Fix GH-21478: Forward read_property to real instance for initialized lazy proxies

When an initialized lazy proxy has __get/__isset, zend_std_read_property()
was calling the magic method on the proxy itself before forwarding to the
real instance at uninit_error. This caused double invocations: __get fired
on both the real instance and the proxy.

For pure reads (BP_VAR_R, BP_VAR_IS), forward directly to the real instance
before attempting magic methods on the proxy. Write contexts (BP_VAR_W/RW)
are excluded because read_property with those types is used as a fallback
from get_property_ptr_ptr for reference operations involving __get.

Closes GH-21478

Author: iliaal

Zend/tests/lazy_objects/gh18038-004.phpt

@@ -36,7 +36,6 @@ var_dump($real->prop);
 --EXPECTF--
 init
 string(19) "RealInstance::__get"
-string(12) "Proxy::__get"
 
 Warning: Undefined property: RealInstance::$prop in %s on line %d
 NULL

Zend/tests/lazy_objects/gh18038-007.phpt

@@ -36,6 +36,5 @@ var_dump(isset($real->prop['']));
 --EXPECT--
 init
 string(21) "RealInstance::__isset"
-string(14) "Proxy::__isset"
 bool(false)
 bool(false)

Zend/tests/lazy_objects/gh21478.phpt

@@ -0,0 +1,32 @@
+--TEST--
+GH-21478 (Property access on lazy proxy may invoke magic method despite real instance guards)
+--FILE--
+<?php
+
+class Foo {
+    public $_;
+
+    public function __get($name) {
+        global $proxy;
+        printf("__get(\$%s) on %s\n", $name, $this::class);
+        return $proxy->{$name};
+    }
+}
+
+class Bar extends Foo {}
+
+$rc = new ReflectionClass(Bar::class);
+$proxy = $rc->newLazyProxy(function () {
+    echo "Init\n";
+    return new Foo();
+});
+
+$real = $rc->initializeLazyObject($proxy);
+$real->x;
+
+?>
+--EXPECTF--
+Init
+__get($x) on Foo
+
+Warning: Undefined property: Foo::$x in %s on line %d

Zend/zend_object_handlers.c

@@ -893,6 +893,13 @@ ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int
 
 	retval = &EG(uninitialized_zval);
 
+	if (UNEXPECTED(zend_object_is_lazy_proxy(zobj)
+			&& zend_lazy_object_initialized(zobj)
+			&& (type == BP_VAR_R || type == BP_VAR_IS))) {
+		zend_object *instance = zend_lazy_object_get_instance(zobj);
+		return zend_std_read_property(instance, name, type, cache_slot, rv);
+	}
+
 	/* magic isset */
 	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
 		zval tmp_result;