Commit 4bfaf549f67 for php.net

commit 4bfaf549f670060d692978b74eb9027564544d65
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Sun Jan 11 19:26:34 2026 +0100

    Fix leaked parent property default value

    Fixes OSS-Fuzz #474613951
    Closes GH-20911

diff --git a/NEWS b/NEWS
index d1e88208d83..5572f87df12 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
   . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
   . Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud)
+  . Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)

 - MbString:
   . Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is
diff --git a/Zend/tests/oss-fuzz-474613951.phpt b/Zend/tests/oss-fuzz-474613951.phpt
new file mode 100644
index 00000000000..552be2e0116
--- /dev/null
+++ b/Zend/tests/oss-fuzz-474613951.phpt
@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz #474613951: Leaked parent property default value
+--FILE--
+<?php
+
+class A {
+    public $prop = C { get => $this->prop; }
+}
+
+class B extends A {
+    public $prop { get => 42; }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
diff --git a/Zend/zend_inheritance.c b/Zend/zend_inheritance.c
index f7f757b438e..56e5bdb9295 100644
--- a/Zend/zend_inheritance.c
+++ b/Zend/zend_inheritance.c
@@ -1495,10 +1495,9 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
 				}

 				int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
+				/* Don't keep default properties in GC (they may be freed by opcache) */
+				zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
 				if (child_info->offset != ZEND_VIRTUAL_PROPERTY_OFFSET) {
-					/* Don't keep default properties in GC (they may be freed by opcache) */
-					zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
-
 					if (use_child_prop) {
 						ZVAL_UNDEF(&ce->default_properties_table[parent_num]);
 					} else {