This appears to be an issue when calling serialize within serialize.

The first and second \stdClass's created have the same ObjectHash. It appears that the second internal call to serialize attempts to return a reference for the second stdclass to the first stdclass. But that is not valid as the first serialization of stdclass is actually in a different serialization call, and it's not meant to be a reference.

There is a simpler code example below; the class extending is not required to show the behaviour. The output is:

loop 0: ObjectHash 00000000169f9afe0000000054338336 Received: O:8:"stdClass":0:{}
loop 0: Returning 'O:8:"stdClass":0:{}'
loop 1: ObjectHash 00000000169f9afe0000000054338336 Received: r:3; //This is wrong - it is not a reference.
Object hash already exists - serialize is going to be sad.
borked, serialize of stdClass::__set_state(array(
)) returned r:3; which could not be unserialized.


<?php

class testClass_forSerialize implements Serializable {
    public function serialize() {
        static $count = 0;
        static $objectHashes = [];
        $ret = new \stdClass();
        $serializedData = serialize($ret);

        $objectHash = spl_object_hash($ret);
        echo "loop $count: ObjectHash $objectHash Received: ".$serializedData."\n";
        if (array_key_exists($objectHash, $objectHashes) == true) {
            echo "Object hash already exists - serialize is going to be sad.\n";
        }

        $objectHashes[$objectHash] = $count;

        if (@unserialize($serializedData) === false) {
            printf(
                "borked, serialize of %s returned %s which could not be unserialized.\n",
                var_export($ret, true),
                $serializedData
            );
            exit(0);
        }

        echo "loop $count: Returning '$serializedData'\n";
        $count++;
        return $serializedData;
    }

    public function unserialize($data) {
        throw new \Exception("not relevant");
    }
}


$list = [];
for ($i=0; $i<2; $i++) {
    $list[] = new \testClass_forSerialize();
}

$ser = serialize($list);

Probably duplicate of https://bugs.php.net/bug.php?id=66052

Actually, this is a duplicate of bug #64146 (as it has the same
cause), but not of #66052.

See also <http://3v4l.org/SggeU> and <http://3v4l.org/9ttkq>.