1--TEST-- 2GH-16646: Use-after-free in ArrayObject::exchangeArray() with destructor 3--FILE-- 4<?php 5 6class C { 7 function __destruct() { 8 global $arr; 9 echo __METHOD__, "\n"; 10 $arr->exchangeArray([]); 11 } 12} 13 14$arr = new ArrayObject(new C); 15$arr->exchangeArray([]); 16var_dump($arr); 17 18?> 19--EXPECT-- 20C::__destruct 21object(ArrayObject)#1 (1) { 22 ["storage":"ArrayObject":private]=> 23 array(0) { 24 } 25} 26
