Assertion failure when freeing rvalue of ASSIGN_OBJ with typed refs and __toString()

Open
#20,316 0 comments 0 reactions 1 assignee View on GitHub

@arnaud-lb is already working on this.

Since Oct 28, 2025.

Assessment

This issue has not been assessed yet.

Description

Bug Status: Needs Triage
Description

The following code:

<?php

class C {
    public string $a = '';
    public $b;
    function __toString() {
        global $c; // turns rvalue into a ref
        return '';
    }
}

$c = new C;
$c->b = &$c->a;
$c->b = $c;

Resulted in this output:

zend_execute.c:4093: i_zval_ptr_dtor_noref: Assertion `zval_get_type(&(*(zval_ptr))) != 10' failed.

Root cause is that we call zend_assign_to_variable_ex() / zend_assign_to_typed_ref_ex() with value_type=IS_TMP_VAR, when value may be a CV slot here: https://github.com/php/php-src/blob/02c67b47f728f915e6015c2fd52c6e1f7a27b172/Zend/zend_object_handlers.c#L875-L876

Therefore the slot may have been modified when reaching this call: https://github.com/php/php-src/blob/02c67b47f728f915e6015c2fd52c6e1f7a27b172/Zend/zend_execute.c#L3665

With the code above, the assertion fails because orig_value is now a ref.

PHP Version
PHP 8.3
Operating System

No response

Dominant language
C
Stars
40.4k
Forks
8.2k
Avg merge
2d 15h
Merged PRs (30d)
103

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from php/php-src

All issues in php/php-src

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.