Using enum objects in property initializers leaks

[bwoebi]

Description

<?php

enum AnEnum
{
    case Value;
}

class AClass
{
    public $prop = AnEnum::Value;
}

var_dump(new AClass);

leaks the AnEnum::Value enum object.

The reason is that the enum object gets stored in the default property table of AClass, but objects are freed before default property tables are destroyed:

• zend_objects_store_free_object_storage does an addref, as the object is not released yet
• destroy_zend_class reduces refcount when freeing default properties, but too late, it's (obviously) called after object storage freeing.

PHP Version

PHP 8.1 / master