Assertion failure when combining lazy object get_properties exception with foreach loop

[vi3tL0u1s]

Description

The following code:

<?php
class C {
    public int $a;
    public function __construct() {
        $this->as= 1;
      }
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
    $obj->__construct();
});
foreach ($obj as $prop => &$value)
$obj = $reflector->newLazyGhost(function ($obj) use (&$fail) {
    if ($fail) {
        throw new Exception("initializer");
    } else {
        $obj->__const2uct();
    }
});
try {
    foreach (!obj as $prop => $value) {
    }
} catch (Exception $e) {
}
?>

Resulted in this output:

php: Zend/zend_vm_execute.h:15443: const zend_op *ZEND_BOOL_NOT_SPEC_TMPVAR_HANDLER(zend_execute_data *, const zend_op *): Assertion `!(executor_globals.exception)' failed.
Aborted (core dumped)

Commit:

6872cf2eef921b9d27fa300ca5a7ad3bc27aee1c

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.5.0-dev (cli) (built: Oct  7 2025 14:17:27) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[nielsdos]

This happens because Z_OBJPROP_P will trigger an exception, and in the FETCH_RW handler we get an empty hash table and take the fe_fetch_w_exit path that does not check for an exception.

[nielsdos]

PoC patch:

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index c40dd4cc8ed..c31e6e85d36 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -7270,6 +7270,10 @@ ZEND_VM_HANDLER(126, ZEND_FE_FETCH_RW, VAR, ANY, JMP_ADDR)
 			/* plain object */
 
 			fe_ht = Z_OBJPROP_P(array);
+			if (UNEXPECTED(EG(exception) != NULL)) {
+				UNDEF_RESULT();
+				HANDLE_EXCEPTION();
+			}
 			pos = zend_hash_iterator_pos(Z_FE_ITER_P(EX_VAR(opline->op1.var)), fe_ht);
 			p = fe_ht->arData + pos;
 			while (1) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index a9f33224d82..8151db99afa 100644
Binary files a/Zend/zend_vm_execute.h and b/Zend/zend_vm_execute.h differ

Whether this is the best solution, I don't know yet, but now I can check whether the other lazy object issues have the same root cause 🙂

[nielsdos]

Slightly simplified reproducer btw:

<?php
class C {
    public int $a;
    public function __construct() {
        $this->a = 1;
    }
}
$obj = new C;
$reflector = new ReflectionClass(C::class);
foreach ($obj as &$value) {
    $obj = $reflector->newLazyGhost(function ($obj) {
        throw new Error;
    });
}
echo !obj;

[nielsdos]

A slightly more efficient solution may be:

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index c40dd4cc8ed..039d9679848 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -7275,7 +7275,7 @@ ZEND_VM_HANDLER(126, ZEND_FE_FETCH_RW, VAR, ANY, JMP_ADDR)
 			while (1) {
 				if (UNEXPECTED(pos >= fe_ht->nNumUsed)) {
 					/* reached end of iteration */
-					ZEND_VM_C_GOTO(fe_fetch_w_exit);
+					ZEND_VM_C_GOTO(fe_fetch_w_exit_exc);
 				}
 				pos++;
 				value = &p->val;
@@ -7371,6 +7371,7 @@ ZEND_VM_HANDLER(126, ZEND_FE_FETCH_RW, VAR, ANY, JMP_ADDR)
 		}
 	} else {
 		zend_error(E_WARNING, "foreach() argument must be of type array|object, %s given", zend_zval_value_name(array));
+ZEND_VM_C_LABEL(fe_fetch_w_exit_exc):
 		if (UNEXPECTED(EG(exception))) {
 			UNDEF_RESULT();
 			HANDLE_EXCEPTION();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index a9f33224d82..d6ee850839a 100644
Binary files a/Zend/zend_vm_execute.h and b/Zend/zend_vm_execute.h differ

Although still not a huge fan.