Language: by-ref param ASSIGN_REF rebinds local CV only (#22546)

[PurHur]

Summary

• Zend $a =& $x rebinds the named CV only; by-ref params must disconnect from the caller (php-src ZEND_ASSIGN_REF).
• VM was peeling through the prior IS_REFERENCE and writing the caller/shared cell; fix rebinds named CVs while keeping unnamed dim/$GLOBALS fetch-temp peels (Language: array element assign by reference — $arr[] = &$var must alias (zend_operators.c) #5349).
• Compliance + repro for rebind + write-through without rebind.

Closes #22546

php-src reference

• Zend/zend_vm_def.h — ZEND_ASSIGN_REF
• Zend/zend_execute.c — by-ref arg binding + local symbol rebind

PHP implementation

• lib/VM.php — TYPE_ASSIGN_REF write-target selection via resolveScopeSlotVariableName

Test plan

• Issue repro:

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/issue_22546_byref_param_assign_ref_rebind.php'
# NULL / NULL / 99

• Compliance:

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter "byref_param_assign_ref_rebind|static_assign_ref_param_disconnect|dim_ref_survives|reference_survives_unset|array_append_by_ref|object_property_assign_by_ref" test/compliance/VMTest.php'
# OK (6 tests)

Trust probe (pre-claim)

• php script/bootstrap-inventory.php --check → OK 6433/6433
• release-readiness --json: inventory/spine/readme ok; north-star5-fast red on master (gen-0 mismatch Self-host M5: bootstrap-inventory argv driver size floor — grow beyond 451KB stub #8713) — unrelated

Made with Cursor

[PurHur]

Cleanup hygiene

Deleting remote branch agent/issue-22546-assign-ref-rebind.

Reason: PR merged into master (#22552 / 0e759fa46); issue #22546 closed; no open PR on this head.

Open PR #22717 (agent/issue-22642-gen0-refresh-oom) and release/v1.1.0-dev left untouched.