From b2f5e6973a1bb0274820e154cabd72331f05ba85 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Thu, 2 Apr 2026 15:28:33 +0200
Subject: [PATCH] Fix missing addref for __unset

Fixes GH-21603
---
 Zend/tests/gh21603.phpt     | 22 ++++++++++++++++++++++
 Zend/zend_object_handlers.c |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 Zend/tests/gh21603.phpt

diff --git a/Zend/tests/gh21603.phpt b/Zend/tests/gh21603.phpt
new file mode 100644
index 0000000000000..ab2fbc44e7977
--- /dev/null
+++ b/Zend/tests/gh21603.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-21603: Missing addref for __unset
+--CREDITS--
+cnwangjihe
+--FILE--
+<?php
+
+class C {
+    public function __unset($name) {
+        global $c;
+        $c = null;
+        var_dump($this);
+    }
+}
+
+$c = new C;
+unset($c->prop);
+
+?>
+--EXPECTF--
+object(C)#%d (0) {
+}
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 648e57dfe7e71..9351670d5184d 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1602,9 +1602,11 @@ ZEND_API void zend_std_unset_property(zend_object *zobj, zend_string *name, void
 		}
 		if (!((*guard) & IN_UNSET)) {
 			/* have unsetter - try with it! */
+			GC_ADDREF(zobj);
 			(*guard) |= IN_UNSET; /* prevent circular unsetting */
 			zend_std_call_unsetter(zobj, name);
 			(*guard) &= ~IN_UNSET;
+			OBJ_RELEASE(zobj);
 			return;
 		} else if (UNEXPECTED(IS_WRONG_PROPERTY_OFFSET(property_offset))) {
 			/* Trigger the correct error */