php-src/ext/json/tests/bug77843.phpt

--TEST--
Bug #77843: Use after free with json serializer
--FILE--
<?php

class X implements JsonSerializable {
    public $prop = "value";
    public function jsonSerialize(): mixed {
        global $arr;
        unset($arr[0]);
        var_dump($this);
        return $this;
    }
}

$arr = [new X()];
var_dump(json_encode([&$arr]));

?>
--EXPECT--
object(X)#1 (1) {
  ["prop"]=>
  string(5) "value"
}
string(20) "[[{"prop":"value"}]]"