From e6d40936d07c948260f425101b9f010c48bae3c9 Mon Sep 17 00:00:00 2001 From: ulofiai <309826581+ulofiai@users.noreply.github.com> Date: Sat, 29 Aug 2026 18:13:56 +0800 Subject: [PATCH] Fix weakref unregister after stack overflow unwind Signed-off-by: ulofiai <309826581+ulofiai@users.noreply.github.com> --- Zend/zend_weakrefs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c index ad0308f44e20..46e02d174257 100644 --- a/Zend/zend_weakrefs.c +++ b/Zend/zend_weakrefs.c @@ -123,7 +123,12 @@ static void zend_weakref_register(zend_object *object, void *payload) { static void zend_weakref_unregister(zend_object *object, void *payload, bool weakref_free) { zend_ulong obj_key = zend_object_to_weakref_key(object); void *tagged_ptr = zend_hash_index_find_ptr(&EG(weakrefs), obj_key); - ZEND_ASSERT(tagged_ptr && "Weakref not registered?"); + if (UNEXPECTED(!tagged_ptr)) { + /* The referent may already have been unregistered while unwinding from + * a stack overflow. There is nothing left to detach in that case. */ + GC_DEL_FLAGS(object, IS_OBJ_WEAKLY_REFERENCED); + return; + } void *ptr = ZEND_WEAKREF_GET_PTR(tagged_ptr); uintptr_t tag = ZEND_WEAKREF_GET_TAG(tagged_ptr);