Assertion failure `zend_weakref_unregister(zend_object *, void *, _Bool): Assertion 'tagged_ptr && "Weakref not registered?"' failed`

Description

The following code:

<?php
try {
function garbageCollectionTrigger() {
for ($i = 0; $i < 10000; $i++) {
$obj = new stdClass();
$weakReferences[] = WeakReference::create($obj);
garbageCollectionTrigger();
$root = $document->createElement('root');
$document = new DomDocument();
}
gc_collect_cycles();
}
garbageCollectionTrigger();
} catch (\Throwable $_ffl_e) {}

Resulted in this output:

php: /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_weakrefs.c:126: void zend_weakref_unregister(zend_object *, void *, _Bool): Assertion `tagged_ptr && "Weakref not registered?"' failed.
Aborted (core dumped)

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php  ./test.php

Commit:

9dc29aafa5eecc71a9f9e2c7607b588597a91810

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This bug was found by fusion-fuzz

PHP Version

nightly

Operating System

No response

Beginne bei Zend/zend_weakrefs.c ungefähr in Zeile 126 und führe den bereitgestellten test.php-Befehl gegen den Commit 9dc29aafa5eecc71a9f9e2c7607b588597a91810 mit der aufgeführten Debug- und Sanitizer-Konfiguration aus. Verfolge die Interaktionen von WeakReference und Garbage Collection, die zur Assertion führen, und füge anschließend einen Regressionstest hinzu oder identifiziere einen, der zeigt, dass der Reproducer nicht mehr abbricht.