Stdlib: array_column() skips non-public object props without __get (#23511)

ext/standard/ArrayColumnJitHelper.php

@@ -4,8 +4,11 @@
 
 namespace PHPCompiler\ext\standard;
 
+use PHPCompiler\MethodVisibility;
+use PHPCompiler\VM\ClassProperty;
 use PHPCompiler\VM\EnumCaseSupport;
 use PHPCompiler\VM\HashTable;
+use PHPCompiler\VM\ObjectEntry;
 use PHPCompiler\VM\Variable;
 
 /**
@@ -176,11 +179,46 @@ private static function readColumnFromRow(Variable $row, string|int $field): ?Va
 
                 return EnumCaseSupport::getProperty($object, $propName);
             }
-            if (!$object->hasProperty($propName)) {
+
+            // php-src php_array_column: silent public property read — no __get (#23511).
+            return self::readPublicObjectColumnProperty($object, $propName);
+        }
+
+        return null;
+    }
+
+    /**
+     * Zend array_column object path: only public declared/dynamic properties; never __get.
+     *
+     * @see https://github.com/php/php-src/blob/master/ext/standard/array.c php_array_column
+     */
+    private static function readPublicObjectColumnProperty(ObjectEntry $object, string $propName): ?Variable
+    {
+        $meta = self::findDeclaredInstanceProperty($object, $propName);
+        if (null !== $meta) {
+            if (!MethodVisibility::isPublic($meta->visibility)) {
                 return null;
             }
+            if (!$object->hasPropertyForMeta($meta)) {
+                return null;
+            }
+
+            return $object->getPropertyForMeta($meta)->resolveIndirect();
+        }
+        // Undeclared dynamic properties are public; missing slots must not invoke __get.
+        if (!$object->hasProperty($propName)) {
+            return null;
+        }
 
-            return $object->getProperty($propName)->resolveIndirect();
+        return $object->getProperty($propName)->resolveIndirect();
+    }
+
+    private static function findDeclaredInstanceProperty(ObjectEntry $object, string $propName): ?ClassProperty
+    {
+        foreach ($object->class->properties as $prop) {
+            if ($prop->name === $propName) {
+                return $prop;
+            }
         }
 
         return null;

test/compliance/cases/stdlib/array_column_private_get.phpt

@@ -0,0 +1,30 @@
+--TEST--
+stdlib array_column() skips private/protected object props (no __get) (#23511)
+--FILE--
+<?php
+class R {
+    private $name;
+    public function __construct(string $n) { $this->name = $n; }
+    public function __get(string $k): string { return $this->name; }
+}
+echo json_encode(array_column([new R('x'), new R('y')], 'name')), "\n";
+class P {
+    public function __construct(public string $name) {}
+}
+echo json_encode(array_column([new P('a'), new P('b')], 'name')), "\n";
+class Prot {
+    protected $name;
+    public function __construct(string $n) { $this->name = $n; }
+    public function __get(string $k): string { return $this->name; }
+}
+echo json_encode(array_column([new Prot('z')], 'name')), "\n";
+class Dyn {
+    public function __get(string $k) { return 'magic'; }
+}
+echo json_encode(array_column([new Dyn()], 'name')), "\n";
+?>
+--EXPECT--
+[]
+["a","b"]
+[]
+[]

test/repro/array_column_private_get.php

@@ -0,0 +1,8 @@
+<?php
+// #23511 — array_column() must not read private props via storage/__get
+class R {
+    private $name;
+    public function __construct(string $n) { $this->name = $n; }
+    public function __get(string $k): string { return $this->name; }
+}
+echo json_encode(array_column([new R('x'), new R('y')], 'name')), "\n";