From ff3f59b5a78d0646990bfcb8438895b3a9d36f55 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Fri, 6 Mar 2026 16:37:25 +0100
Subject: [PATCH] Fix incorrect property_info sizing for locally shadowed trait
 properties

Previously, static trait properties would always redeclare locally declared
static properties to make sure any inherited property would stop sharing a
common slot with the parent. This would leave holes in property_info, creating
issues for this code:

    zend_hash_extend(&ce->properties_info,
        zend_hash_num_elements(&ce->properties_info) +
        zend_hash_num_elements(&parent_ce->properties_info), 0);

where zend_hash_num_elements(&ce->properties_info) +
zend_hash_num_elements(&parent_ce->properties_info) is supposed to extend the
hash table enough to hold all additional properties coming from parent. However,
if ce->properties_info contains holes this might not be enough, given all parent
properties are appended at nNumUsed.

This could be fixed by further extending the hash table, but we can also avoid
the holes in properties_info completely by not redeclaring trait properties that
are already declared in the target class. This is now possible because traits
are bound before performing parent class inheritance, so if the property is
already present we know it will separate the property slot.

Fixes GH-20672
Closes GH-21358
---
 NEWS                    |  4 ++++
 Zend/tests/gh20672.phpt | 31 +++++++++++++++++++++++++++++++
 Zend/zend_inheritance.c |  4 +---
 3 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100644 Zend/tests/gh20672.phpt

diff --git a/NEWS b/NEWS
index 5437086c8e7dd..b7d4c1eee441b 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.5.5
 
+- Core:
+  . Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed
+    trait properties). (ilutov)
+
 - Bz2:
   . Fix truncation of total output size causing erroneous errors. (ndossche)
 
diff --git a/Zend/tests/gh20672.phpt b/Zend/tests/gh20672.phpt
new file mode 100644
index 0000000000000..416cd3e5a6342
--- /dev/null
+++ b/Zend/tests/gh20672.phpt
@@ -0,0 +1,31 @@
+--TEST--
+GH-20672: Incorrect property_info sizing for locally shadowed trait properties
+--CREDITS--
+Jonne Ransijn (yyny)
+--FILE--
+<?php
+
+trait T {
+    public static $a;
+    public static $b;
+    public static $c;
+}
+
+class Base {
+    public $x;
+    public $y;
+}
+
+class Child extends Base {
+    public static $a;
+    public static $b;
+    public static $c;
+    public static $d;
+
+    use T;
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
diff --git a/Zend/zend_inheritance.c b/Zend/zend_inheritance.c
index 0b24c2a990c22..d2952094a468c 100644
--- a/Zend/zend_inheritance.c
+++ b/Zend/zend_inheritance.c
@@ -2933,9 +2933,7 @@ static void zend_do_traits_property_binding(zend_class_entry *ce, zend_class_ent
 								ZSTR_VAL(prop_name),
 								ZSTR_VAL(ce->name));
 					}
-					if (!(flags & ZEND_ACC_STATIC)) {
-						continue;
-					}
+					continue;
 				}
 			}