Assertion failure in zend_hash_del with HashTable refcount inconsistency

Description

The following code:

<?php
$c = new ReflectionClass('stdClass');
ob_start(fn() => serialize($GLOBALS), 1);
$array = [$c];
unset($array[$x]);

php: /path/to/php-src/Zend/zend_hash.c:1556: zend_hash_del: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted

Commit

5472cac806a

Configurations

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  7 2026 13:33:43) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

zend/zend_hash.c:1556 の reproducer と assertion から始めます。提供されている debug および AddressSanitizer の設定で PHP をビルドし、その後スクリプトを実行して HashTable の参照カウントの不整合を調査します。この assertion で reproducer が abort しなくなれば完了です。