Fix leaked parent property default value

Fixes OSS-Fuzz #474613951
Closes GH-20911

NEWS

@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
   . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
   . Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud)
+  . Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)
 
 - MbString:
   . Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is

Zend/tests/oss-fuzz-474613951.phpt

@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz #474613951: Leaked parent property default value
+--FILE--
+<?php
+
+class A {
+    public $prop = C { get => $this->prop; }
+}
+
+class B extends A {
+    public $prop { get => 42; }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/zend_inheritance.c

@@ -1495,10 +1495,9 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
 				}
 
 				int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
+				/* Don't keep default properties in GC (they may be freed by opcache) */
+				zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
 				if (child_info->offset != ZEND_VIRTUAL_PROPERTY_OFFSET) {
-					/* Don't keep default properties in GC (they may be freed by opcache) */
-					zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
-
 					if (use_child_prop) {
 						ZVAL_UNDEF(&ce->default_properties_table[parent_num]);
 					} else {