Assertion failure in zend_hash_del with HashTable refcount inconsistency
Open
Nobody has claimed this yet.
Bug
Extension: standard
Status: Verified
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?php
$c = new ReflectionClass('stdClass');
ob_start(fn() => serialize($GLOBALS), 1);
$array = [$c];
unset($array[$x]);
php: /path/to/php-src/Zend/zend_hash.c:1556: zend_hash_del: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted
Commit
5472cac806a
Configurations
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic
PHP Version
PHP 8.6.0-dev (cli) (built: Jan 7 2026 13:33:43) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System
Ubuntu 22.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reproducer and the assertion at zend/zend_hash.c:1556. Build PHP with the provided debug and AddressSanitizer configuration, then run the script to investigate the HashTable reference-count inconsistency. Done means the reproducer no longer aborts at this assertion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100