From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sat, 17 Aug 2019 08:57:26 +0000 (+0200)
Subject: Fixed bug #77922
X-Git-Tag: php-7.4.0beta4~6^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=be7e819068985859f92e4af21e49b4f647dd0467;p=php

Fixed bug #77922

In PHP 7.3 shadow properties are no longer duplicated. Make sure we
only release them if the property was defined on the parent class,
which means that it changed from private->shadow, which is where
duplication does happen.
---

diff --git a/NEWS b/NEWS
index 07bd89152a..9ddf7bcf83 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.10
 
+- Core:
+  . Fixed bug #77922 (Double release of doc comment on inherited shadow
+    property). (Nikita)
+
 - Intl:
   . Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8()
     when requested. (Sara)
diff --git a/Zend/tests/bug77922.phpt b/Zend/tests/bug77922.phpt
new file mode 100644
index 0000000000..2984f4c873
--- /dev/null
+++ b/Zend/tests/bug77922.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #77922: Double release of doc comment on inherited shadow property
+--FILE--
+<?php
+
+class A {
+    /** Foo */
+    private $prop;
+}
+
+class B extends A {
+}
+
+class C extends B {
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index cd1525bdab..a7f32de379 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -235,7 +235,8 @@ ZEND_API void destroy_zend_class(zval *zv)
 				efree(ce->default_static_members_table);
 			}
 			ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
-				if (prop_info->ce == ce || (prop_info->flags & ZEND_ACC_SHADOW)) {
+				if (prop_info->ce == ce ||
+						((prop_info->flags & ZEND_ACC_SHADOW) && prop_info->ce == ce->parent)) {
 					zend_string_release_ex(prop_info->name, 0);
 					if (prop_info->doc_comment) {
 						zend_string_release_ex(prop_info->doc_comment, 0);