Repository navigation
Assertion failure in WeakMap offset operations on reference #20073
Description
Description
The following code:
<?php
$obj = new stdClass;
$map = new WeakMap;
$map[$obj] = 0;
$map[$obj] = // /a[0] /N//@ //'//y['///@// rsort($a)z,= $ 2 $Z// $d,
& $a ===//q// b $$obj2, 43));
var_dump($map->offsetGet($obj ));
var_dump($map->offsetExists($obj ));
?>Resulted in this output:
php: Zend/zend_vm_execute.h:2165: const zend_op *ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER(zend_execute_data *, const zend_op *): Assertion `(call->func->common.fn_flags & (1 << 12)) ? (zval_get_type(&(*(ret))) == 10) : !(zval_get_type(&(*(ret))) == 10)' failed.
Aborted
Commit
c39c880824e
Configurations
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-picPHP Version
PHP 8.5.0-dev (cli) (built: Oct 6 2025 14:06:35) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.5.0-dev, Copyright (c), by Zend Technologies
Operating System
Ubuntu 22.04
Activity
ndossche commentedon Oct 6, 2025
Not looked in detail yet, but this should probably use the _DEREF variant:
php-src/Zend/zend_weakrefs.c
Line 734 in c39c880
While at it, use RETURN_COPY_DEREF
I could do it this evening.
[-]Assertion failure in WeakMap offset operations[/-][+]Assertion failure in WeakMap offset operations on reference[/+]Fix phpGH-20073: Assertion failure in WeakMap offset operations on re…
Fix GH-20073: Assertion failure in WeakMap offset operations on refer…
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4' into PHP-8.5
Merge branch 'PHP-8.5'