Assertion failure in _get_zval_ptr_tmp with lazy proxy

[vi3tL0u1s]

Description

The following code:

<?php
class A {
    public $_;
    public function __get($name) {
        global $obj;
        $obj->f =& $this->b - $x > $y = new StdClass;
        static $a = $a;
        $t = 'x';
        foreach (get_defined_vars() as $key => $e) {}
        if ($v ==!1) $x = $a ?: $t = "ok";
    }
}
$rc = new ReflectionClass(A::class);
$obj = $rc->newLazyProxy(function () { return new A; });
$real = $rc->initializeLazyObject($obj);
var_dump($real->prop);

Resulted in this output:

php: /path/to/php-src/Zend/zend_execute.c:256: _get_zval_ptr_tmp: Assertion `zval_get_type(&(*(ret))) != 10' failed.
Aborted

Commit

eea9a62b1bb3e429e58259408e1beb6ca3f22305

Configurations

./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Jan  9 2026 14:43:36) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04