==11171== Invalid read of size 4
==11171==    at 0x92DDE6: zend_gc_delref (zend_types.h:1035)
==11171==    by 0x92E139: i_zval_ptr_dtor (zend_variables.h:43)
==11171==    by 0x92E35B: zval_ptr_dtor (zend_variables.c:84)
==11171==    by 0x6D0857: spl_ptr_heap_pqueue_elem_dtor (spl_heap.c:111)
==11171==    by 0x6D14FE: spl_ptr_heap_destroy (spl_heap.c:356)
==11171==    by 0x6D15A6: spl_heap_object_free_storage (spl_heap.c:377)
==11171==    by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)
==11171==    by 0x98357D: i_zval_ptr_dtor (zend_variables.h:44)
==11171==    by 0x983985: zend_object_std_dtor (zend_objects.c:70)
==11171==    by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)
==11171==  Address 0x12552bd0 is 0 bytes inside a block of size 56 free'd
==11171==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11171==    by 0x8F70AF: _efree_custom (zend_alloc.c:2411)
==11171==    by 0x8F71F0: _efree (zend_alloc.c:2531)
==11171==    by 0x94A834: zend_array_destroy (zend_hash.c:1637)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)
==11171==    by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44)
==11171==    by 0x94A6FC: zend_array_destroy (zend_hash.c:1615)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)
==11171==    by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44)
==11171==    by 0x94A6CA: zend_array_destroy (zend_hash.c:1611)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)
==11171==    by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44)
==11171==  Block was alloc'd at
==11171==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11171==    by 0x8F80F0: __zend_malloc (zend_alloc.c:2961)
==11171==    by 0x8F7048: _malloc_custom (zend_alloc.c:2402)
==11171==    by 0x8F7176: _emalloc (zend_alloc.c:2521)
==11171==    by 0x945C94: _zend_new_array (zend_hash.c:256)
==11171==    by 0xA02FB1: ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER (zend_vm_execute.h:46146)
==11171==    by 0xA0E9AA: execute_ex (zend_vm_execute.h:57221)
==11171==    by 0xA0EF21: zend_execute (zend_vm_execute.h:57553)
==11171==    by 0x9328BA: zend_execute_scripts (zend.c:1663)
==11171==    by 0x893110: php_execute_script (main.c:2619)
==11171==    by 0xA11B2D: do_cli (php_cli.c:962)
==11171==    by 0xA12C96: main (php_cli.c:1352)
==11171== 
php: /home/nikic/php-7.4/Zend/zend_types.h:1035: zend_gc_delref: Assertion `p->refcount > 0' failed.
==11171== 
==11171== Process terminating with default action of signal 6 (SIGABRT)
==11171==    at 0xA127E97: raise (raise.c:51)
==11171==    by 0xA129800: abort (abort.c:79)
==11171==    by 0xA119399: __assert_fail_base (assert.c:92)
==11171==    by 0xA119411: __assert_fail (assert.c:101)
==11171==    by 0x92DE0A: zend_gc_delref (zend_types.h:1035)
==11171==    by 0x92E139: i_zval_ptr_dtor (zend_variables.h:43)
==11171==    by 0x92E35B: zval_ptr_dtor (zend_variables.c:84)
==11171==    by 0x6D0857: spl_ptr_heap_pqueue_elem_dtor (spl_heap.c:111)
==11171==    by 0x6D14FE: spl_ptr_heap_destroy (spl_heap.c:356)
==11171==    by 0x6D15A6: spl_heap_object_free_storage (spl_heap.c:377)
==11171==    by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194)
==11171==    by 0x92E1C6: rc_dtor_func (zend_variables.c:57)

Possibly a GC issue in spl_ptr_heap.

I switched SplPriorityQueue to use a custom structure instead of an array to store elements -- unfortunately it means that we are exposing PTR zvals to GC, which it doesn't support.

Simple reproducer to get a leak:

<?php  
$pqueue = new SplPriorityQueue();
$pqueue->insert($pqueue, 1);

Probably some variation could also reproduce a segfault.

Either we need to use a separate buffer for GC, but it might make more sense to generate the ptr heap implementation to also support storing two zvals side by side, which will, as an additional bonus, also be more efficient.

Okay, while the GC issue also exists, what is actually causing the segfault here is something else, reproducible with just:

<?php
$pq = new SplPriorityQueue();
$pq->insert(new stdClass, 1);
var_dump($pq);
var_dump($pq);