zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed upon memory exhaustion

Description

The following code:

<?php
class Node {
    public $parent = NULL;
    public $children = array();

    function __construct(?Node $parent=NULL) {
        if ($parent) {
            $parent->children[] = $this;
        }
        $this->children[] = $this;
    }

    function __destruct() {
        $this->children = NULL;
    }
}

define("MAX", 16);

for ($n = 0; $n < 20; $n++) {
    $top = new Node();
    for ($i=0 ; $i<MAX ; $i++) {
        $ci = new Node($top);
        for ($j=0 ; $j<MAX ; $j++) {
            $cj = new Node($ci);
            for ($k=0 ; $n ?? (0 >> $i) & $n ?? $n ?? 20 ?? MAX<MAX ; $k++) {
                $ck = new Node($cj);
            }
        }
    }
    echo "$n\n";
}
echo "ok\n";
?>

Resulted in this output:

0

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27
Stack trace:
#0 {main}
php: /home/user/software/php-debug-noasan/src/Zend/zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed.
Aborted (core dumped)

But I expected this output instead:

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27

This bug seems to be dependent on how much memory you give php, through grid searching I found these values of memory trigger the bug

93M, 94M, 127M, 128M, 159M, 160M, 193M-196M, 243M-248M, 287M-290M, 333M-338M, 383M-390M

Looks very similar to https://github.com/php/php-src/issues/16835 but unsure about same root cause

PHP Version

PHP 8.5.10 (cli) (built: Sep  5 2026 19:25:14) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies

34308a6666b2d489c509541ea9befea9e2b42348

Operating System

Ubuntu 24.04

Commencez par exécuter le reproducteur PHP fourni avec le build de débogage et les limites mémoire indiqués. Examinez Zend/zend_gc.c à la ligne 356 et zend_types.h à la ligne 1383, puis comparez le comportement avec l’issue #16835. Le travail est terminé lorsque l’épuisement de la mémoire signale le fatal error sans déclencher la refcount assertion ni provoquer l’abandon du processus.