mirror of
https://github.com/php/php-src.git
synced 2024-12-02 22:34:55 +08:00
f92a03627a
This can happen if zend_call_function inserted a dummy frame, and we already switched to the dummy frame in leave_helper, and an exception is thrown during CV destruction. Fixes oss-fuzz #25343.
26 lines
504 B
PHP
26 lines
504 B
PHP
--TEST--
|
|
EX(func) can be null during write_property in an edge case
|
|
--FILE--
|
|
<?php
|
|
class a {
|
|
public static $i = 0;
|
|
function __destruct() {
|
|
if (self::$i++ != 0) throw new Exception;
|
|
$b = new a;
|
|
echo $b;
|
|
}
|
|
}
|
|
new a;
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d
|
|
Stack trace:
|
|
#0 %s(%d): a->__destruct()
|
|
#1 {main}
|
|
|
|
Next Exception in %s:%d
|
|
Stack trace:
|
|
#0 %s(%d): a->__destruct()
|
|
#1 {main}
|
|
thrown in %s on line %d
|