Fix ref source removal on object destruction

Author: nikic

Zend/tests/type_declarations/typed_properties_093.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Typed property assignment by ref with variable name
+--FILE--
+<?php
+
+class Test {
+    public int $prop;
+}
+
+$name = new class {
+    public function __toString() {
+        return 'prop';
+    }
+};
+
+$test = new Test;
+$ref = "foobar";
+try {
+    $test->$name =& $ref;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump($test);
+
+?>
+--EXPECT--
+Typed property Test::$prop must be int, string used
+object(Test)#2 (1) {
+  ["prop"]=>
+  NULL
+}

Zend/tests/type_declarations/typed_properties_094.phpt

@@ -0,0 +1,36 @@
+--TEST--
+Edge cases relating to reference source tracking
+--FILE--
+<?php
+
+class A {
+    public int $prop = 42;
+}
+class B extends A {
+}
+
+$b = new B;
+$r =& $b->prop;
+unset($b);
+$r = "foo"; // ok
+
+class A2 {
+    private int $prop = 42;
+
+    public function &getRef() {
+        return $this->prop;
+    }
+}
+class B2 extends A2 {
+    public $prop;
+}
+
+$b2 = new B2;
+$r2 =& $b2->getRef();
+unset($b2);
+$r2 = "foo"; // ok
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/zend_objects.c

@@ -59,13 +59,10 @@ ZEND_API void zend_object_std_dtor(zend_object *object)
 		do {
 			if (Z_REFCOUNTED_P(p)) {
 				if (UNEXPECTED(Z_ISREF_P(p))) {
-					zend_property_info *prop_info;
-					ZEND_REF_FOREACH_TYPE_SOURCES(Z_REF_P(p), prop_info) {
-						if (prop_info->ce == object->ce && p == OBJ_PROP(object, prop_info->offset)) {
-							ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(p), prop_info);
-							break; /* stop iteration here, the array might be realloc()'ed */
-						}
-					} ZEND_REF_FOREACH_TYPE_SOURCES_END();
+					zend_property_info *prop_info = zend_get_property_info_for_slot(object, p);
+					if (prop_info->type) {
+						ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(p), prop_info);
+					}
 				}
 				i_zval_ptr_dtor(p);
 			}