diff --git a/NEWS b/NEWS
index fd2f2fa82ec80..cf36b1bad7c7f 100644
--- a/NEWS
+++ b/NEWS
@@ -87,6 +87,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true
     for classes with property hooks). (alexandre-daubois)
   . Added ReflectionConstant::inNamespace(). (Khaled Alam)
+  . Added ReflectionProperty::isReadable() and ReflectionProperty::isWritable().
+    (ilutov)
 
 - Session:
   . Fixed bug 71162 (updateTimestamp never called when session data is empty).
diff --git a/UPGRADING b/UPGRADING
index 151b27b226788..7e47d0ba4817c 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -134,8 +134,8 @@ PHP 8.6 UPGRADE NOTES
 
 - Reflection:
   . ReflectionConstant::inNamespace()
-  . ReflectionProperty::isReadable() ReflectionProperty::isWritable() were
-    added.
+  . Added ReflectionProperty::isReadable() and ReflectionProperty::isWritable().
+    RFC: https://wiki.php.net/rfc/isreadable-iswriteable
 
 - Standard:
   . `clamp()` returns the given value if in range, else return the nearest
diff --git a/ext/pcre/tests/preg_match_all_negative_length_match.phpt b/ext/pcre/tests/preg_match_all_negative_length_match.phpt
deleted file mode 100644
index b18007cd32562..0000000000000
--- a/ext/pcre/tests/preg_match_all_negative_length_match.phpt
+++ /dev/null
@@ -1,10 +0,0 @@
---TEST--
-preg_match_all() resource cleanup when \K in lookahead causes negative-length match
---FILE--
-<?php
-$result = preg_match_all('/(?=ab\K)a/', 'ab', $matches);
-var_dump($result);
-?>
---EXPECTF--
-Warning: preg_match_all(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset %d in %s
-bool(false)
diff --git a/ext/pcre/tests/preg_match_negative_length_match.phpt b/ext/pcre/tests/preg_match_negative_length_match.phpt
deleted file mode 100644
index 221ea4fb9e54c..0000000000000
--- a/ext/pcre/tests/preg_match_negative_length_match.phpt
+++ /dev/null
@@ -1,10 +0,0 @@
---TEST--
-preg_match() resource cleanup when \K in lookahead causes negative-length match
---FILE--
-<?php
-$result = preg_match('/(?=ab\K)a/', 'ab', $matches);
-var_dump($result);
-?>
---EXPECTF--
-Warning: preg_match(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset %d in %s
-bool(false)
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 0f802bc128a20..fbbeeb0b433f4 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1745,7 +1745,10 @@ PHP_FUNCTION(highlight_file)
 	}
 
 	if (i) {
-		php_output_start_default();
+		if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
+			zend_throw_error(NULL, "Unable to start output handler");
+			RETURN_THROWS();
+		}
 	}
 
 	php_get_highlight_struct(&syntax_highlighter_ini);
@@ -1780,7 +1783,10 @@ PHP_FUNCTION(php_strip_whitespace)
 		Z_PARAM_PATH_STR(filename)
 	ZEND_PARSE_PARAMETERS_END();
 
-	php_output_start_default();
+	if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
+		zend_throw_error(NULL, "Unable to start output handler");
+		RETURN_THROWS();
+	}
 
 	zend_stream_init_filename_ex(&file_handle, filename);
 	zend_save_lexical_state(&original_lex_state);
@@ -1817,7 +1823,10 @@ PHP_FUNCTION(highlight_string)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (i) {
-		php_output_start_default();
+		if (UNEXPECTED(php_output_start_default() != SUCCESS)) {
+			zend_throw_error(NULL, "Unable to start output handler");
+			RETURN_THROWS();
+		}
 	}
 
 	EG(error_reporting) = E_ERROR;
diff --git a/ext/standard/tests/strings/gh20906_1.phpt b/ext/standard/tests/strings/gh20906_1.phpt
new file mode 100644
index 0000000000000..ccb0dfbee5669
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_1.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - php_strip_whitespace
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        php_strip_whitespace(__FILE__);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+try {
+  new A;
+} catch (Throwable $e) {
+  echo $e::class, ": ", $e->getMessage(), "\n";
+}
+?>
+--EXPECTF--
+%a
+Fatal error: php_strip_whitespace(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/ext/standard/tests/strings/gh20906_2.phpt b/ext/standard/tests/strings/gh20906_2.phpt
new file mode 100644
index 0000000000000..b3ea5cf6ef74b
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_2.phpt
@@ -0,0 +1,21 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - highlight_file
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        highlight_file(__FILE__, true);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+new A;
+?>
+--EXPECTF--
+%a
+Fatal error: highlight_file(): Cannot use output buffering in output buffering display handlers in %s on line %d
diff --git a/ext/standard/tests/strings/gh20906_3.phpt b/ext/standard/tests/strings/gh20906_3.phpt
new file mode 100644
index 0000000000000..a26fc61bed654
--- /dev/null
+++ b/ext/standard/tests/strings/gh20906_3.phpt
@@ -0,0 +1,21 @@
+--TEST--
+GH-20906 (Assertion failure when messing up output buffers) - highlight_string
+--CREDITS--
+vi3tL0u1s
+--FILE--
+<?php
+class A {
+    function __destruct() {
+        highlight_string(__FILE__, true);
+        echo "x";
+        $c = new A;
+        ob_start(function () use ($c) { return '/'; }, 1);
+        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
+    }
+}
+
+new A;
+?>
+--EXPECTF--
+%a
+Fatal error: highlight_string(): Cannot use output buffering in output buffering display handlers in %s on line %d