Fixed bug #77922

In PHP 7.3 shadow properties are no longer duplicated. Make sure we
only release them if the property was defined on the parent class,
which means that it changed from private->shadow, which is where
duplication does happen.

Author: nikic

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.10
 
+- Core:
+  . Fixed bug #77922 (Double release of doc comment on inherited shadow
+    property). (Nikita)
+
 - Intl:
   . Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8()
     when requested. (Sara)

Zend/tests/bug77922.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #77922: Double release of doc comment on inherited shadow property
+--FILE--
+<?php
+
+class A {
+    /** Foo */
+    private $prop;
+}
+
+class B extends A {
+}
+
+class C extends B {
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/zend_opcode.c

@@ -235,7 +235,8 @@ ZEND_API void destroy_zend_class(zval *zv)
 				efree(ce->default_static_members_table);
 			}
 			ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
-				if (prop_info->ce == ce || (prop_info->flags & ZEND_ACC_SHADOW)) {
+				if (prop_info->ce == ce ||
+						((prop_info->flags & ZEND_ACC_SHADOW) && prop_info->ce == ce->parent)) {
 					zend_string_release_ex(prop_info->name, 0);
 					if (prop_info->doc_comment) {
 						zend_string_release_ex(prop_info->doc_comment, 0);