Assertion failure when array poping a self addressing variable

[YuanchengJiang]

Description

The following code:

<?php
$input[] = &$input;
array_pop($input);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1520: void zend_hash_packed_del_val(HashTable *, zval *): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

[nielsdos]

We had smth similar with array_shift; I fixed it back then so I'll have a look at this soon.