26 lines
430 B
PHP
26 lines
430 B
PHP
--TEST--
|
|
Bug #77843: Use after free with json serializer
|
|
--FILE--
|
|
<?php
|
|
|
|
class X implements JsonSerializable {
|
|
public $prop = "value";
|
|
public function jsonSerialize() {
|
|
global $arr;
|
|
unset($arr[0]);
|
|
var_dump($this);
|
|
return $this;
|
|
}
|
|
}
|
|
|
|
$arr = [new X()];
|
|
var_dump(json_encode([&$arr]));
|
|
|
|
?>
|
|
--EXPECT--
|
|
object(X)#1 (1) {
|
|
["prop"]=>
|
|
string(5) "value"
|
|
}
|
|
string(20) "[[{"prop":"value"}]]"
|