From c44c46be1ccdd824bef81221bd6d3e653301b177 Mon Sep 17 00:00:00 2001
From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Thu, 9 Jun 2022 10:48:52 +0200
Subject: [PATCH] Fix refcount of declared properties when casting objects to
 arrays

---
 Zend/tests/bugGH-8655.phpt  | 29 +++++++++++++++++++++++++++++
 Zend/zend_object_handlers.c |  4 ++++
 2 files changed, 33 insertions(+)
 create mode 100644 Zend/tests/bugGH-8655.phpt

diff --git a/Zend/tests/bugGH-8655.phpt b/Zend/tests/bugGH-8655.phpt
new file mode 100644
index 0000000000000..d484c65d0e5e6
--- /dev/null
+++ b/Zend/tests/bugGH-8655.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug GH-8655 (zval reference is not released when targetting a declared property)
+--FILE--
+<?php
+class Foo
+{
+    public $foo;
+}
+
+function hydrate($properties, $object)
+{
+    foreach ($properties as $name => &$value) {
+        $object->$name = &$value;
+    }
+};
+
+$object = new Foo;
+
+hydrate(['foo' => 123], $object);
+
+$arrayCast = (array) $object;
+
+$object->foo = 234;
+var_dump(ReflectionReference::fromArrayElement($arrayCast, 'foo'));
+echo $arrayCast['foo'];
+?>
+--EXPECT--
+NULL
+123
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 3b0cfab1778d4..966ba0dd6ed72 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -111,6 +111,10 @@ ZEND_API HashTable *zend_std_build_object_properties_array(zend_object *zobj) /*
 				continue;
 			}
 
+			if (Z_ISREF_P(prop) && Z_REFCOUNT_P(prop) == 1) {
+				prop = Z_REFVAL_P(prop);
+			}
+
 			Z_TRY_ADDREF_P(prop);
 			_zend_hash_append(ht, prop_info->name, prop);
 		}