Assertion failure in Zend/zend_exceptions.c:630

[YuanchengJiang]

Description

The following code:

<?php
function foo($vars) {
foreach ($vars as $i => $v1) {
foreach ($vars as $j => $v2) {
try {
$reflection = new ReflectionFunction('strripos');
$result[$randomFunction][] = $reflection->invokeArgs($vars);
} catch (\Throwable $e) {
}
}
}
}
try {
new ReflectionProperty();
} catch (TypeError $re) {
}
$fusion = $re;
function apply_dumb($item, $key) {};
array_walk_recursive($fusion, 'apply_dumb');
$vars = [$re,$re,$re];
foo($vars);

Resulted in this output:

/php-src/Zend/zend_exceptions.c:630: void zim_Exception_getTraceAsString(zend_execute_data *, zval *): Assertion `zval_get_type(&(*(trace))) == 7' failed.
Aborted (core dumped)

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[DanielEScherzer]

Minimal reproduction:

<?php
$re = new TypeError();
function apply_dumb($item, $key) {};
array_walk_recursive($re, 'apply_dumb');
strripos( '', $re, 0 );

produces

root@3acd01cef279:/usr/src/php# php /var/www/html/test.php 
php: /usr/src/php/Zend/zend_exceptions.c:630: zim_Exception_getTraceAsString: Assertion `zval_get_type(&(*(trace))) == 7' failed.
Aborted

[arnaud-lb]

getTraceAsString() assumes that $re->trace is an array because of its type hint. However it may also be a reference to an array.