Zend GC assertion failure in gc_check_possible_root_no_ref with lazy proxy

[vi3tL0u1s]

Description

The following code:

<?php
class A {
    public $_;
    public function __get($n) {
        global $obj;
        $obj->f =& $this->b;
        static $a = $a;
        foreach (get_defined_vars() as $k => $v) {}
        foreach (get_defined_vars() as $k => $v) {}
    }
}
class B extends A {}
$rc = new ReflectionClass(B::class);
$obj = $rc->newLazyProxy(fn() => new A);
$rc->initializeLazyObject($obj)->p;

Resulted in this output:

php: /path/to/php-src/Zend/zend_gc.h:105: gc_check_possible_root_no_ref: Assertion `(ref)->gc.u.type_info != (10 | ((1<<4) << 0))' failed.
Aborted

Commit

643cf6253e5

Configurations

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  8 2026 01:22:30) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[devnexen]

another case of lazy object but this time is due to $obj->f =& $this->b; the assertion crashes before the exception has any chance to throw

Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in /home/dcarlier/Contribs/php-src/c.php:6
Stack trace:
#0 /home/dcarlier/Contribs/php-src/c.php(6): A->__get('b')
#1 /home/dcarlier/Contribs/php-src/c.php(15): A->__get('p')
#2 {main}

i.e. I trick the vm using zend_assign_to_variable_ex just for the sake of the demonstration.

[devnexen]

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff6845e2e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff6828888 in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff68287f0 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:118
#6  0x000055555d452051 in gc_check_possible_root_no_ref (ref=0x7bfff2801f80) at Zend/zend_gc.h:105
#7  0x000055555e0c8c0c in zend_assign_to_variable (variable_ptr=0x7bfff2801f88, value=0x7bfff28722a0, value_type=8 '\b', strict=false) at Zend/zend_execute.h:183
#8  0x000055555dd7494b in ZEND_FE_FETCH_R_SPEC_VAR_TAILCALL_HANDLER (execute_data=0x7bfff2807500, opline=0x7bfff28773f0) at Zend/zend_vm_execute.h:79125
#9  0x000055555d46d93f in execute_ex (ex=0x7bfff2807500) at Zend/zend_vm_execute.h:116212
#10 0x000055555d40d698 in zend_call_function (fci=0x7bfff3b0a640, fci_cache=0x7bfff3b0a6a0) at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1010
#11 0x000055555d412c1b in zend_call_known_function (fn=0x7bfff288b140, object=0x7bfff287a2a0, called_scope=0x7bfff2891280, retval_ptr=0x7bfff2807460, param_count=1, params=0x7bfff395df20, named_params=0x0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1104
#12 0x000055555e550f03 in zend_call_known_instance_method (fn=0x7bfff288b140, object=0x7bfff287a2a0, retval_ptr=0x7bfff2807460, param_count=1, params=0x7bfff395df20) at Zend/zend_API.h:860
#13 0x000055555e52a412 in zend_call_known_instance_method_with_1_params (fn=0x7bfff288b140, object=0x7bfff287a2a0, retval_ptr=0x7bfff2807460, param=0x7bfff395df20) at Zend/zend_API.h:872
#14 0x000055555e52221d in zend_std_call_getter (zobj=0x7bfff287a2a0, prop_name=0x7c2ff4de2f80, retval=0x7bfff2807460) at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:245
#15 0x000055555e51db4a in zend_std_read_property (zobj=0x7bfff287a2a0, name=0x7c2ff4de2f80, type=1, cache_slot=0x7bfff287a1e0, rv=0x7bfff2807460)
    at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:932
#16 0x000055555e0dbab2 in zend_fetch_property_address
    (result=0x7bfff2807460, container=0x7bfff28073d0, container_op_type=0, prop_ptr=0x7bfff2877530, prop_op_type=1, cache_slot=0x7bfff287a1e0, type=1, flags=33, prop_info_p=0x0, opline=0x7bfff2877070, execute_data=0x7bfff28073b0) at /home/dcarlier/Contribs/php-src/Zend/zend_execute.c:3616
#17 0x000055555ddb4285 in ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_TAILCALL_HANDLER (execute_data=0x7bfff28073b0, opline=0x7bfff2877070) at Zend/zend_vm_execute.h:90255
#18 0x000055555d46d93f in execute_ex (ex=0x7bfff28073b0) at Zend/zend_vm_execute.h:116212
#19 0x000055555d40d698 in zend_call_function (fci=0x7bfff3b0a440, fci_cache=0x7bfff3b0a4a0) at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1010
#20 0x000055555d412c1b in zend_call_known_function (fn=0x7bfff288b140, object=0x7bfff287a2a0, called_scope=0x7bfff2891280, retval_ptr=0x7bfff3a7fca0, param_count=1, params=0x7bfff395de20, named_params=0x0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1104
#21 0x000055555e550f03 in zend_call_known_instance_method (fn=0x7bfff288b140, object=0x7bfff287a2a0, retval_ptr=0x7bfff3a7fca0, param_count=1, params=0x7bfff395de20) at Zend/zend_API.h:860
#22 0x000055555e52a412 in zend_call_known_instance_method_with_1_params (fn=0x7bfff288b140, object=0x7bfff287a2a0, retval_ptr=0x7bfff3a7fca0, param=0x7bfff395de20) at Zend/zend_API.h:872
#23 0x000055555e52221d in zend_std_call_getter (zobj=0x7bfff287a2a0, prop_name=0x7c2ff4de3040, retval=0x7bfff3a7fca0) at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:245
#24 0x000055555e51db4a in zend_std_read_property (zobj=0x7bfff287a2a0, name=0x7c2ff4de3040, type=1, cache_slot=0x7bfff287a1c8, rv=0x7bfff3a7fca0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:932
#25 0x000055555e0dbab2 in zend_fetch_property_address
    (result=0x7bfff3a7fca0, container=0x7bfff2801d48, container_op_type=4, prop_ptr=0x7bfff2877520, prop_op_type=1, cache_slot=0x7bfff287a1c8, type=1, flags=0, prop_info_p=0x7bfff3a7fce0, opline=0x7bfff28770e0, execute_data=0x7bfff2807260) at /home/dcarlier/Contribs/php-src/Zend/zend_execute.c:3616
#26 0x000055555e0d82db in zend_assign_to_property_reference
    (container=0x7bfff28072c0, container_op_type=4, prop_ptr=0x7bfff2877520, prop_op_type=1, value_ptr=0x7bfff2807320, opline=0x7bfff28770e0, execute_data=0x7bfff2807260)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute.c:3659
#27 0x000055555e0d7e84 in zend_assign_to_property_reference_var_const (container=0x7bfff28072c0, prop_ptr=0x7bfff2877520, value_ptr=0x7bfff2807320, opline=0x7bfff28770e0, execute_data=0x7bfff2807260)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute.c:3699
#28 0x000055555dc717d3 in ZEND_ASSIGN_OBJ_REF_SPEC_CV_CONST_OP_DATA_VAR_TAILCALL_HANDLER (execute_data=0x7bfff2807260, opline=0x7bfff28770e0) at Zend/zend_vm_execute.h:101229
#29 0x000055555d46d93f in execute_ex (ex=0x7bfff2807260) at Zend/zend_vm_execute.h:116212
#30 0x000055555d40d698 in zend_call_function (fci=0x7bfff3b0a040, fci_cache=0x7bfff3b0a0a0) at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1010
#31 0x000055555d412c1b in zend_call_known_function (fn=0x7bfff288b140, object=0x7bfff287a230, called_scope=0x7bfff2891000, retval_ptr=0x7bfff28071c0, param_count=1, params=0x7bfff395dd20, named_params=0x0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1104
#32 0x000055555e550f03 in zend_call_known_instance_method (fn=0x7bfff288b140, object=0x7bfff287a230, retval_ptr=0x7bfff28071c0, param_count=1, params=0x7bfff395dd20) at Zend/zend_API.h:860
#33 0x000055555e52a412 in zend_call_known_instance_method_with_1_params (fn=0x7bfff288b140, object=0x7bfff287a230, retval_ptr=0x7bfff28071c0, param=0x7bfff395dd20) at Zend/zend_API.h:872
#34 0x000055555e52221d in zend_std_call_getter (zobj=0x7bfff287a230, prop_name=0x7c2ff4de2f80, retval=0x7bfff28071c0) at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:245
#35 0x000055555e51db4a in zend_std_read_property (zobj=0x7bfff287a230, name=0x7c2ff4de2f80, type=1, cache_slot=0x7bfff287a1e0, rv=0x7bfff28071c0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_object_handlers.c:932
#36 0x000055555e0dbab2 in zend_fetch_property_address
    (result=0x7bfff28071c0, container=0x7bfff2807130, container_op_type=0, prop_ptr=0x7bfff2877530, prop_op_type=1, cache_slot=0x7bfff287a1e0, type=1, flags=33, prop_info_p=0x0, opline=0x7bfff2877070, execute_data=0x7bfff2807110) at /home/dcarlier/Contribs/php-src/Zend/zend_execute.c:3616
#37 0x000055555ddb4285 in ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_TAILCALL_HANDLER (execute_data=0x7bfff2807110, opline=0x7bfff2877070) at Zend/zend_vm_execute.h:90255
#38 0x000055555d46d93f in execute_ex (ex=0x7bfff2807110) at Zend/zend_vm_execute.h:116212
#39 0x000055555d40d698 in zend_call_function (fci=0x7bfff3b09e40, fci_cache=0x7bfff3b09ea0) at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1010
#40 0x000055555d412c1b in zend_call_known_function (fn=0x7bfff288b140, object=0x7bfff287a230, called_scope=0x7bfff2891000, retval_ptr=0x7bfff2807100, param_count=1, params=0x7bfff395dc20, named_params=0x0)
    at /home/dcarlier/Contribs/php-src/Zend/zend_execute_API.c:1104
#41 0x000055555e550f03 in zend_call_known_instance_method (fn=0x7bfff288b140, object=0x7bfff287a230, retval_ptr=0x7bfff2807100, param_count=1, params=0x7bfff395dc20) at Zend/zend_API.h:860

[iluuu1994]

This is probably another variation of GH-20854. From what I can see, the same guard confusion arises.