1--TEST-- 2GH-16478: Use-after-free in SplFixedArray::unset() 3--FILE-- 4<?php 5 6class C { 7 function __destruct() { 8 global $arr; 9 $arr->setSize(0); 10 } 11} 12 13$arr = new SplFixedArray(2); 14$arr[0] = new C; 15unset($arr[0]); 16var_dump($arr); 17 18?> 19--EXPECT-- 20object(SplFixedArray)#1 (0) { 21} 22