Fix phpGH-20073: Assertion failure in WeakMap offset operations on reference

ndossche · ndossche · commit b16761ec11a2 · 2025-10-07T20:16:41.000+02:00
Closes phpGH-20078.
diff --git a/NEWS b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv). (ilutov)
+  . Fixed bug GH-20073 (Assertion failure in WeakMap offset operations on
+    reference). (nielsdos)
 
 23 Oct 2025, PHP 8.3.27
 
diff --git a/Zend/tests/weakrefs/gh20073.phpt b/Zend/tests/weakrefs/gh20073.phpt
@@ -0,0 +1,15 @@
+--TEST--
+GH-20073 (Assertion failure in WeakMap offset operations on reference)
+--FILE--
+<?php
+$obj = new stdClass;
+$map = new WeakMap;
+$integer = 1;
+$map[$obj] = 0;
+$map[$obj] =& $integer;
+$integer++;
+var_dump($map[$obj], $map->offsetGet($obj));
+?>
+--EXPECT--
+int(2)
+int(2)
diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c
@@ -702,7 +702,7 @@ ZEND_METHOD(WeakMap, offsetGet)
 		return;
 	}
 
-	ZVAL_COPY(return_value, zv);
+	RETURN_COPY_DEREF(zv);
 }
 
 ZEND_METHOD(WeakMap, offsetSet)

Original file line number	Diff line number	Diff line change
`@@ -702,7 +702,7 @@ ZEND_METHOD(WeakMap, offsetGet)`
`702`	`702`	`return;`
`703`	`703`	`}`
`704`	`704`
`705`		`- ZVAL_COPY(return_value, zv);`
	`705`	`+ RETURN_COPY_DEREF(zv);`
`706`	`706`	`}`
`707`	`707`
`708`	`708`	`ZEND_METHOD(WeakMap, offsetSet)`