Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy

[vi3tL0u1s]

Description

The following code:

<?php
class A {
    public $_;
    public function __get($n) {
        global $obj;
        $obj->x =& $this->_;
        static $a = $a;
        $e =& $this->_ - $a;
    }
}
$rc = new ReflectionClass(A::class);
$obj = $rc->newLazyProxy(fn() => new A);
$rc->initializeLazyObject($obj);
var_dump($obj->p);

Resulted in this output:

php: /path/to/php-src/Zend/zend_operators.c:362: _zendi_try_convert_scalar_to_number: Assertion `0' failed.
Aborted

Commit

eea9a62b1bb3e429e58259408e1beb6ca3f22305

Configurations

./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  9 2026 14:43:36) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[iluuu1994]

Probably also related to GH-20854. Note the $this->a =& $b pattern within __get of a lazy proxy.