1--TEST-- 2GH-16479: Use-after-free in SplObjectStorage::setInfo() 3--FILE-- 4<?php 5 6class C { 7 function __destruct() { 8 global $store; 9 $store->removeAll($store); 10 } 11} 12 13$o = new stdClass; 14$store = new SplObjectStorage; 15$store[$o] = new C; 16$store->setInfo(1); 17var_dump($store); 18 19?> 20--EXPECT-- 21object(SplObjectStorage)#2 (1) { 22 ["storage":"SplObjectStorage":private]=> 23 array(0) { 24 } 25} 26
