mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
a2a7287b87
The array merging function may still hold the properties array while the object is already being destroyed. Therefore, we should take into account the refcount in simplexml's destruction code. It may be possible to trigger this in other ways too. Closes GH-17421.
23 lines
444 B
PHP
23 lines
444 B
PHP
--TEST--
|
|
GH-17409 (Assertion failure Zend/zend_hash.c)
|
|
--EXTENSIONS--
|
|
simplexml
|
|
--CREDITS--
|
|
YuanchengJiang
|
|
--FILE--
|
|
<?php
|
|
$root = simplexml_load_string('<?xml version="1.0"?>
|
|
<root xmlns:reserved="reserved-ns">
|
|
<child reserved:attribute="Sample" />
|
|
</root>
|
|
');
|
|
// Need to use $GLOBALS such that simplexml object is destroyed
|
|
var_dump(array_merge_recursive($GLOBALS, $GLOBALS)["root"]);
|
|
?>
|
|
--EXPECT--
|
|
array(1) {
|
|
["child"]=>
|
|
array(0) {
|
|
}
|
|
}
|