SIGABRT in `zend_compile_func_array_map()` (zend_compile.c:5072) with `Assertion 0 && "not implemented"`

[iany0]

Description

The following code:

<?php

function foo(string $key): string {
 throw new \Exception('Test');
}

array_filter(
 array_combine(
 ['a'],
 array_map(j::foo(...),['a']),
ay_combine(
 ['a'],
 array_map(j::foo( ['a'],
 array_map(j::foo(...),['a']),
ay_combine(
 ['a'],
 array_map(j::foo(...),['a']),
 ),
 ...),['a']),
 ),
 ),
);

?>

Resulted in this output:

Running LLVMFuzzerInitialize ...
continue...
Reading 375 bytes from poc_4
php-fuzz-parser: /home/unimelb.edu.au/wenqiyan/fuzzingdynamiq/subjects/testphp/php-src/Zend/zend_compile.c:5072: zend_result zend_compile_func_array_map(znode *, zend_ast_list *, zend_string *, uint32_t): Assertion `0 && "not implemented"' failed.
Aborted

This reproduces with php-fuzz-parser (fuzzing harness).

PHP Version

PHP 8.6.0-dev

Operating System

No response

[iluuu1994]

Looks related to GH-20934. /cc @TimWolla