zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed upon memory exhaustion

Description

The following code:

<?php
class Node {
    public $parent = NULL;
    public $children = array();

    function __construct(?Node $parent=NULL) {
        if ($parent) {
            $parent->children[] = $this;
        }
        $this->children[] = $this;
    }

    function __destruct() {
        $this->children = NULL;
    }
}

define("MAX", 16);

for ($n = 0; $n < 20; $n++) {
    $top = new Node();
    for ($i=0 ; $i<MAX ; $i++) {
        $ci = new Node($top);
        for ($j=0 ; $j<MAX ; $j++) {
            $cj = new Node($ci);
            for ($k=0 ; $n ?? (0 >> $i) & $n ?? $n ?? 20 ?? MAX<MAX ; $k++) {
                $ck = new Node($cj);
            }
        }
    }
    echo "$n\n";
}
echo "ok\n";
?>

Resulted in this output:

0

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27
Stack trace:
#0 {main}
php: /home/user/software/php-debug-noasan/src/Zend/zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed.
Aborted (core dumped)

But I expected this output instead:

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27

This bug seems to be dependent on how much memory you give php, through grid searching I found these values of memory trigger the bug

93M, 94M, 127M, 128M, 159M, 160M, 193M-196M, 243M-248M, 287M-290M, 333M-338M, 383M-390M

Looks very similar to https://github.com/php/php-src/issues/16835 but unsure about same root cause

PHP Version

PHP 8.5.10 (cli) (built: Sep  5 2026 19:25:14) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies

34308a6666b2d489c509541ea9befea9e2b42348

Operating System

Ubuntu 24.04

まず、報告されているデバッグビルドとメモリ制限で、提供された PHP リプロデューサーを実行します。Zend/zend_gc.c の 356 行目と zend_types.h の 1383 行目を調べ、その後、issue #16835 と動作を比較します。メモリ枯渇時に refcount assertion を発生させたり abort したりせず、fatal error が報告されれば完了です。