From 0eb65e55a53705092019fb202fdf6d41e7a14383 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Mon, 6 Oct 2025 17:51:23 +0200
Subject: [PATCH] Fix GH-20073: Assertion failure in WeakMap offset operations
 on reference

---
 Zend/tests/weakrefs/gh20073.phpt | 15 +++++++++++++++
 Zend/zend_weakrefs.c             |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/weakrefs/gh20073.phpt

diff --git a/Zend/tests/weakrefs/gh20073.phpt b/Zend/tests/weakrefs/gh20073.phpt
new file mode 100644
index 0000000000000..b64c1a68d3cc0
--- /dev/null
+++ b/Zend/tests/weakrefs/gh20073.phpt
@@ -0,0 +1,15 @@
+--TEST--
+GH-20073 (Assertion failure in WeakMap offset operations on reference)
+--FILE--
+<?php
+$obj = new stdClass;
+$map = new WeakMap;
+$integer = 1;
+$map[$obj] = 0;
+$map[$obj] =& $integer;
+$integer++;
+var_dump($map[$obj], $map->offsetGet($obj));
+?>
+--EXPECT--
+int(2)
+int(2)
diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c
index e96e68e3b2743..cffaeb985aed2 100644
--- a/Zend/zend_weakrefs.c
+++ b/Zend/zend_weakrefs.c
@@ -702,7 +702,7 @@ ZEND_METHOD(WeakMap, offsetGet)
 		return;
 	}
 
-	ZVAL_COPY(return_value, zv);
+	RETURN_COPY_DEREF(zv);
 }
 
 ZEND_METHOD(WeakMap, offsetSet)