Fix GH-14687 segfault on debugging a freed SplObjectIterator instance.

Author: devnexen

ext/spl/spl_directory.c

@@ -668,7 +668,7 @@ static inline HashTable *spl_filesystem_object_get_debug_info(zend_object *objec
 	if (intern->type == SPL_FS_DIR) {
 #ifdef HAVE_GLOB
 		pnstr = spl_gen_private_prop_name(spl_ce_DirectoryIterator, "glob", sizeof("glob")-1);
-		if (php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
+		if (intern->u.dir.dirp && php_stream_is(intern->u.dir.dirp ,&php_glob_stream_ops)) {
 			ZVAL_STR_COPY(&tmp, intern->path);
 		} else {
 			ZVAL_FALSE(&tmp);

ext/spl/tests/gh14687.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GH-14687 segfault on debugging SplObjectStorage instance after __destruct.
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+phar
+--INI--
+phar.require_hash=0
+phar.readonly=0
+--FILE--
+<?php
+$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar.zip';
+$phar = new Phar($fname);
+class HasDestructor {
+  public function __destruct() {
+    var_dump($GLOBALS['s']);
+  }
+}
+$s = new SplObjectStorage();
+$s[$phar] = new HasDestructor();
+--EXPECT--
+object(SplObjectStorage)#2 (1) {
+  ["storage":"SplObjectStorage":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["obj"]=>
+      object(Phar)#1 (3) {
+        ["pathName":"SplFileInfo":private]=>
+        string(0) ""
+        ["glob":"DirectoryIterator":private]=>
+        bool(false)
+        ["subPathName":"RecursiveDirectoryIterator":private]=>
+        string(0) ""
+      }
+      ["inf"]=>
+      object(HasDestructor)#3 (0) {
+      }
+    }
+  }
+}