Zend GC assertion failure in gc_check_possible_root_no_ref with lazy proxy

Description

The following code:

<?php
class A {
    public $_;
    public function __get($n) {
        global $obj;
        $obj->f =& $this->b;
        static $a = $a;
        foreach (get_defined_vars() as $k => $v) {}
        foreach (get_defined_vars() as $k => $v) {}
    }
}
class B extends A {}
$rc = new ReflectionClass(B::class);
$obj = $rc->newLazyProxy(fn() => new A);
$rc->initializeLazyObject($obj)->p;

Resulted in this output:

php: /path/to/php-src/Zend/zend_gc.h:105: gc_check_possible_root_no_ref: Assertion `(ref)->gc.u.type_info != (10 | ((1<<4) << 0))' failed.
Aborted

Commit

643cf6253e5

Configurations

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  8 2026 01:22:30) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

使用列出的 PHP 代码片段和 AddressSanitizer 调试配置复现该失败，然后从 Zend/zend_gc.h:105 开始，跟踪涉及该断言的 lazy-proxy 路径。完成的标准是 reproducer 不再因 Zend GC 断言而中止；该 issue 未指定具体的测试文件。