So... the add_property_str() version unintentionally took ownership of the zend_string and released it

Author: Girgias

Zend/zend_API.h

@@ -539,9 +539,13 @@ static zend_always_inline void add_property_double_ex(zval *z_object, const char
 }
 static zend_always_inline void add_property_str(zval *z_object, const char *name, zend_string *value) {
 	zend_update_property_str(Z_OBJCE_P(z_object), Z_OBJ_P(z_object), name, strlen(name), value);
+	/* This legacy API assumed that the passed zend_string* would be freed */
+	zend_string_release(value);
 }
 static zend_always_inline void add_property_str_ex(zval *z_object, const char *name, size_t name_length, zend_string *value) {
 	zend_update_property_str(Z_OBJCE_P(z_object), Z_OBJ_P(z_object), name, name_length, value);
+	/* This legacy API assumed that the passed zend_string* would be freed */
+	zend_string_release(value);
 }
 static zend_always_inline void add_property_string(zval *z_object, const char *name, const char *value) {
 	zend_update_property_string(Z_OBJCE_P(z_object), Z_OBJ_P(z_object), name, strlen(name), value);