Assertion failure in gc with invalid variable (OOM)

Description

The following code:

<?php
$cls = new finfo();
class foo {
    public $x;
    static public $y;
    public function a() {
        return $this->x;
    }
    static public function b() {
        return self::$y;
    }
}
$foo = new foo;
$h = $foo->a()[0]->a;
$h = foo::b()[1]->b;
var_dump($h);
$fusion = $h;
$base = curl_init('http://www.google.com/');
curl_setopt($base, CURLOPT_RETURNTRANSFER, true);
$mh = curl_multi_init();
for ($i = 0; $fusion < 2; ++$i) {
    $ch = curl_copy_handle($base);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Foo: Bar']);
    curl_multi_add_handle($mh, $ch);
}
?>

Resulted in this output:

php: Zend/zend_types.h:1346: uint32_t zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

ubuntu 22.04

Start by running the supplied PHP reproducer with a nightly build on Ubuntu 22.04, then inspect the assertion in Zend/zend_types.h at line 1346. Trace the invalid variable and reference-count changes through the reproducer; done means the script no longer aborts with the zend_gc_delref assertion.