Assertion failure in WeakMap offset operations on reference

[vi3tL0u1s]

Description

The following code:

<?php
$obj = new stdClass;
$map = new WeakMap;
$map[$obj] = 0;
$map[$obj] = // /a[0] /N//@ //'//y['///@// rsort($a)z,= $ 2 $Z// $d,
& $a ===//q// b $$obj2, 43));
var_dump($map->offsetGet($obj ));
var_dump($map->offsetExists($obj ));
?>

Resulted in this output:

php: Zend/zend_vm_execute.h:2165: const zend_op *ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER(zend_execute_data *, const zend_op *): Assertion `(call->func->common.fn_flags & (1 << 12)) ? (zval_get_type(&(*(ret))) == 10) : !(zval_get_type(&(*(ret))) == 10)' failed.
Aborted

Commit

c39c880824e

Configurations

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.5.0-dev (cli) (built: Oct  6 2025 14:06:35) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[nielsdos]

Not looked in detail yet, but this should probably use the _DEREF variant:

php-src/Zend/zend_weakrefs.c

Line 734 in c39c880

ZVAL_COPY(return_value, zv);

While at it, use RETURN_COPY_DEREF
I could do it this evening.