[php-src] PR #24251: Fix GH-24250: Set visibility not enforced after write forwarded to `__set()`

From: Date: Sun, 11 Oct 2026 00:07:03 +0000
Subject: [php-src] PR #24251: Fix GH-24250: Set visibility not enforced after write forwarded to `__set()`
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39330@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24251 Author: DirkHoffman Fixes GH-24250. > **LLM-generated description:** Since 94136cf9bf (GH-22709), the > ZEND_ASSIGN_OBJ fast path skips the set visibility check when the > cache slot is primed, relying on zend_std_write_property() to reset > the slot when the check fails. When an unset property is written through > __set(), the check is skipped altogether and the slot primed by > zend_get_property_offset() stays valid, so the next write at the > same call site to an initialized property bypasses > protected(set)/private(set) (also > from child classes, and for private(set) readonly in > __clone()). This resets the cache slot in that case as well, so > __set() forwarding itself is unchanged. > > The new test fails on 8.6.0RC3 / current PHP-8.6 and passes on 8.4 and 8.5 (same expected > output). Found and verified with the help of AI tools.

« previous php.git-pulls (#39330) next »