Io\Poll use-after-free

### Description Originally reported by @P0cas, please credit in test. The following code: ```php <?php [$reader, $writer] = stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, 0); $context = new Io\Poll\Context(Io\Poll\Backend::Epoll); $handle = new StreamPollHandle($reader); $first = $context->add($handle, [Io\Poll\Event::Read]); $first->remove(); // Backend registration succeeds, but the Context hash insertion collides // with $first and its failure is ignored. $second = $context->add($handle, [Io\Poll\Event::Read]); // Only $first is invalidated before php_poll_ctx is freed. unset($context); // $second still has active=true and the freed php_poll_ctx pointer. $second->remove(); ``` Resulted in this output: ``` ==269199==ERROR: AddressSanitizer: heap-use-after-free on address 0x71b5415f3884 at pc 0x5aa806efc8b9 bp 0x7ffdaec76160 sp 0x7ffdaec76158 READ of size 1 at 0x71b5415f3884 thread T0 #0 0x5aa806efc8b8 in php_poll_remove /home/ilutov/Developer/php-src/main/poll/poll_core.c:282 #1 0x5aa806be9f56 in zim_Io_Poll_Watcher_remove /home/ilutov/Developer/php-src/ext/standard/io_poll.c:643 ``` ### PHP Version ```plain master ``` ### Operating System _No response_