Repository navigation
Zend GC assertion failure in gc_check_possible_root_no_ref with lazy proxy #20861
Description
Description
The following code:
<?php
class A {
public $_;
public function __get($n) {
global $obj;
$obj->f =& $this->b;
static $a = $a;
foreach (get_defined_vars() as $k => $v) {}
foreach (get_defined_vars() as $k => $v) {}
}
}
class B extends A {}
$rc = new ReflectionClass(B::class);
$obj = $rc->newLazyProxy(fn() => new A);
$rc->initializeLazyObject($obj)->p;Resulted in this output:
php: /path/to/php-src/Zend/zend_gc.h:105: gc_check_possible_root_no_ref: Assertion `(ref)->gc.u.type_info != (10 | ((1<<4) << 0))' failed.
Aborted
Commit
643cf6253e5
Configurations
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-picPHP Version
PHP 8.6.0-dev (cli) (built: Jan 8 2026 01:22:30) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System
Ubuntu 22.04
Activity
devnexen commentedon Jan 7, 2026
another case of lazy object but this time is due to
$obj->f =& $this->b;the assertion crashes before the exception has any chance to throwi.e. I trick the vm using zend_assign_to_variable_ex just for the sake of the demonstration.
devnexen commentedon Jan 7, 2026
iluuu1994 commentedon Jan 9, 2026
This is probably another variation of GH-20854. From what I can see, the same guard confusion arises.
ndossche commentedon Oct 25, 2026
No longer reproduces, this is likely indeed a variant.