SIGABRT in `zend_ast_get_zval()` (zend_ast.h:383)

[iany0]

Description

The following code:

<?php

function foo(string $key): utring {
 throw new \Exception('Test');
}

array_filter(
 array_map(foo(...), ['a']), array_combie(
 array_map(foo(...)(...), ['a']),
 ),
 array_map(foo, ['a']),
 ['a'],
 );

?>

Resulted in this output:

Running LLVMFuzzerInitialize ...
continue...
Reading 242 bytes from poc_3
php-fuzz-parser: /php-src/Zend/zend_ast.h:383: zval *zend_ast_get_zval(zend_ast *): Assertion `ast->kind == ZEND_AST_ZVAL' failed.
Aborted

This reproduces with php-fuzz-parser (fuzzing harness).

PHP Version

PHP 8.6.0-dev

Operating System

No response

[iluuu1994]

Looks related to GH-20934. /cc @TimWolla