1--TEST-- 2Bug #81992 (SplFixedArray::setSize() causes use-after-free) - setSize variation 3--FILE-- 4<?php 5class InvalidDestructor { 6 public function __construct( 7 private int $desiredSize, 8 private SplFixedArray $obj, 9 ) {} 10 11 public function __destruct() { 12 echo "In destructor\n"; 13 $this->obj->setSize($this->desiredSize); 14 echo "Destroyed, size is now still ", $this->obj->getSize(), "\n"; 15 } 16} 17 18class DestructorLogger { 19 public function __construct(private int $id) {} 20 21 public function __destruct() { 22 echo "Destroyed the logger with id ", $this->id, "\n"; 23 } 24} 25 26function test(int $desiredSize) { 27 $obj = new SplFixedArray(5); 28 $obj[0] = str_repeat("A", 10); 29 $obj[1] = new DestructorLogger(1); 30 $obj[2] = str_repeat('B', 10); 31 $obj[3] = new InvalidDestructor($desiredSize, $obj); 32 $obj[4] = new DestructorLogger(4); 33 $obj->setSize(2); 34 echo "Size is now ", $obj->getSize(), "\n"; 35 echo "Done\n"; 36} 37 38echo "--- Smaller size test ---\n"; 39test(1); 40echo "--- Equal size test ---\n"; 41test(2); 42echo "--- Larger size test ---\n"; 43test(10); 44?> 45--EXPECT-- 46--- Smaller size test --- 47In destructor 48Destroyed, size is now still 2 49Destroyed the logger with id 4 50Destroyed the logger with id 1 51Size is now 1 52Done 53--- Equal size test --- 54In destructor 55Destroyed, size is now still 2 56Destroyed the logger with id 4 57Size is now 2 58Done 59Destroyed the logger with id 1 60--- Larger size test --- 61In destructor 62Destroyed, size is now still 2 63Destroyed the logger with id 4 64Size is now 10 65Done 66Destroyed the logger with id 1 67
