zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed upon memory exhaustion

[lmaltsis]

Description

The following code:

<?php
class Node {
    public $parent = NULL;
    public $children = array();

    function __construct(?Node $parent=NULL) {
        if ($parent) {
            $parent->children[] = $this;
        }
        $this->children[] = $this;
    }

    function __destruct() {
        $this->children = NULL;
    }
}

define("MAX", 16);

for ($n = 0; $n < 20; $n++) {
    $top = new Node();
    for ($i=0 ; $i<MAX ; $i++) {
        $ci = new Node($top);
        for ($j=0 ; $j<MAX ; $j++) {
            $cj = new Node($ci);
            for ($k=0 ; $n ?? (0 >> $i) & $n ?? $n ?? 20 ?? MAX<MAX ; $k++) {
                $ck = new Node($cj);
            }
        }
    }
    echo "$n\n";
}
echo "ok\n";
?>

Resulted in this output:

0

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27
Stack trace:
#0 {main}
php: /home/user/software/php-debug-noasan/src/Zend/zend_types.h:1383: zend_gc_delref: Assertion `p->refcount > 0' failed.
Aborted (core dumped)

But I expected this output instead:

Fatal error: Allowed memory size of 97517568 bytes exhausted at /home/user/software/php-debug-noasan/src/Zend/zend_gc.c:356 (tried to allocate 4096 bytes) in /tmp/bug.php on line 27

This bug seems to be dependent on how much memory you give php, through grid searching I found these values of memory trigger the bug

93M, 94M, 127M, 128M, 159M, 160M, 193M-196M, 243M-248M, 287M-290M, 333M-338M, 383M-390M

Looks very similar to #16835 but unsure about same root cause

PHP Version

PHP 8.5.10 (cli) (built: Sep  5 2026 19:25:14) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.10, Copyright (c), by Zend Technologies

34308a6666b2d489c509541ea9befea9e2b42348

Operating System

Ubuntu 24.04

[devnexen]

same root cause but at least your reproducer does not depend on any extension.