From 6c5bed3c5671acfbbd53cc31edff06407dab3f93 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Thu, 2 Apr 2026 15:28:33 +0200
Subject: [PATCH 1/2] Fix missing addref for __unset

Fixes GH-21603
Closes GH-21604
---
 NEWS                        |  1 +
 Zend/tests/gh21603.phpt     | 22 ++++++++++++++++++++++
 Zend/zend_object_handlers.c |  2 ++
 3 files changed, 25 insertions(+)
 create mode 100644 Zend/tests/gh21603.phpt

diff --git a/NEWS b/NEWS
index 6c284c501b0a..8c423fe61cec 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov)
   . Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving
     self::/parent::/static:: callables if the error handler throws). (macoaure)
+  . Fixed bug GH-21603 (Missing addref for __unset). (ilutov)
 
 - Curl:
   . Add support for brotli and zstd on Windows. (Shivam Mathur)
diff --git a/Zend/tests/gh21603.phpt b/Zend/tests/gh21603.phpt
new file mode 100644
index 000000000000..ab2fbc44e797
--- /dev/null
+++ b/Zend/tests/gh21603.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-21603: Missing addref for __unset
+--CREDITS--
+cnwangjihe
+--FILE--
+<?php
+
+class C {
+    public function __unset($name) {
+        global $c;
+        $c = null;
+        var_dump($this);
+    }
+}
+
+$c = new C;
+unset($c->prop);
+
+?>
+--EXPECTF--
+object(C)#%d (0) {
+}
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 28fd8254249c..50f563b2c605 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1653,9 +1653,11 @@ ZEND_API void zend_std_unset_property(zend_object *zobj, zend_string *name, void
 		}
 		if (!((*guard) & IN_UNSET)) {
 			/* have unsetter - try with it! */
+			GC_ADDREF(zobj);
 			(*guard) |= IN_UNSET; /* prevent circular unsetting */
 			zend_std_call_unsetter(zobj, name);
 			(*guard) &= ~IN_UNSET;
+			OBJ_RELEASE(zobj);
 			return;
 		} else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
 			/* Trigger the correct error */

From d0d1627f25df295cc3c081e9e36a4cf290472923 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Tue, 14 Apr 2026 14:29:29 +0100
Subject: [PATCH 2/2] ext/phar: add missing EXTENSIONS section for test
 (#21744)

---
 ext/phar/tests/invalid_string_phar_mungserver.phpt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ext/phar/tests/invalid_string_phar_mungserver.phpt b/ext/phar/tests/invalid_string_phar_mungserver.phpt
index 46de113f6c08..8128987dacbc 100644
--- a/ext/phar/tests/invalid_string_phar_mungserver.phpt
+++ b/ext/phar/tests/invalid_string_phar_mungserver.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Passing invalid string to Phar::mungServer()
+--EXTENSIONS--
+phar
 --FILE--
 <?php