, data);
 		/* Don't overwrite iterator count. */
-		ht->u.v.flags = HASH_FLAG_STATIC_KEYS;
+		ht->u.v.flags = prev_flags | HASH_FLAG_STATIC_KEYS;
 #if defined(__AVX2__)
 		do {
 			__m256i ymm0 = _mm256_setzero_si256();
@@ -227,7 +229,7 @@ static zend_always_inline void zend_hash_real_init_mixed_ex(HashTable *ht)
 	}
 	ht->nTableMask = HT_SIZE_TO_MASK(nSize);
 	HT_SET_DATA_ADDR(ht, data);
-	HT_FLAGS(ht) = HASH_FLAG_STATIC_KEYS;
+	HT_FLAGS(ht) = prev_flags | HASH_FLAG_STATIC_KEYS;
 	HT_HASH_RESET(ht);
 }
 

ext/zend_test/test.c

@@ -73,6 +73,24 @@ static zend_class_entry *zend_test_int_enum;
 static zend_class_entry *zend_test_magic_call;
 static zend_object_handlers zend_test_class_handlers;
 
+static ZEND_FUNCTION(zend_test_gh12986)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+	HashTable *ht = _zend_new_array_0();
+	// The HT_ALLOW_COW_VIOLATION() macro is a noop in non-debug builds,
+	// so we have to set the flag directly.
+	HT_FLAGS(ht) |= HASH_FLAG_ALLOW_COW_VIOLATION;
+	zval value;
+	ZVAL_LONG(&value, 1);
+	zend_hash_next_index_insert(ht, &value);
+	if (HT_FLAGS(ht) & HASH_FLAG_ALLOW_COW_VIOLATION) {
+		php_printf("OK: HASH_FLAG_ALLOW_COW_VIOLATION is preserved by zend_hash_real_init_ex\n");
+	} else {
+		php_printf("KO: HASH_FLAG_ALLOW_COW_VIOLATION was cleared by zend_hash_real_init_ex\n");
+	}
+	zend_array_release(ht);
+}
+
 static int le_throwing_resource;
 
 static ZEND_FUNCTION(zend_test_func)

ext/zend_test/test.stub.php

@@ -246,6 +246,8 @@ function zend_test_override_libxml_global_state(): void {}
 #endif
 
     function zend_test_is_pcre_bundled(): bool {}
+
+    function zend_test_gh12986(): void {}
 }
 
 namespace ZendTestNS {

ext/zend_test/tests/gh12986.phpt

@@ -0,0 +1,12 @@
+--TEST--
+GH-12986 (HASH_FLAG_ALLOW_COW_VIOLATION is not preserved by zend_hash_real_init_ex)
+--EXTENSIONS--
+zend_test
+--FILE--
+<?php
+
+zend_test_gh12986();
+
+?>
+--EXPECT--
+OK: HASH_FLAG_ALLOW_COW_VIOLATION is preserved by zend_hash_real_init_ex