1--TEST-- 2Bug #77843: Use after free with json serializer 3--SKIPIF-- 4<?php if(!extension_loaded('json')) die('skip json extension not loaded') ?> 5--FILE-- 6<?php 7 8class X implements JsonSerializable { 9 public $prop = "value"; 10 public function jsonSerialize() { 11 global $arr; 12 unset($arr[0]); 13 var_dump($this); 14 return $this; 15 } 16} 17 18$arr = [new X()]; 19var_dump(json_encode([&$arr])); 20 21?> 22--EXPECT-- 23object(X)#1 (1) { 24 ["prop"]=> 25 string(5) "value" 26} 27string(20) "[[{"prop":"value"}]]" 28
