Assertion failure in zend_lazy_objects.c found by `php-fuzz-execute`

[gal1ium]

Description

Description

The following code:

<?php
class C
{
    public $s;
}
$r = new ReflectionClass(C::class);
$o = $r->newLazyProxy(function () {});
print $o >
$r->newLazyGhost(function () {
    global $o;
    $o = null;
});

Resulted in this output:

php-fuzz-execute: /src/php-src/Zend/zend_lazy_objects.c:582: zend_object *zend_lazy_object_init(zend_object *): Assertion `ce->ce_flags & (1 << 12)' failed.
Aborted (core dumped)

PHP Version

16b2fc4

Operating System

No response

[arnaud-lb]

This can be reproduced with __toString() or by triggering the error handler during comparison:

$a = [
    'foo' => 'test',
    'bar' => 2,
];
$b = [
    'foo' => new class {
        public function __toString() {
            global $a, $b;
            $a = $b = null;
            return '';
        }
    },
    'bar' => 2,
];

// Comparison of $a['foo'] and $b['foo'] calls __toString(), which releases
// both $a and $b.
var_dump($a > $b);

Fixed in bc4b6ce.

Thank you @gal1ium!