Fix array copy-on-write: keep source after mutating copy (#5340)

[PurHur]

Summary

• Fixes array copy-on-write regression where $c = $a followed by $c[0] = 99 left $a as NULL instead of [1].
• Root cause: TYPE_ASSIGN in lib/VM.php nulled arg3 after every assignment (added for list-destructuring by-ref in Fix list destructuring by-ref semantics (#4433) #4438), including named variables like $a.
• Added Block::isNamedVariableSlot() and only release compiler temporaries after assign; named locals are preserved.

php-src reference

• Zend/zend_array.c — zend_array_separate() COW split on write
• Zend/zend_variables.c — zval separation; source zval must survive shared HashTable until refcount drops naturally

Verification

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/issue5340_array_cow.php'

Output (matches Zend semantics):

array(1) { [0]=> int(1) }
array(1) { [0]=> int(99) }
array(1) { [0]=> int(1) }
array(1) { [0]=> int(1) }
array(1) { [0]=> int(99) }

./script/docker-exec.sh -- bash -lc 'php vendor/bin/phpunit test/unit/ArrayCowAssignTest.php test/unit/ListDestructKeyedByRefNestedTest.php test/compliance/VMTest.php --filter array_cow'

All green (2 ArrayCowAssign unit tests, list destructuring regression, 2 compliance phpts).

Closes #5340

Made with Cursor