1--TEST-- 2Bug #77843: Use after free with json serializer 3--FILE-- 4<?php 5 6class X implements JsonSerializable { 7 public $prop = "value"; 8 public function jsonSerialize(): mixed { 9 global $arr; 10 unset($arr[0]); 11 var_dump($this); 12 return $this; 13 } 14} 15 16$arr = [new X()]; 17var_dump(json_encode([&$arr])); 18 19?> 20--EXPECT-- 21object(X)#1 (1) { 22 ["prop"]=> 23 string(5) "value" 24} 25string(20) "[[{"prop":"value"}]]" 26
