Merge branch 'PHP-8.4'

* PHP-8.4:
  Fix GH-17991: Assertion failure dom_attr_value_write

Author: nielsdos

ext/dom/php_dom.c

@@ -367,13 +367,14 @@ static zend_always_inline const dom_prop_handler *dom_get_prop_handler(const dom
 
 	if (obj->prop_handler != NULL) {
 		if (cache_slot && *cache_slot == obj->prop_handler) {
-			hnd = *(cache_slot + 1);
+			hnd = cache_slot[1];
 		}
 		if (!hnd) {
 			hnd = zend_hash_find_ptr(obj->prop_handler, name);
 			if (cache_slot) {
-				*cache_slot = obj->prop_handler;
-				*(cache_slot + 1) = (void *) hnd;
+				cache_slot[0] = obj->prop_handler;
+				cache_slot[1] = (void *) hnd;
+				cache_slot[2] = NULL;
 			}
 		}
 	}

ext/dom/tests/gh17991.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-17991 (Assertion failure dom_attr_value_write)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$attr = new DOMAttr("r", "iL");
+class Box {
+    public ?Test $value;
+}
+class Test {
+}
+function test($box) {
+    var_dump($box->value = new Test);
+}
+$box = new Box();
+test($box);
+test($attr);
+?>
+--EXPECTF--
+object(Test)#%d (0) {
+}
+
+Fatal error: Uncaught TypeError: Cannot assign Test to property DOMAttr::$value of type string in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(DOMAttr))
+#1 {main}
+  thrown in %s on line %d