Assertion failure zend_reference_destroy()

[YuanchengJiang]

Description

The following code:

<?php
$xml = '<a><b></b></a>';
$o1 = new SimpleXMlElement($xml);
$o2 = clone $o1;
$r = current($o2->xpath('/a'));
$fusion = $r;
class C {
public int $a = 1;
}
function test(string $name, object $obj) {
$ref = &$obj->a;
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
});
test('Ghost', $obj);
test('Proxy', $fusion);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:73: void zend_reference_destroy(zend_reference *): Assertion `!((ref)->sources.ptr != ((void*)0))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

[nielsdos]

Simplified:

<?php
$o1 = new SimpleXMlElement('<a/>');
class C {
    public int $a = 1;
}
function test($obj) {
    $ref =& $obj->a;
}
$obj = new C;
test($obj);
test($o1);

EDIT: this strongly looks like a cache slot issue

[nielsdos]

The call for zend_handle_fetch_obj_flags is not guarded by a CE check, which is what causes this issue.