Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()

[vi3tL0u1s]

Description

The following code:

<?php
#[AllowDynamicProperties]
class RealInstance {
    public $_;
    public function ___isset($name) {
        return isset($this->$name['']);
    }
}
class Proxy extends RealInstance {
    public function __isset($name) {
        return isset($this->$name['']);
    }
}
$rc = new ReflectionClass(Proxy::class);
$obj = $rc->newLazyProxy(function () {
    return new RealInstance;
});
var_dump(isset($obj->$name['']));

Resulted in this output:

php: /path/to/php-src/Zend/zend_object_handlers.c:620: zend_get_property_guard: Assertion `zobj->ce->ce_flags & (1 << 30)' failed.
Aborted

Commit:

035f95cf5e016236cca11bc293dc04d40b40e45c

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 16 2025 19:51:33) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04