Fix comments between -> and keyword

Comments should not fall out of ST_LOOKING_FOR_PROPERTY.

Fixes phpGH-14961
Closes phpGH-14976

Author: iluuu1994

NEWS

@@ -14,6 +14,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
   . Fixed bug GH-14969 (Use-after-free in property coercion with __toString()).
     (ilutov)
+  . Fixed bug GH-14961 (Comment between -> and keyword results in parse error).
+    (ilutov)
 
 - Dom:
   . Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)

Zend/tests/gh14961.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-14961: Comment between -> and keyword
+--FILE--
+<?php
+
+class C {
+    public $class = C::class;
+}
+
+$c = new C();
+$c->/* comment */class = 42;
+var_dump($c->/** doc comment */class);
+var_dump($c->
+    // line comment
+    class);
+var_dump($c->
+    # hash comment
+    class);
+var_dump($c?->/* comment */class);
+
+?>
+--EXPECT--
+int(42)
+int(42)
+int(42)
+int(42)

Zend/zend_language_scanner.l

@@ -1587,12 +1587,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 	RETURN_TOKEN_WITH_STR(T_STRING, 0);
 }
 
-<ST_LOOKING_FOR_PROPERTY>{ANY_CHAR} {
-	yyless(0);
-	yy_pop_state();
-	goto restart;
-}
-
 <ST_IN_SCRIPTING>"::" {
 	RETURN_TOKEN(T_PAAMAYIM_NEKUDOTAYIM);
 }
@@ -2375,7 +2369,7 @@ inline_char_handler:
 }
 
 
-<ST_IN_SCRIPTING>"#"|"//" {
+<ST_IN_SCRIPTING,ST_LOOKING_FOR_PROPERTY>"#"|"//" {
 	while (YYCURSOR < YYLIMIT) {
 		switch (*YYCURSOR++) {
 			case '\r':
@@ -2399,7 +2393,7 @@ inline_char_handler:
 	RETURN_OR_SKIP_TOKEN(T_COMMENT);
 }
 
-<ST_IN_SCRIPTING>"/*"|"/**"{WHITESPACE} {
+<ST_IN_SCRIPTING,ST_LOOKING_FOR_PROPERTY>"/*"|"/**"{WHITESPACE} {
 	int doc_com;
 
 	if (yyleng > 2) {
@@ -2435,6 +2429,12 @@ inline_char_handler:
 	RETURN_OR_SKIP_TOKEN(T_COMMENT);
 }
 
+<ST_LOOKING_FOR_PROPERTY>{ANY_CHAR} {
+	yyless(0);
+	yy_pop_state();
+	goto restart;
+}
+
 <ST_IN_SCRIPTING>"?>"{NEWLINE}? {
 	BEGIN(INITIAL);
 	if (yytext[yyleng-1] != '>') {