From 92d773b1e7df1a685f5d0525824cd3f25e39b98d Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sat, 29 Jun 2024 08:42:03 +0100
Subject: [PATCH 1/3] Fix GH-14687 segfault on debugging a freed
 SplObjectIterator instance.

---
 ext/spl/spl_directory.c    |  2 +-
 ext/spl/tests/gh14687.phpt | 41 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 ext/spl/tests/gh14687.phpt

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 0440ff59c8ba9..494971a9b1369 100644
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -668,7 +668,7 @@ static inline HashTable *spl_filesystem_object_get_debug_info(zend_object *objec
 	if (intern->type == SPL_FS_DIR) {
 #ifdef HAVE_GLOB
 		pnstr = spl_gen_private_prop_name(spl_ce_DirectoryIterator, "glob", sizeof("glob")-1);
-		if (php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
+		if (intern->u.dir.dirp && php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
 			ZVAL_STR_COPY(&tmp, intern->path);
 		} else {
 			ZVAL_FALSE(&tmp);
diff --git a/ext/spl/tests/gh14687.phpt b/ext/spl/tests/gh14687.phpt
new file mode 100644
index 0000000000000..a868e75fc1ad2
--- /dev/null
+++ b/ext/spl/tests/gh14687.phpt
@@ -0,0 +1,41 @@
+--TEST--
+GH-14687 segfault on debugging SplObjectStorage instance after __destruct.
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+phar
+--INI--
+phar.require_hash=0
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar.zip';
+$phar = new Phar($fname);
+class HasDestructor {
+  public function __destruct() {
+    var_dump($GLOBALS['s']);
+  }
+}
+$s = new SplObjectStorage();
+$s[$phar] = new HasDestructor();
+--EXPECT--
+object(SplObjectStorage)#2 (1) {
+  ["storage":"SplObjectStorage":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["obj"]=>
+      object(Phar)#1 (3) {
+        ["pathName":"SplFileInfo":private]=>
+        string(0) ""
+        ["glob":"DirectoryIterator":private]=>
+        bool(false)
+        ["subPathName":"RecursiveDirectoryIterator":private]=>
+        string(0) ""
+      }
+      ["inf"]=>
+      object(HasDestructor)#3 (0) {
+      }
+    }
+  }
+}

From 77603d60cae854bf1c5d8d0335fa996a5104566d Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sat, 29 Jun 2024 09:46:29 +0100
Subject: [PATCH 2/3] fix test attempt

---
 ext/spl/tests/gh14687.phpt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ext/spl/tests/gh14687.phpt b/ext/spl/tests/gh14687.phpt
index a868e75fc1ad2..1c1b19a66b960 100644
--- a/ext/spl/tests/gh14687.phpt
+++ b/ext/spl/tests/gh14687.phpt
@@ -18,6 +18,9 @@ class HasDestructor {
 }
 $s = new SplObjectStorage();
 $s[$phar] = new HasDestructor();
+register_shutdown_function(function() {
+	global $s;
+});
 --EXPECT--
 object(SplObjectStorage)#2 (1) {
   ["storage":"SplObjectStorage":private]=>

From 831b036130ed4272f314eb202dfe187240cdb2b2 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Mon, 28 Oct 2024 20:53:39 +0000
Subject: [PATCH 3/3] changes test from feedback

---
 ext/spl/tests/gh14687.phpt | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ext/spl/tests/gh14687.phpt b/ext/spl/tests/gh14687.phpt
index 1c1b19a66b960..1e95d6b6517cc 100644
--- a/ext/spl/tests/gh14687.phpt
+++ b/ext/spl/tests/gh14687.phpt
@@ -9,7 +9,7 @@ phar.require_hash=0
 phar.readonly=0
 --FILE--
 <?php
-$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar.zip';
+$fname = __DIR__ . '/gh14687.phar.zip';
 $phar = new Phar($fname);
 class HasDestructor {
   public function __destruct() {
@@ -21,6 +21,11 @@ $s[$phar] = new HasDestructor();
 register_shutdown_function(function() {
 	global $s;
 });
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh14687.phar.zip');
+?>
 --EXPECT--
 object(SplObjectStorage)#2 (1) {
   ["storage":"SplObjectStorage":private]=>