1--TEST-- 2GH-10169: Fix use-after-free when releasing object during property assignment 3--FILE-- 4<?php 5class A 6{ 7 public string $prop; 8} 9class B 10{ 11 public function __toString() 12 { 13 global $a; 14 $a = null; 15 return str_repeat('a', 1); 16 } 17} 18 19$a = new A(); 20try { 21 $a->prop = new B(); 22} catch (Error $e) { 23 echo $e->getMessage(), "\n"; 24} 25 26$a = new A(); 27$a->prop = ''; 28try { 29 $a->prop = new B(); 30} catch (Error $e) { 31 echo $e->getMessage(), "\n"; 32} 33 34?> 35--EXPECT-- 36Object was released while assigning to property A::$prop 37Object was released while assigning to property A::$prop 38