Fix GH-24701: Use-after-free on typed trait constants during opcache preload

NEWS

@@ -30,6 +30,8 @@ PHP                                                                        NEWS
     for grouping. (Klaas Skelte van der Werf)
   . Fixed bug GH-24265 (Unwind/GracefulExit discarded in
     zend_fiber_execute()). (David Carlier)
+  . Fixed bug GH-24701 (Use-after-free on typed trait constants during
+    opcache preload). (sanklamm, lazerg)
 
 - Date:
   . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property

Zend/zend_inheritance.c

@@ -2848,6 +2848,7 @@ static void zend_do_traits_constant_binding(zend_class_entry *ce, zend_class_ent
 
 				Z_TRY_ADDREF(constant->value);
 				constant->doc_comment = constant->doc_comment ? zend_string_copy(constant->doc_comment) : NULL;
+				zend_type_copy_ctor(&constant->type, /* use_arena */ true, /* persistent */ false);
 				if (constant->attributes && (!(GC_FLAGS(constant->attributes) & IS_ARRAY_IMMUTABLE))) {
 					GC_ADDREF(constant->attributes);
 				}

ext/opcache/tests/gh24701.phpt

@@ -0,0 +1,21 @@
+--TEST--
+GH-24701 (Use-after-free on typed trait constants during opcache preload)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.preload={PWD}/preload_gh24701.inc
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+var_dump(C::x());
+var_dump(C::Y);
+?>
+--EXPECT--
+enum(E::A)
+enum(F::B)

ext/opcache/tests/preload_gh24701.inc

@@ -0,0 +1,21 @@
+<?php
+enum E: string {
+    case A = 'a';
+}
+
+enum F: string {
+    case B = 'b';
+}
+
+trait T {
+    protected const E X = E::A;
+    public const E|F Y = F::B;
+}
+
+class C {
+    use T;
+
+    public static function x() {
+        return self::X;
+    }
+}