Fix failed assertion with throwing __toString in binary const expr

Solve this with the same pattern as ZEND_AST_GREATER[_EQUAL].

Fixes OSS-Fuzz #434346548
Closes phpGH-19291

Author: iluuu1994

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     (psumbera)
   . Fixed bug GH-18581 (Coerce numeric string keys from iterators when argument
     unpacking). (ilutov)
+  . Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in
+    binary const expr). (ilutov)
 
 - FTP:
   . Fix theoretical issues with hrtime() not being available. (nielsdos)

Zend/tests/oss_fuzz_434346548.phpt

@@ -0,0 +1,22 @@
+--TEST--
+OSS-Fuzz #434346548: Failed assertion with throwing __toString in binary const expr
+--FILE--
+<?php
+
+class Foo {
+    function __toString() {}
+}
+
+function test($y = new Foo() < "") {
+    var_dump();
+}
+
+try {
+    test();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Foo::__toString(): Return value must be of type string, none returned

Zend/zend_ast.c

@@ -548,9 +548,10 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
 				ret = FAILURE;
 			} else {
 				binary_op_type op = get_binary_op(ast->attr);
-				ret = op(result, &op1, &op2);
+				op(result, &op1, &op2);
 				zval_ptr_dtor_nogc(&op1);
 				zval_ptr_dtor_nogc(&op2);
+				ret = EG(exception) ? FAILURE : SUCCESS;
 			}
 			break;
 		case ZEND_AST_GREATER: