[php-src] Issue #20614: Assertion failure in zend_safe_assign_to_variable_noref() caused by $GLOBALS serialization with reference assignments

[email protected] (vi3tL0u1s)
Newsgroups php.bugs
Message-ID <KT2UcZ9jtGTxaUdKAj601zPIvFCJ9kgcMSsGMpmOR34@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/20614
Author: vi3tL0u1s

### Description

The following code:

```php
<?
for ($i = 0; $i <= 2; $i++) {
    $tok = $conditions;
    $x[0] = &$$array;     
    $a[] = !$a; 
    $$a[0] =&rsort($a);
    unset($a[3][0]);
    $conditions = $b = new SplFixedArray(2);
    $b[0] = $$stdClassCollection = new SplObjectStorage;
    $v[0] = &$a;
    $a = unserialize(serialize($GLOBALS));
}
```

Resulted in this output:
```
Notice: Only variables should be assigned by reference in /path/to/poc.php on line 6
php: /path/to/php-src/Zend/zend_execute.h:216: void zend_safe_assign_to_variable_noref(zval *, zval *): Assertion `zval_get_type(&(*(variable_ptr))) != 10' failed.
Aborted
```

Commit:
```
56795d2810e
```

Build configuration:
```
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib
```


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Nov 29 2025 14:32:34) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```

### Operating System

Ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.