Fix const/cv freeing on failed reference assignment

Author: nikic

Zend/tests/type_declarations/typed_properties_106.phpt

@@ -0,0 +1,26 @@
+--TEST--
+CONST/CV should not be freed on failed reference assignment
+--FILE--
+<?php
+class Test {
+    public ?Type $prop;
+}
+$obj = new Test;
+$ref =& $obj->prop;
+try {
+    $ref = [1];
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $ary = [1];
+    $ref = $ary;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump($ref);
+?>
+--EXPECT--
+Cannot assign array to reference held by property Test::$prop of type ?Type
+Cannot assign array to reference held by property Test::$prop of type ?Type
+NULL

Zend/zend_execute.c

@@ -3187,7 +3187,9 @@ ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *value, zend_uc
 		Z_TRY_DELREF_P(value);
 	}
 	if (!ret) {
-		zval_ptr_dtor(value);
+		if (value_type & (IS_VAR|IS_TMP_VAR)) {
+			zval_ptr_dtor(value);
+		}
 		return Z_REFVAL_P(variable_ptr);
 	}