Assertion failure `zend_weakref_unregister(zend_object *, void *, _Bool): Assertion 'tagged_ptr && "Weakref not registered?"' failed`

Description

The following code:

<?php
try {
function garbageCollectionTrigger() {
for ($i = 0; $i < 10000; $i++) {
$obj = new stdClass();
$weakReferences[] = WeakReference::create($obj);
garbageCollectionTrigger();
$root = $document->createElement('root');
$document = new DomDocument();
}
gc_collect_cycles();
}
garbageCollectionTrigger();
} catch (\Throwable $_ffl_e) {}

Resulted in this output:

php: /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_weakrefs.c:126: void zend_weakref_unregister(zend_object *, void *, _Bool): Assertion `tagged_ptr && "Weakref not registered?"' failed.
Aborted (core dumped)

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php  ./test.php

Commit:

9dc29aafa5eecc71a9f9e2c7607b588597a91810

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This bug was found by fusion-fuzz

PHP Version

nightly

Operating System

No response

Bắt đầu với Zend/zend_weakrefs.c quanh dòng 126 và chạy lệnh test.php đã cung cấp trên commit 9dc29aafa5eecc71a9f9e2c7607b588597a91810 bằng cấu hình debug và sanitizer được liệt kê. Theo dõi các tương tác giữa WeakReference và quá trình garbage collection dẫn đến assertion, sau đó thêm hoặc xác định một regression test cho thấy reproducer không còn bị abort.