From be7e819068985859f92e4af21e49b4f647dd0467 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sat, 17 Aug 2019 10:57:26 +0200
Subject: [PATCH] Fixed bug #77922

In PHP 7.3 shadow properties are no longer duplicated. Make sure we
only release them if the property was defined on the parent class,
which means that it changed from private->shadow, which is where
duplication does happen.
---
 NEWS                     |  4 ++++
 Zend/tests/bug77922.phpt | 20 ++++++++++++++++++++
 Zend/zend_opcode.c       |  3 ++-
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug77922.phpt

diff --git a/NEWS b/NEWS
index 07bd89152ac..9ddf7bcf83f 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.10
 
+- Core:
+  . Fixed bug #77922 (Double release of doc comment on inherited shadow
+    property). (Nikita)
+
 - Intl:
   . Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8()
     when requested. (Sara)
diff --git a/Zend/tests/bug77922.phpt b/Zend/tests/bug77922.phpt
new file mode 100644
index 00000000000..2984f4c8737
--- /dev/null
+++ b/Zend/tests/bug77922.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #77922: Double release of doc comment on inherited shadow property
+--FILE--
+<?php
+
+class A {
+    /** Foo */
+    private $prop;
+}
+
+class B extends A {
+}
+
+class C extends B {
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index cd1525bdab9..a7f32de3798 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -235,7 +235,8 @@ ZEND_API void destroy_zend_class(zval *zv)
 				efree(ce->default_static_members_table);
 			}
 			ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
-				if (prop_info->ce == ce || (prop_info->flags & ZEND_ACC_SHADOW)) {
+				if (prop_info->ce == ce ||
+						((prop_info->flags & ZEND_ACC_SHADOW) && prop_info->ce == ce->parent)) {
 					zend_string_release_ex(prop_info->name, 0);
 					if (prop_info->doc_comment) {
 						zend_string_release_ex(prop_info->doc_comment, 0);