Assertion failure with ext/date DateInterval property hash construction

Description

The following code:

<?
for ($i = 0; $i <= 2; $j++) {
    $a[] = $$x[ ! 0] = $obj = new DateInterval('P1W');
    $a = false;
    $aniay['abc'] = $obj->prop3 = $y = (array)   $a[] =& $  $u; 
    $$x[$key]-= $aniay['abc'] = $a === $ao = new ArrayObject();
    var_dump(json_decode(json_encode($a), '1000001'));
}

Resulted in this output:

php: /path/to/php-src/Zend/zend_hash.c:912: _zend_hash_str_add_or_update_i: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted

Commit:

035f95cf5e016236cca11bc293dc04d40b40e45c

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 16 2025 19:51:33) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

Build PHP at commit 035f95cf5e016236cca11bc293dc04d40b40e45c with the provided debug and AddressSanitizer configuration, then run the reproducer. Inspect the assertion at Zend/zend_hash.c:912 and the ext/date DateInterval behavior; done means the reproducer no longer aborts and the failure has regression coverage.