Skip to content

Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset() #20504

Closed

Description

@vi3tL0u1s

Description

The following code:

<?php
#[AllowDynamicProperties]
class RealInstance {
    public $_;
    public function ___isset($name) {
        return isset($this->$name['']);
    }
}
class Proxy extends RealInstance {
    public function __isset($name) {
        return isset($this->$name['']);
    }
}
$rc = new ReflectionClass(Proxy::class);
$obj = $rc->newLazyProxy(function () {
    return new RealInstance;
});
var_dump(isset($obj->$name['']));

Resulted in this output:

php: /path/to/php-src/Zend/zend_object_handlers.c:620: zend_get_property_guard: Assertion `zobj->ce->ce_flags & (1 << 30)' failed.
Aborted

Commit:

035f95cf5e016236cca11bc293dc04d40b40e45c

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 16 2025 19:51:33) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

Activity

  1. self-assigned this
    on Nov 16, 2025
  2. added a commit that references this issue on Feb 3, 2026
    de26827
  3. arnaud-lb commented on Feb 3, 2026

    @arnaud-lb
    Member

    Thank you @vi3tL0u1s!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions