Fix phpGH-14687 segfault on debugging a freed SplObjectIterator insta…

…nce.

ext/spl/spl_directory.c

@@ -668,7 +668,7 @@ static inline HashTable *spl_filesystem_object_get_debug_info(zend_object *objec
  if (intern->type == SPL_FS_DIR) {
 #ifdef HAVE_GLOB
  pnstr = spl_gen_private_prop_name(spl_ce_DirectoryIterator, "glob", sizeof("glob")-1);
- if (php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
+ if (intern->u.dir.dirp && php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
  ZVAL_STR_COPY(&tmp, intern->path);
  } else {
  ZVAL_FALSE(&tmp);

ext/spl/tests/gh14687.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GH-14687 segfault on debugging SplObjectStorage instance after __destruct.
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+phar
+--INI--
+phar.require_hash=0
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar.zip';
+$phar = new Phar($fname);
+class HasDestructor {
+ public function __destruct() {
+ var_dump($GLOBALS['s']);
+ }
+}
+$s = new SplObjectStorage();
+$s[$phar] = new HasDestructor();
+--EXPECT--
+object(SplObjectStorage)#2 (1) {
+ ["storage":"SplObjectStorage":private]=>
+ array(1) {
+ [0]=>
+ array(2) {
+ ["obj"]=>
+ object(Phar)#1 (3) {
+ ["pathName":"SplFileInfo":private]=>
+ string(0) ""
+ ["glob":"DirectoryIterator":private]=>
+ bool(false)
+ ["subPathName":"RecursiveDirectoryIterator":private]=>
+ string(0) ""
+ }
+ ["inf"]=>
+ object(HasDestructor)#3 (0) {
+ }
+ }
+ }
+}