Fix GH-17991: Assertion failure dom_attr_value_write

Closes GH-17995.

Author: nielsdos

NEWS

@@ -12,6 +12,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect
     results for closures created from magic __call()). (timwolla)
 
+- DOM:
+  . Fixed bug GH-17991 (Assertion failure dom_attr_value_write). (nielsdos)
+
 - Opcache:
   . Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal
     JIT). (nielsdos)

ext/dom/php_dom.c

@@ -372,13 +372,14 @@ static zend_always_inline const dom_prop_handler *dom_get_prop_handler(const dom
 
 	if (obj->prop_handler != NULL) {
 		if (cache_slot && *cache_slot == obj->prop_handler) {
-			hnd = *(cache_slot + 1);
+			hnd = cache_slot[1];
 		}
 		if (!hnd) {
 			hnd = zend_hash_find_ptr(obj->prop_handler, name);
 			if (cache_slot) {
-				*cache_slot = obj->prop_handler;
-				*(cache_slot + 1) = (void *) hnd;
+				cache_slot[0] = obj->prop_handler;
+				cache_slot[1] = (void *) hnd;
+				cache_slot[2] = NULL;
 			}
 		}
 	}

ext/dom/tests/gh17991.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-17991 (Assertion failure dom_attr_value_write)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$attr = new DOMAttr("r", "iL");
+class Box {
+    public ?Test $value;
+}
+class Test {
+}
+function test($box) {
+    var_dump($box->value = new Test);
+}
+$box = new Box();
+test($box);
+test($attr);
+?>
+--EXPECTF--
+object(Test)#%d (0) {
+}
+
+Fatal error: Uncaught TypeError: Cannot assign Test to property DOMAttr::$value of type string in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(DOMAttr))
+#1 {main}
+  thrown in %s on line %d