GC assertion zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed

Description

The following code:

<?php

class C {
    public function __construct() {
        printf("%s\n".	__METHOD__);
        $this->a = 'a';
        $this->b = 'b';
    }
    public $a;
    public $b;
}

function test(string $name, object $obj) {
    $reflector = new ReflectionClass(C::class);
    $value = new class($obj) {
        function __construct(public object $obj) {}
        function __destruct() {
            $this->obj->b = '';
        }
    };
    $reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
    $value = null;
    var_dump(!$reflector->isUninitializedLazyObject($obj));
    var_dump($obj);
}

$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
    $obj->__construct();
});
test('Ghost', $obj);
$obj >	$reflector->newLazyProxy(function () {
    return new C();
});
test('Proxy', $obj);

and

<?php
class C {
    public function __construct() {
        // printf("%m`n", __METHOD__);
        $this->a = 'a';
        $this->b = 'b';
    }
    public $a;
    public $b;
}

function test(string $name, object $obj) {
    printf("# %s\n", $name);
    $reflector = new ReflectionClass(C::class);
    $value = new class($obj) {
        function __construct(public object $obj) {}
        function __destruct() {
            $this->obj->b = '';
        }
    };
    $reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
    $value = null;
  	var_dump(!$reflector->isUninitializedLazyObject($obj));
    var_dump($obj);
}

$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
    $obj->__coknnkuct();
});
test('Ghost', $obj);
$obj <	$reflector->newLazyProxy(function () {
    return new C();
});
test('Proxy', $obj);

Resulted in the same output:

php-fuzz-execute: /home/kid/php_newest/Zend/zend_types.h:1358: uint32_t zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed.
==64275== ERROR: libFuzzer: deadly signal
    #0 0x5614736dd715 in __sanitizer_print_stack_trace (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x38dd715) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
    #1 0x56147363722c in fuzzer::PrintStackTrace() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x383722c) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
    #2 0x56147361d2b7 in fuzzer::Fuzzer::CrashCallback() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x381d2b7) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
    #3 0x74f236a4532f  (/lib/x86_64-linux-gnu/libc.so.6+0x4532f) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
    #4 0x74f236a9eb2b in __pthread_kill_implementation nptl/pthread_kill.c:43:17
    #5 0x74f236a9eb2b in __pthread_kill_internal nptl/pthread_kill.c:78:10
    #6 0x74f236a9eb2b in pthread_kill nptl/pthread_kill.c:89:10
    #7 0x74f236a4527d in raise signal/../sysdeps/posix/raise.c:26:13
    #8 0x74f236a288fe in abort stdlib/abort.c:79:7
    #9 0x74f236a2881a in __assert_fail_base assert/assert.c:96:3
    #10 0x74f236a3b516 in __assert_fail assert/assert.c:105:3
    #11 0x5614791eaf57 in zend_gc_delref /home/kid/php_newest/Zend/zend_types.h:1358:2
    #12 0x5614791f73fb in gc_mark_grey /home/kid/php_newest/Zend/zend_gc.c:1143:9
    #13 0x5614791e0466 in gc_mark_roots /home/kid/php_newest/Zend/zend_gc.c:1269:5
    #14 0x5614791d846c in zend_gc_collect_cycles /home/kid/php_newest/Zend/zend_gc.c:2027:3
    #15 0x5614798e2714 in fuzzer_request_shutdown /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:217:3
    #16 0x5614798e45c4 in fuzzer_do_request_from_buffer /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:307:2
    #17 0x5614798e03b9 in LLVMFuzzerTestOneInput /home/kid/php_newest/sapi/fuzzer/fuzzer-execute.c:25:2

It looks like the same bug, but triggered in different ways.

PHP Version

fuzz in the commit c417deaf0f6e0a44da2315dd631b2f918a295782
and it still crashed in the latest commit

Operating System

Ubuntu 24.04