Add test demonstrating write_property problem

Author: iluuu1994

Zend/tests/gh10168_3.phpt

@@ -1,5 +1,5 @@
 --TEST--
-GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed static prop
 --FILE--
 <?php
 class Test

Zend/tests/gh10168_4.phpt

@@ -11,16 +11,9 @@ $box = new Box();
 
 class Test
 {
-	static ?Test $a = null;
-
 	public function __construct() {
 		global $box;
-
-		if (self::$a === null) {
-			var_dump($box->storage = $this);
-		} else {
-			var_dump($box->storage = $this);
-		}
+		var_dump($box->storage = $this);
 	}
 
 	function __destruct() {

Zend/tests/gh10168_5.phpt

@@ -1,5 +1,5 @@
 --TEST--
-GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): allocated assignment in destructor
 --FILE--
 <?php
 

Zend/tests/gh10168_6.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop without cache slot
+--XFAIL--
+--FILE--
+<?php
+
+class Box {
+	public $storage;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		static $i = 0;
+		$i++;
+		global $box;
+		if ($i === 1) {
+			var_dump($box->storage = $this);
+		} else {
+			// Avoid cache slot, triggering write_property
+			var_dump($box->storage = $this);
+		}
+	}
+
+	function __destruct() {
+		global $box;
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}