Separate the storage of ArrayObject and ArrayIterator from the payload

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this extension will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- `deepclone_to_array()` separates the storage that `ArrayObject` and
+  `ArrayIterator` return from `__serialize()`, as these classes write to it in
+  place: changing such an object after the call changed the payload too.
+
 ## [0.8.7] - 2026-09-30
 
 ### Fixed

deepclone.c

@@ -61,6 +61,7 @@
 #include "Zend/zend_interfaces.h"
 #include "ext/spl/spl_iterators.h"
 #include "ext/spl/spl_exceptions.h"
+#include "ext/spl/spl_array.h"
 #include "ext/spl/spl_heap.h"
 #include "ext/spl/spl_observer.h"
 
@@ -3004,6 +3005,15 @@ static void dc_process_object(dc_ctx *ctx, zval *src, zval *dst, zval *mask_dst)
 			zval_ptr_dtor(&props_zval);
 			return;
 		}
+		/* ArrayObject and ArrayIterator return their storage without separating it, so that writing to the object later would change the payload */
+		if (instanceof_function(ce, spl_ce_ArrayObject) || instanceof_function(ce, spl_ce_ArrayIterator)) {
+			zval *storage = zend_hash_index_find(Z_ARRVAL(retval), 1);
+			if (storage && Z_TYPE_P(storage) == IS_ARRAY && Z_REFCOUNTED_P(storage) && Z_REFCOUNT_P(storage) > 1) {
+				SEPARATE_ARRAY(&retval);
+				storage = zend_hash_index_find(Z_ARRVAL(retval), 1);
+				SEPARATE_ARRAY(storage);
+			}
+		}
 		if (has_unserialize) {
 			zval_ptr_dtor(&props_zval);
 			ZVAL_COPY_VALUE(&props_zval, &retval);

tests/deepclone_to_array_spl_array_storage.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Writing to an ArrayObject or ArrayIterator after deepclone_to_array() leaves the payload unchanged
+--EXTENSIONS--
+deepclone
+--FILE--
+<?php
+
+$ao = new ArrayObject([1, 'list' => [1]]);
+$ai = new RecursiveArrayIterator([1]);
+$empty = new ArrayObject([1]);
+unset($empty[0]);
+$data = deepclone_to_array([$ao, $ai, $empty]);
+
+$ao[] = 2;
+$ao['list'][] = 2;
+$ai[] = 2;
+$empty[] = 2;
+
+$clone = deepclone_from_array($data);
+var_dump($clone[0]->getArrayCopy() === [1, 'list' => [1]]);
+var_dump($clone[1]->getArrayCopy() === [1]);
+var_dump($clone[2]->getArrayCopy() === []);
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)