Fix GH-24792: Assignment-result writes compile but fail with invalid opcode

NEWS

@@ -13,6 +13,8 @@ PHP                                                                        NEWS
     (lazerg)
   . Fixed bug GH-25007 (Partial function application: named args in a constant
     expression cause out-of-bounds write in zp_compile()). (lazerg)
+  . Fixed bug GH-24792 (Assignment-result writes compile but fail with invalid
+    opcode). (ChrisAbner)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).

Zend/tests/gh24792.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-24792: Assignment results can still be read and passed by reference
+--FILE--
+<?php
+function f(&$x) {
+    $x[] = 9;
+}
+
+$arr = [[1]];
+f([&$x] = $arr);
+var_dump($arr[1]);
+
+$b = [1];
+f($a =& $b);
+var_dump($b[1]);
+
+var_dump(($v = ['k' => 'v'])['k'], $v);
+var_dump(isset(($w = [1])[0]), ($w = [1])[5] ?? 'default', empty(($w = [1])[0]));
+
+$o = new stdClass;
+$o->p = [1];
+var_dump(($c = $o)->p[0]);
+?>
+--EXPECT--
+int(9)
+int(9)
+string(1) "v"
+array(1) {
+  ["k"]=>
+  string(1) "v"
+}
+bool(true)
+string(7) "default"
+bool(false)
+int(1)

Zend/tests/gh24792_001.phpt

@@ -0,0 +1,8 @@
+--TEST--
+GH-24792: Dimension write on an assignment result
+--FILE--
+<?php
+($a = [1])[0] = 2;
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_002.phpt

@@ -0,0 +1,8 @@
+--TEST--
+GH-24792: Property write on an assignment result
+--FILE--
+<?php
+($a = new stdClass)->p = 1;
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_003.phpt

@@ -0,0 +1,8 @@
+--TEST--
+GH-24792: Compound assignment on a dimension of an assignment result
+--FILE--
+<?php
+($a = [1])[0] += 2;
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_004.phpt

@@ -0,0 +1,8 @@
+--TEST--
+GH-24792: Unset of a dimension of an assignment result
+--FILE--
+<?php
+unset(($a = [1])[0]);
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_005.phpt

@@ -0,0 +1,8 @@
+--TEST--
+GH-24792: Reference to a dimension of an assignment result
+--FILE--
+<?php
+$r = &($a = [1])[0];
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_006.phpt

@@ -0,0 +1,9 @@
+--TEST--
+GH-24792: Dimension of an assignment result passed by reference
+--FILE--
+<?php
+function f(&$x) {}
+f(($a = [1])[0]);
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_007.phpt

@@ -0,0 +1,9 @@
+--TEST--
+GH-24792: Dimension write on a by-reference assignment result
+--FILE--
+<?php
+$b = [1];
+($a =& $b)[0] = 2;
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/tests/gh24792_008.phpt

@@ -0,0 +1,9 @@
+--TEST--
+GH-24792: Dimension write on the result of a destructuring assignment with references
+--FILE--
+<?php
+$arr = [[1]];
+([&$x] = $arr)[0] = 5;
+?>
+--EXPECTF--
+Fatal error: Cannot use temporary expression in write context in %s on line %d

Zend/zend_compile.c

@@ -12797,11 +12797,17 @@ static zend_op *zend_compile_var_inner(znode *result, zend_ast *ast, uint32_t ty
 			*result = *zend_ast_get_znode(ast);
 			return NULL;
 		case ZEND_AST_ASSIGN_REF:
-			zend_compile_assign_ref(result, ast, type);
-			return NULL;
 		case ZEND_AST_ASSIGN:
-			zend_compile_assign(result, ast, false, type);
-			return NULL;
+			/* Assignment results may only be passed by reference, not written to. */
+			if (by_ref || (type != BP_VAR_W && type != BP_VAR_RW && type != BP_VAR_UNSET)) {
+				if (ast->kind == ZEND_AST_ASSIGN_REF) {
+					zend_compile_assign_ref(result, ast, type);
+				} else {
+					zend_compile_assign(result, ast, false, type);
+				}
+				return NULL;
+			}
+			ZEND_FALLTHROUGH;
 		default:
 			if (type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) {
 				zend_error_noreturn(E_COMPILE_ERROR,