Add regression test demonstrating rehash protection during warning

Author: lacatoire

Zend/tests/gh20482_assign_dim_uaf_output_handler_rehash.phpt

@@ -0,0 +1,29 @@
+--TEST--
+GH-20482: ZEND_ASSIGN_DIM survives a hash table rehash forced by the output handler during the undefined-variable warning
+--FILE--
+<?php
+$a = ['existing' => 0];
+
+ob_start(function () use (&$a) {
+    // Force several rehashes by adding many keys; the previously-allocated
+    // bucket for $a['target'] (if it had been pre-fetched) would now point
+    // into freed/relocated memory.
+    for ($i = 0; $i < 64; $i++) {
+        $a["k$i"] = $i;
+    }
+    return '';
+}, 1);
+
+// Triggers "Undefined variable" -> output handler -> rehash. Without the
+// fix the previously-fetched bucket pointer would be stale; with the fix
+// variable_ptr is fetched fresh after the warning.
+$a['target'] = $undef;
+
+ob_end_clean();
+var_dump($a['target'], count($a));
+echo "ok\n";
+?>
+--EXPECT--
+NULL
+int(66)
+ok