Assertion failure in array_shift with self-referencing array

[YuanchengJiang]

Description

The following code:

<?php
$new_array = array (&$new_array, 1, 'two');
var_dump(array_shift($new_array[0]));

Resulted in this output:

/php-src/Zend/zend_hash.c:1520: void zend_hash_packed_del_val(HashTable *, zval *): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

This would work, just not very pretty...

diff --git a/ext/standard/array.c b/ext/standard/array.c
index ba1424f677f..3865ce0f25e 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3513,7 +3513,8 @@ PHP_FUNCTION(array_shift)
 			}
 			idx++;
 		}
-		RETVAL_COPY_DEREF(val);
+		ZVAL_COPY_VALUE(return_value, val);
+		ZVAL_UNDEF(val);
 
 		/* Delete the first value */
 		zend_hash_packed_del_val(Z_ARRVAL_P(stack), val);
@@ -3567,7 +3568,8 @@ PHP_FUNCTION(array_shift)
 			}
 			idx++;
 		}
-		RETVAL_COPY_DEREF(val);
+		ZVAL_COPY_VALUE(return_value, val);
+		ZVAL_UNDEF(val);
 
 		/* Delete the first value */
 		zend_hash_del_bucket(Z_ARRVAL_P(stack), p);
@@ -3591,6 +3593,10 @@ PHP_FUNCTION(array_shift)
 	}
 
 	zend_hash_internal_pointer_reset(Z_ARRVAL_P(stack));
+
+	if (Z_ISREF_P(return_value)) {
+		zend_unwrap_reference(return_value);
+	}
 }
 /* }}} */