3v4l.org

run code in 300+ PHP versions simultaneously
<?php class Container { public function getObject() { $this->object = new StringableObject(); return $this->object; } // This destructor is required to exist to trigger the segfault public function __destruct() { } } class StringableObject { public function __toString() { $this->test = $this; return ''; } } $container = new Container(); $object = $container->getObject(); // Any kind of function which triggers a 'to string' object conversion // Casting $object with (string) will circumvent the problem echo trim($object); // Another call is required to corrupt heap echo trim('test');
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  (null)
number of ops:  16
compiled vars:  !0 = $container, !1 = $object
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   17     0  E >   DECLARE_CLASS                                            'stringableobject'
   27     1        NEW                                              $2      'Container'
          2        DO_FCALL                                      0          
          3        ASSIGN                                                   !0, $2
   28     4        INIT_METHOD_CALL                                         !0, 'getObject'
          5        DO_FCALL                                      0  $5      
          6        ASSIGN                                                   !1, $5
   32     7        INIT_FCALL                                               'trim'
          8        SEND_VAR                                                 !1
          9        DO_ICALL                                         $7      
         10        ECHO                                                     $7
   34    11        INIT_FCALL                                               'trim'
         12        SEND_VAL                                                 'test'
         13        DO_ICALL                                         $8      
         14        ECHO                                                     $8
         15      > RETURN                                                   1

Class Container:
Function getobject:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  getObject
number of ops:  7
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    6     0  E >   NEW                                              $1      'StringableObject'
          1        DO_FCALL                                      0          
          2        ASSIGN_OBJ                                               'object'
          3        OP_DATA                                                  $1
    8     4        FETCH_OBJ_R                                      ~3      'object'
          5      > RETURN                                                   ~3
    9     6*     > RETURN                                                   null

End of function getobject

Function __destruct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  __destruct
number of ops:  1
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   14     0  E > > RETURN                                                   null

End of function __destruct

End of class Container.

Class StringableObject:
Function __tostring:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  __toString
number of ops:  6
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   21     0  E >   FETCH_THIS                                       ~1      
          1        ASSIGN_OBJ                                               'test'
          2        OP_DATA                                                  ~1
   23     3      > RETURN                                                   ''
   24     4*       VERIFY_RETURN_TYPE                                       
          5*     > RETURN                                                   null

End of function __tostring

End of class StringableObject.

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
153.54 ms | 1392 KiB | 15 Q