Assertion failure zend_reference_destroy()

Description

The following code:

<?php
$xml = '<a><b></b></a>';
$o1 = new SimpleXMlElement($xml);
$o2 = clone $o1;
$r = current($o2->xpath('/a'));
$fusion = $r;
class C {
public int $a = 1;
}
function test(string $name, object $obj) {
$ref = &$obj->a;
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
});
test('Ghost', $obj);
test('Proxy', $fusion);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:73: void zend_reference_destroy(zend_reference *): Assertion `!((ref)->sources.ptr != ((void*)0))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

Simplified:

<?php
$o1 = new SimpleXMlElement('<a/>');
class C {
    public int $a = 1;
}
function test($obj) {
    $ref =& $obj->a;
}
$obj = new C;
test($obj);
test($o1);

EDIT: this strongly looks like a cache slot issue

The call for zend_handle_fetch_obj_flags is not guarded by a CE check, which is what causes this issue.

Fix phpGH-17736: Assertion failure zend_reference_destroy()

Fix GH-17736: Assertion failure zend_reference_destroy()

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4'

Navigation Menu

Repository navigation

Assertion failure zend_reference_destroy() #17736

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Assertion failure zend_reference_destroy() #17736

Description

Description

PHP Version

Operating System

Activity

ndossche commented on Feb 8, 2025

ndossche commented on Feb 8, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions