From 13d63d610551431077e090da0e42694e93fc57c1 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Tue, 23 Dec 2025 19:14:28 +0100
Subject: [PATCH] Fix GH-20771: Assertion failure when getUnicodeHost() returns
 empty string

If nothing was added to a smart_str, the interned empty string is
returned, and therefore ZVAL_NEW_STR is wrong as it'll set the
REFCOUNTED flag.

Closes GH-20773.
---
 NEWS                                      |  4 ++++
 ext/uri/tests/whatwg/getters/gh20771.phpt | 14 ++++++++++++++
 ext/uri/uri_parser_whatwg.c               |  2 +-
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 ext/uri/tests/whatwg/getters/gh20771.phpt

diff --git a/NEWS b/NEWS
index a28ef5f450d..9ea0ffa9bbe 100644
--- a/NEWS
+++ b/NEWS
@@ -50,6 +50,10 @@ PHP                                                                        NEWS
 - Standard:
   . Fix error check for proc_open() command. (ndossche)
 
+- URI:
+  . Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns
+    empty string). (ndossche)
+
 18 Dec 2025, PHP 8.5.1
 
 - Core:
diff --git a/ext/uri/tests/whatwg/getters/gh20771.phpt b/ext/uri/tests/whatwg/getters/gh20771.phpt
new file mode 100644
index 00000000000..19f1d1fb0f5
--- /dev/null
+++ b/ext/uri/tests/whatwg/getters/gh20771.phpt
@@ -0,0 +1,14 @@
+--TEST--
+GH-20771 (Assertion failure when getUnicodeHost() returns empty string)
+--EXTENSIONS--
+uri
+--FILE--
+<?php
+
+$url = Uri\WhatWg\Url::parse('test://');
+
+var_dump($url->getUnicodeHost());
+
+?>
+--EXPECT--
+string(0) ""
diff --git a/ext/uri/uri_parser_whatwg.c b/ext/uri/uri_parser_whatwg.c
index 2e9ffad22d4..055f130af7c 100644
--- a/ext/uri/uri_parser_whatwg.c
+++ b/ext/uri/uri_parser_whatwg.c
@@ -365,7 +365,7 @@ static zend_result php_uri_parser_whatwg_host_read(void *uri, php_uri_component_
 				lxb_url_serialize_host_unicode(&lexbor_idna, &lexbor_uri->host, serialize_to_smart_str_callback, &host_str);
 				lxb_unicode_idna_clean(&lexbor_idna);
 
-				ZVAL_NEW_STR(retval, smart_str_extract(&host_str));
+				ZVAL_STR(retval, smart_str_extract(&host_str));
 				break;
 			}
 			case PHP_URI_COMPONENT_READ_MODE_NORMALIZED_ASCII: