Fix #81992: SplFixedArray::setSize() causes use-after-free

Upon resizing, the elements are destroyed from lower index to higher
index. When an element refers to an object with a destruct

Fix #81992: SplFixedArray::setSize() causes use-after-free

Upon resizing, the elements are destroyed from lower index to higher
index. When an element refers to an object with a destructor, it can
refer to a lower (i.e. already destroyed) element, causing a uaf.
Set refcounted zvals to NULL after destroying them to avoid a uaf.

Closes GH-11959.

show more ...