From 6b110b151ddb2eb123407131476aa510b73f54d0 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 21 Feb 2019 10:59:30 +0100
Subject: [PATCH] Fixed bug #77643

Resolve property initializers against the correct class, even when
parent slots are reused.
---
 ext/opcache/ZendAccelerator.c                 | 23 +++++++------------
 ext/opcache/tests/preload_010.phpt            | 15 ++++++++++++
 .../tests/preload_overwritten_prop_init.inc   | 10 ++++++++
 3 files changed, 33 insertions(+), 15 deletions(-)
 create mode 100644 ext/opcache/tests/preload_010.phpt
 create mode 100644 ext/opcache/tests/preload_overwritten_prop_init.inc

diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 5c05afc9289..f5fa1d931b6 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -3414,23 +3414,16 @@ static void preload_link(void)
 					}
 				} ZEND_HASH_FOREACH_END();
 				if (ce->default_properties_count) {
-					zend_class_entry *pce = ce;
-
-					val = ce->default_properties_table + ce->default_properties_count - 1;
-					do {
-						uint32_t count = pce->parent ? pce->default_properties_count - pce->parent->default_properties_count : pce->default_properties_count;
-
-						while (count) {
-							if (Z_TYPE_P(val) == IS_CONSTANT_AST) {
-								if (UNEXPECTED(zval_update_constant_ex(val, pce) != SUCCESS)) {
-									ok = 0;
-								}
+					uint32_t i;
+					for (i = 0; i < ce->default_properties_count; i++) {
+						val = &ce->default_properties_table[i];
+						if (Z_TYPE_P(val) == IS_CONSTANT_AST) {
+							zend_property_info *prop = ce->properties_info_table[i];
+							if (UNEXPECTED(zval_update_constant_ex(val, prop->ce) != SUCCESS)) {
+								ok = 0;
 							}
-							val--;
-							count--;
 						}
-						pce = pce->parent;
-					} while (pce && pce-> default_properties_count);
+					}
 				}
 				if (ce->default_static_members_count) {
 					uint32_t count = ce->parent ? ce->default_static_members_count - ce->parent->default_static_members_count : ce->default_static_members_count;
diff --git a/ext/opcache/tests/preload_010.phpt b/ext/opcache/tests/preload_010.phpt
new file mode 100644
index 00000000000..80967f64a69
--- /dev/null
+++ b/ext/opcache/tests/preload_010.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Initializer of overwritten property should be resolved against the correct class
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.preload={PWD}/preload_overwritten_prop_init.inc
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+var_dump((new Bar)->prop);
+?>
+--EXPECT--
+int(42)
diff --git a/ext/opcache/tests/preload_overwritten_prop_init.inc b/ext/opcache/tests/preload_overwritten_prop_init.inc
new file mode 100644
index 00000000000..9d2c6020750
--- /dev/null
+++ b/ext/opcache/tests/preload_overwritten_prop_init.inc
@@ -0,0 +1,10 @@
+<?php
+
+class Foo {
+    public $prop;
+}
+
+class Bar extends Foo {
+    public $prop = self::FOOBAR;
+    const FOOBAR = 42;
+}