[php-src] PR #25065: Fix use-after-free when assigning to a typed property releases the object

Pull Request: https://github.com/php/php-src/pull/25065 Author: adapik The slow path protects the object while the value is coerced to the property type (see zend_std_write_property()), because that can run user code (__toString(), an error handler) which frees the object. The fast path in ZEND_ASSIGN_OBJ and the JIT helper don't have this check. So the same code behaves differently depending on whether the cache slot is primed: the first assignment throws "Object was released while assigning to property", the following ones write into freed memory. This fix adds the same check to the fast path and the JIT helper, so all paths behave the same. It is done only when the value doesn't match the type exactly. The situation is rare and artificial. Still, I think it is important that the behavior is the same on every path, regardless of whether the cache slot is primed. I found this by accident while working on #25057.