[php-src] Issue #20316: Assertion failure when freeing rvalue of ASSIGN_OBJ with typed refs and __toString()
| From: | arnaud-lb | Date: | Tue, 28 Oct 2025 12:01:03 +0000 |
| Subject: | [php-src] Issue #20316: Assertion failure when freeing rvalue of ASSIGN_OBJ with typed refs and __toString() | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-251137@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/20316
Author: arnaud-lb
### Description
The following code:
```php
<?php
class C {
public string $a = '';
public $b;
function __toString() {
global $c; // turns rvalue into a ref
return '';
}
}
$c = new C;
$c->b = &$c->a;
$c->b = $c;
```
Resulted in this output:
```
zend_execute.c:4093: i_zval_ptr_dtor_noref: Assertion `zval_get_type(&(*(zval_ptr))) != 10'
failed.
```
Root cause is that we call
zend_assign_to_variable_ex() /
zend_assign_to_typed_ref_ex()
[here](https://github.com/php/php-src/blob/02c67b47f728f915e6015c2fd52c6e1f7a27b172/Zend/zend_object_handlers.c#L875)
with value_type=IS_TMP_VAR, when value may be a CV slot.
### PHP Version
```plain
PHP 8.3
```
### Operating System
_No response_