1--TEST-- 2Bug #54238 (use-after-free in substr_replace()) 3--FILE-- 4<?php 5$f = array(array('A', 'A')); 6 7$z = substr_replace($f, $f, $f, 1); 8var_dump($z, $f); 9?> 10--EXPECTF-- 11Warning: Array to string conversion in %s on line %d 12 13Warning: Array to string conversion in %s on line %d 14array(1) { 15 [0]=> 16 string(9) "AArrayray" 17} 18array(1) { 19 [0]=> 20 array(2) { 21 [0]=> 22 string(1) "A" 23 [1]=> 24 string(1) "A" 25 } 26} 27