More tests

Author: iluuu1994

Zend/tests/gh10168_3.phpt

@@ -7,9 +7,12 @@ class Test
 	static ?Test $a = null;
 
 	public function __construct() {
-		if (self::$a === null) {
-			var_dump(self::$a = &$this);
+		static $i = 0;
+		$i++;
+		if ($i === 1) {
+			var_dump(self::$a = $this);
 		} else {
+			// Avoid cache slot, triggering write_property
 			var_dump(self::$a = $this);
 		}
 	}

Zend/tests/gh10168_4.phpt

@@ -1,5 +1,5 @@
 --TEST--
-GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign prop
 --FILE--
 <?php
 

Zend/tests/gh10168_7.phpt

@@ -0,0 +1,31 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed static prop by ref
+--XFAIL--
+--FILE--
+<?php
+
+class Test
+{
+	static ?Test $a = null;
+
+	public function __construct() {
+		var_dump(self::$a = &$this);
+	}
+
+	function __destruct() {
+		var_dump(self::$a);
+		self::$a = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+object(Test)#2 (0) {
+}
+object(Test)#2 (0) {
+}
+NULL

Zend/tests/gh10168_8.phpt

@@ -0,0 +1,36 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop
+--FILE--
+<?php
+
+class Box {
+	public ?Test $storage = null;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		global $box;
+		var_dump($box->storage = $this);
+	}
+
+	function __destruct() {
+		global $box;
+		var_dump($box->storage);
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}
+object(Test)#3 (0) {
+}
+NULL