SplFixedArray incorrectly handles references in deserialization

[vi3tL0u1s]

Description

The following code:

<?
for ($i = 0; $i <= 2; $i++) {
    $tok = $conditions;
    $x[0] = &$$array;     
    $a[] = !$a; 
    $$a[0] =&rsort($a);
    unset($a[3][0]);
    $conditions = $b = new SplFixedArray(2);
    $b[0] = $$stdClassCollection = new SplObjectStorage;
    $v[0] = &$a;
    $a = unserialize(serialize($GLOBALS));
}

Resulted in this output:

Notice: Only variables should be assigned by reference in /path/to/poc.php on line 6
php: /path/to/php-src/Zend/zend_execute.h:216: void zend_safe_assign_to_variable_noref(zval *, zval *): Assertion `zval_get_type(&(*(variable_ptr))) != 10' failed.
Aborted

Commit:

56795d2810e

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 29 2025 14:32:34) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[devnexen]

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff6845e2e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff6828888 in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff68287f0 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:118
#6  0x000055555bb38f39 in zend_safe_assign_to_variable_noref (variable_ptr=0x7bfff28a5100, value=0x7bfff39592e0) at Zend/zend_execute.h:216
#7  0x000055555bb31c1a in spl_fixedarray_object_unset_dimension_helper (intern=0x7bfff287f380, offset=0x7bfff284f5f0) at /home/dcarlier/Contribs/php-src/ext/spl/spl_fixedarray.c:465
#8  0x000055555bb350ff in spl_fixedarray_object_unset_dimension (object=0x7bfff287f3a0, offset=0x7bfff284f5f0) at /home/dcarlier/Contribs/php-src/ext/spl/spl_fixedarray.c:477
#9  0x000055555dd12cf6 in ZEND_UNSET_DIM_SPEC_VAR_CONST_TAILCALL_HANDLER (execute_data=0x7bfff2807020, opline=0x7bfff284eff0) at Zend/zend_vm_execute.h:82272
#10 0x000055555d42ca3f in execute_ex (ex=0x7bfff2807020) at Zend/zend_vm_execute.h:116212
#11 0x000055555d42eabf in zend_execute (op_array=0x7bfff288a000, return_value=0x0) at Zend/zend_vm_execute.h:121924
#12 0x000055555e64fb00 in zend_execute_script (type=8, retval=0x0, file_handle=0x7fffffffc2e0) at /home/dcarlier/Contribs/php-src/Zend/zend.c:1975
#13 0x000055555cb08d23 in php_execute_script_ex (primary_file=0x7fffffffc2e0, retval=0x0) at /home/dcarlier/Contribs/php-src/main/main.c:2645
#14 0x000055555cb09c09 in php_execute_script (primary_file=0x7fffffffc2e0) at /home/dcarlier/Contribs/php-src/main/main.c:2685
#15 0x000055555e6613cf in do_cli (argc=2, argv=0x7c2ff4de1bd0) at /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:951
#16 0x000055555e65d372 in main (argc=2, argv=0x7c2ff4de1bd0) at /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1362

[ndossche]

SplFixedArray incorrectly handles references, I believe it shouldn't allow them:

<?php
$fa = new SplFixedArray(0);
$nr = 1;
$array = [&$nr];
$fa->__unserialize($array);
var_dump($fa);
unset($fa[0]);
var_dump($fa);