Make sure fetch_property_type_info is only used with valid offset

It's not relevant in any other case and might be wrong wrt cache
state I think.

Author: nikic

Zend/zend_object_handlers.c

@@ -742,7 +742,8 @@ ZEND_API zval *zend_std_read_property(zval *object, zval *member, int type, void
 			}
 
 			if (UNEXPECTED(ZEND_CLASS_HAS_TYPE_HINTS(zobj->ce) &&
-				(prop_info = zend_object_fetch_property_type_info(Z_OBJCE_P(object), name, IS_VALID_PROPERTY_OFFSET(property_offset) ? cache_slot : NULL)))) {
+				IS_VALID_PROPERTY_OFFSET(property_offset) &&
+				(prop_info = zend_object_fetch_property_type_info(Z_OBJCE_P(object), name, cache_slot)))) {
 				zend_verify_prop_assignable_by_ref(prop_info, retval, (zobj->ce->__get->common.fn_flags & ZEND_ACC_STRICT_TYPES) != 0);
 			}
 
@@ -757,8 +758,9 @@ ZEND_API zval *zend_std_read_property(zval *object, zval *member, int type, void
 		}
 	}
 
-	if ((type != BP_VAR_IS)) {
-		if (UNEXPECTED(prop_info = zend_object_fetch_property_type_info(Z_OBJCE_P(object), name, cache_slot))) {
+	if (type != BP_VAR_IS) {
+		if (IS_VALID_PROPERTY_OFFSET(property_offset) &&
+			(prop_info = zend_object_fetch_property_type_info(Z_OBJCE_P(object), name, cache_slot))) {
 			zend_throw_error(NULL, "Typed property %s::$%s must not be accessed before initialization",
 				ZSTR_VAL(prop_info->ce->name),
 				ZSTR_VAL(name));