Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
  Undef slot before destroying in unset_property

Zend/tests/unset_prop_recursion.phpt

@@ -0,0 +1,65 @@
+--TEST--
+Unset property where unset will recursively access property again
+--FILE--
+<?php
+class Node {
+    public $parent = null;
+    public $children = [];
+    function insert(Node $node) {
+        $node->parent = $this;
+        $this->children[] = $node;
+    }
+    function __destruct() {
+        var_dump($this);
+        unset($this->children);
+    }
+}
+
+$a = new Node;
+$a->insert(new Node);
+$a->insert(new Node);
+?>
+--EXPECT--
+object(Node)#1 (2) {
+  ["parent"]=>
+  NULL
+  ["children"]=>
+  array(2) {
+    [0]=>
+    object(Node)#2 (2) {
+      ["parent"]=>
+      *RECURSION*
+      ["children"]=>
+      array(0) {
+      }
+    }
+    [1]=>
+    object(Node)#3 (2) {
+      ["parent"]=>
+      *RECURSION*
+      ["children"]=>
+      array(0) {
+      }
+    }
+  }
+}
+object(Node)#2 (2) {
+  ["parent"]=>
+  object(Node)#1 (2) {
+    ["parent"]=>
+    NULL
+  }
+  ["children"]=>
+  array(0) {
+  }
+}
+object(Node)#3 (2) {
+  ["parent"]=>
+  object(Node)#1 (2) {
+    ["parent"]=>
+    NULL
+  }
+  ["children"]=>
+  array(0) {
+  }
+}

Zend/zend_object_handlers.c

@@ -999,8 +999,10 @@ ZEND_API void zend_std_unset_property(zend_object *zobj, zend_string *name, void
 					ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(slot), prop_info);
 				}
 			}
-			zval_ptr_dtor(slot);
+			zval tmp;
+			ZVAL_COPY_VALUE(&tmp, slot);
 			ZVAL_UNDEF(slot);
+			zval_ptr_dtor(&tmp);
 			if (zobj->properties) {
 				HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
 			}