PHP 8.3.20 segfaults when removing a node from SimpleXML with unset

[EreMaijala]

Description

The following code:

<?php

$xml = simplexml_load_string('<foo><bar>baz</bar></foo>');
echo 'XML 1 loaded' . PHP_EOL;
unset($xml->{'bar'}[0]);
echo 'XML 1 modified' . PHP_EOL;

$xml = simplexml_load_string('<foo><bar>baz</bar></foo>');
echo 'XML 2 loaded' . PHP_EOL;
$field = 'bar';
unset($xml->{$field}[0]);
echo 'XML 2 modified' . PHP_EOL;

Resulted in this output:

XML 1 loaded
XML 1 modified
XML 2 loaded
Segmentation fault: 11

But I expected this output instead:

XML 1 loaded
XML 1 modified
XML 2 loaded
XML 2 modified

We first noticed the problem when PHPUnit tests that worked on Friday suddenly started segfaulting today. It seems that Github Actions switched from PHP 8.3.19 to 8.3.20 meanwhile. Also tested that the code works fine with 8.3.19.

PHP Version

PHP 8.3.20 (cli) (built: Apr 8 2025 20:21:18) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.20, Copyright (c) Zend Technologies
with Xdebug v3.3.1, Copyright (c) 2002-2023, by Derick Rethans
with Zend OPcache v8.3.20, Copyright (c), by Zend Technologies

Operating System

Github ubuntu-latest and macOS 15.4 (PHP from Homebrew)

[nielsdos]

Duplicate of #18304 and already fixed for the next version of 8.3.