Fix #18542: unserialize() respects class_alias for private properties

[HakanIST]

Problem

When a class with private properties is serialized, the property names are mangled as \0ClassName\0propName. If the class is later aliased via class_alias(), unserialize() fails to match the mangled class name against the actual class entry, causing properties to be treated as dynamic instead of declared.

This results in:

• Creation of dynamic property is deprecated warning (PHP 8.2+)
• Typed property must not be accessed before initialization fatal error

Root Cause

In is_property_visibility_changed() (ext/standard/var_unserializer.re), the mangled class name is only compared against ce->name via strcasecmp(). When class_alias() is used, the mangled string contains the alias name while ce->name holds the canonical class name — these don't match, so the property is not recognized as declared.

Fix

Added a fallback check that uses zend_hash_str_find_ptr_lc(EG(class_table), ...) to verify whether the mangled class name resolves to the same zend_class_entry. This:

• Uses zero heap allocations (zend_hash_str_find_ptr_lc uses stack-allocated do_alloca internally)
• Is only triggered as a fallback when the direct name comparison fails, so there is zero overhead on the normal (non-alias) path
• Does not trigger autoloading (direct hash table lookup)

Test

Added ext/standard/tests/serialize/unserialize_class_alias_private_props.phpt covering private, protected, and public properties with class_alias().

All existing serialization tests (164) and class_alias tests (26) pass with zero regressions.

Closes #18542

[HakanIST]

CI Note: All test failures across every platform are the same pre-existing pdo_set_fetch_mode_errors.phpt test, also failing on current master. The FREEBSD_NTS failure is an SSH infrastructure issue. Our new test unserialize_class_alias_private_props.phpt passes on all platforms.

[HakanIST]

This bug also manifests in MediaWiki when using APCU cache with class_alias for backward compatibility during namespace migrations (Phabricator T405901). Verified locally that this patch resolves it.

[Girgias]

Please rebase on the latest master to fix CI.

[HakanIST]

Rebased on latest master as requested, and expanded test coverage with additional cases: inheritance with parent private properties, multiple typed properties via alias, and a regression check using the canonical class name. @Girgias @bukka ready for review.

[TimWolla]

I don't see @IMSoP's remark being accounted for in the tests: #18542 (comment)

[HakanIST]

Added tests to cover @IMSoP's concern from #18542:

Test 7: Shadowed private properties at different inheritance levels with alias. \0ChildAlias\0prop resolves to Child's property, while \0Base\0prop stays with Base's property. No cross-contamination happens between levels.

Test 8: Single class (no inheritance) with both canonical and alias mangled names:

• \0BravoAlias\0value alone (alias path)
• \0Bravo\0value alone (canonical path)
• Both in same payload, verifying they resolve to the same declared slot without creating dynamic property

The fix only triggers zend_hash_str_find_ptr_lc() lookup as fallback when direct strcasecmp(unmangled_class, ce->name) fails, and checks == ce so it cannot match a different class entry in the hierarchy.