1--TEST-- 2Bug #54238 (use-after-free in substr_replace()) 3--INI-- 4error_reporting=E_ALL&~E_NOTICE 5--FILE-- 6<?php 7$f = array(array('A', 'A')); 8 9$z = substr_replace($f, $f, $f, 1); 10var_dump($z, $f); 11?> 12--EXPECT-- 13array(1) { 14 [0]=> 15 string(9) "AArrayray" 16} 17array(1) { 18 [0]=> 19 array(2) { 20 [0]=> 21 string(1) "A" 22 [1]=> 23 string(1) "A" 24 } 25} 26