(cherry picked from commit 448c9be157f4147e121f1a2a524536c75c9c6059)

(cherry picked from commit ed9d916c28b042d276a28998f92eb7e6cc56025a)

When using the php_serialize session serialization handler, do
not use the result of the unserialization if it failed.

(cherry picked from commit e0f9fbdfa61012101de7f4a8653ca5538c404a71)

If a (nested) unserialize() call fails, we remove all the values
that were inserted into var_hash during that call. This prevents
their use in other unserializations in the same context.

(cherry picked from commit 61f2f5a0f760157f9c9d32d7d3df2be47a73e74d)

Don't call __destruct() on an unserialized object that has a
__wakeup() method if either
a) unserialization of its properties fails or
b) the __wakeup() call fails (e.g. by throwing).

This basically treats __wakeup() as a form of constructor and
aligns us with the usual behavior that if the constructor call
fails the destructor should not be called.

The security aspect here is that people use __wakeup() to prevent
unserialization of objects with dangerous __destruct() methods,
but this is ineffective if __destruct() can still be called while
__wakeup() was skipped.

(cherry picked from commit 2135fdef9b588a34f8805b2bbf10704e36163d5a)

(cherry picked from commit 659a21dc20f0b64dafd8cb16573059d3b45cce6b)

Conflicts:
	ext/wddx/wddx.c

(cherry picked from commit e3829b88694460a2e5af10ad5eee9966fa55e589)