Zend GC assertion failure in gc_check_possible_root_no_ref with lazy proxy

Description

The following code:

<?php
class A {
    public $_;
    public function __get($n) {
        global $obj;
        $obj->f =& $this->b;
        static $a = $a;
        foreach (get_defined_vars() as $k => $v) {}
        foreach (get_defined_vars() as $k => $v) {}
    }
}
class B extends A {}
$rc = new ReflectionClass(B::class);
$obj = $rc->newLazyProxy(fn() => new A);
$rc->initializeLazyObject($obj)->p;

Resulted in this output:

php: /path/to/php-src/Zend/zend_gc.h:105: gc_check_possible_root_no_ref: Assertion `(ref)->gc.u.type_info != (10 | ((1<<4) << 0))' failed.
Aborted

Commit

643cf6253e5

Configurations

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  8 2026 01:22:30) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

Reproduce the failure using the PHP snippet and the listed debug AddressSanitizer configuration, then start at Zend/zend_gc.h:105 and trace the lazy-proxy path involved in the assertion. Done means the reproducer no longer aborts with the Zend GC assertion; no specific test file is named in the issue.