blob: 92f91a55571f5a620e4a09c0f1a25412d4088f27 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
--TEST--
Bug #39297 (Memory corryption because of indirect modification of overloaded array)
--FILE--
<?php
function compareByRef(&$first, &$second) {
return $first === $second;
}
class MyTree implements ArrayAccess {
public $parent;
public $children = array();
public function offsetExists($offset) {
}
public function offsetUnset($offset) {
}
public function offsetSet($offset, $value) {
echo "offsetSet()\n";
$cannonicalName = strtolower($offset);
$this->children[$cannonicalName] = $value;
$value->parent = $this;
}
public function offsetGet($offset) {
echo "offsetGet()\n";
$cannonicalName = strtolower($offset);
return $this->children[$cannonicalName];
}
}
$id = 'Test';
$root = new MyTree();
$child = new MyTree();
$root[$id] = $child;
var_dump(compareByRef($root[$id], $child));
?>
--EXPECT--
offsetSet()
offsetGet()
bool(true)
|
