3v4l.org

run code in 500+ PHP versions simultaneously
<?php class Container { public function getObject() { $this->object = new StringableObject(); return $this->object; } // This destructor is required to exist to trigger the segfault public function __destruct() { } } class StringableObject { public function __toString() { $this->test = $this; return ''; } } $container = new Container(); $object = $container->getObject(); // Any kind of function which triggers a 'to string' object conversion // Casting $object with (string) will circumvent the problem echo trim($object); // Another call is required to corrupt heap echo trim('test');
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  (null)
number of ops:  12
compiled vars:  !0 = $container, !1 = $object
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   17     0  E >   DECLARE_CLASS                                                'stringableobject'
   27     1        NEW                                                  $2      'Container'
          2        DO_FCALL                                          0          
          3        ASSIGN                                                       !0, $2
   28     4        INIT_METHOD_CALL                                             !0, 'getObject'
          5        DO_FCALL                                          0  $5      
          6        ASSIGN                                                       !1, $5
   32     7        FRAMELESS_ICALL_1                trim                ~7      !1
          8        ECHO                                                         ~7
   34     9        FRAMELESS_ICALL_1                trim                ~8      'test'
         10        ECHO                                                         ~8
         11      > RETURN                                                       1

Class Container:
Function getobject:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  getObject
number of ops:  7
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    6     0  E >   NEW                                                  $1      'StringableObject'
          1        DO_FCALL                                          0          
          2        ASSIGN_OBJ                                                   'object'
          3        OP_DATA                                                      $1
    8     4        FETCH_OBJ_R                                          ~3      'object'
          5      > RETURN                                                       ~3
    9     6*     > RETURN                                                       null

End of function getobject

Function __destruct:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  __destruct
number of ops:  1
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   14     0  E > > RETURN                                                       null

End of function __destruct

End of class Container.

Class StringableObject:
Function __tostring:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/mqWTN
function name:  __toString
number of ops:  6
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   21     0  E >   FETCH_THIS                                           ~1      
          1        ASSIGN_OBJ                                                   'test'
          2        OP_DATA                                                      ~1
   23     3      > RETURN                                                       ''
   24     4*       VERIFY_RETURN_TYPE                                           
          5*     > RETURN                                                       null

End of function __tostring

End of class StringableObject.

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
160.64 ms | 2952 KiB | 13 Q