Clear after first failed check

Author: nielsdos

Zend/zend_execute.c

@@ -3232,6 +3232,9 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 				return;
 			}
 		}
+	} else if (prop_op_type == IS_CONST) {
+		/* CE mismatch, make cache slot consistent */
+		cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
 	}
 
 	/* Pointer on property callback is required */
@@ -3267,7 +3270,7 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 
 		if (prop_op_type == IS_CONST) {
 			prop_info = CACHED_PTR_EX(cache_slot + 2);
-			if (prop_info && EXPECTED(zobj->ce == CACHED_PTR_EX(cache_slot))) {
+			if (prop_info) {
 				if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags))) {
 					goto end;
 				}

ext/opcache/jit/zend_jit_helpers.c

@@ -2084,7 +2084,7 @@ static void ZEND_FASTCALL zend_jit_fetch_obj_w_slow(zend_object *zobj)
 
 			if (opline->op2_type == IS_CONST) {
 				prop_info = CACHED_PTR_EX(cache_slot + 2);
-				if (!prop_info || !EXPECTED(zobj->ce == CACHED_PTR_EX(cache_slot))) {
+				if (!prop_info) {
 					break;
 				}
 			}