From 56b2b9f5397d2a6cc84c5c4f79176c6652469180 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Thu, 9 Apr 2026 11:43:34 -0400
Subject: [PATCH] Fix GH-21687: assertion failure in zend_enum_fetch_case_name
 after array_walk

array_walk() wraps object properties in IS_REFERENCE when passing
them to the callback. For enum objects, this converts the name
property from IS_STRING to IS_REFERENCE in-place. A subsequent
var_dump() calls zend_enum_fetch_case_name() which asserts IS_STRING
on the property, triggering an assertion failure.

Dereference through IS_REFERENCE in both zend_enum_fetch_case_name()
and zend_enum_fetch_case_value() before accessing the value.

Closes GH-21687
---
 Zend/tests/gh21687.phpt | 18 ++++++++++++++++++
 Zend/zend_enum.h        |  6 +++++-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/gh21687.phpt

diff --git a/Zend/tests/gh21687.phpt b/Zend/tests/gh21687.phpt
new file mode 100644
index 000000000000..1ce3a7481fff
--- /dev/null
+++ b/Zend/tests/gh21687.phpt
@@ -0,0 +1,18 @@
+--TEST--
+GH-21687 (Assertion failure in zend_enum_fetch_case_name after array_walk on enum)
+--FILE--
+<?php
+enum Foo: int {
+    case Bar = 0;
+}
+
+$bar = Foo::Bar;
+array_walk($bar, function($v) {});
+var_dump($bar);
+echo $bar->name . "\n";
+echo $bar->value . "\n";
+?>
+--EXPECT--
+enum(Foo::Bar)
+Bar
+0
diff --git a/Zend/zend_enum.h b/Zend/zend_enum.h
index 4d0799e4f0ac..2bb330be0b47 100644
--- a/Zend/zend_enum.h
+++ b/Zend/zend_enum.h
@@ -69,6 +69,7 @@ static zend_always_inline zval *zend_enum_fetch_case_name(zend_object *zobj)
 	ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_ENUM);
 
 	zval *name = OBJ_PROP_NUM(zobj, 0);
+	ZVAL_DEREF(name);
 	ZEND_ASSERT(Z_TYPE_P(name) == IS_STRING);
 	return name;
 }
@@ -77,7 +78,10 @@ static zend_always_inline zval *zend_enum_fetch_case_value(zend_object *zobj)
 {
 	ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_ENUM);
 	ZEND_ASSERT(zobj->ce->enum_backing_type != IS_UNDEF);
-	return OBJ_PROP_NUM(zobj, 1);
+
+	zval *value = OBJ_PROP_NUM(zobj, 1);
+	ZVAL_DEREF(value);
+	return value;
 }
 
 END_EXTERN_C()