[php-src] Issue #10085: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
| From: | Changochen | Date: | Mon, 12 Dec 2022 05:29:40 +0000 |
| Subject: | [php-src] Issue #10085: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed. | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243101@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10085
Author: Changochen
### Description
The following code:
```php
<?[$i]=$i[]=$i=&$Yhh;$i[$m==$i[]=$i];$h=$i[$m==$i[]=0]+=$Yhh;
```
Resulted in this output:
```
Zend/zend_hash.c:1007: zval *_zend_hash_index_add_or_update_i(HashTable *, zend_ulong, zval *,
uint32_t): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags &
(1<<6))' failed.
```
Reproduce steps:
```bash
./configure --disable-all --enable-address-sanitizer --disable-phpdbg --disable-cgi --with-pic
--enable-debug-assertions
make -j
./sapi/cli/php -f poc.php
```
PS: Without the debug assertions, the poc doesn't trigger a crash or abort by sanitizer.
### PHP Version
PHP 8.3.0-dev
### Operating System
Ubuntu 20.04