Fix unsound SCCP for partial objects with hooks

Fixes GH-21231

Author: iluuu1994

Zend/Optimizer/sccp.c

@@ -989,8 +989,14 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 				/* Don't try to propagate assignments to (potentially) typed properties. We would
 				 * need to deal with errors and type conversions first. */
 				// TODO: Distinguish dynamic and declared property assignments here?
-				if (!var_info->ce || (var_info->ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS) ||
-						!(var_info->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES)) {
+				// FIXME: With dynamic property warnings and hooks this has
+				// become decreasingly useful. Maybe partial objects should just
+				// be removed.
+				if (!var_info->ce
+				 || var_info->is_instanceof
+				 || (var_info->ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)
+				 || !(var_info->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES)
+				 || (var_info->ce->num_hooked_props)) {
 					SET_RESULT_BOT(result);
 					SET_RESULT_BOT(op1);
 					return;

ext/opcache/tests/gh21231.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-21231: Unsound SCCP for partial objects with hooks
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+
+#[AllowDynamicProperties]
+class Foo {
+    public $prop { get => 43; set => $value; }
+}
+
+function test() {
+    $obj = new Foo;
+    $obj->prop = 42;
+    return $obj->prop;
+}
+
+var_dump(test());
+
+?>
+--EXPECT--
+int(43)