Fix GH-17941: Stack-use-after-return with lazy objects and hooks

zend_std_write_property() can return the variable pointer, but the code
was using a local variable, and so a pointer to a local variable could
be returned. Fix this by using the value pointer instead.
This can be more efficient on master by using the safe_assign helper.

Author: nielsdos

Zend/tests/lazy_objects/gh17941.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-17941 (Stack-use-after-return with lazy objects and hooks)
+--FILE--
+<?php
+
+class SubClass {
+    public $prop {get => $this->prop; set($x) => $this->prop = $x;}
+}
+
+$rc = new ReflectionClass(SubClass::class);
+$obj = $rc->newLazyProxy(function ($object) {
+    echo "init\n";
+    return new SubClass;
+});
+
+function foo(SubClass $x) {
+    $x->prop = 1;
+    var_dump($x->prop);
+}
+
+foo($obj);
+
+?>
+--EXPECT--
+init
+int(1)

Zend/zend_object_handlers.c

@@ -1196,9 +1196,10 @@ lazy_init:;
 		goto exit;
 	}
 
-	variable_ptr = zend_std_write_property(zobj, name, &backup, cache_slot);
-	zval_ptr_dtor(&backup);
-	return variable_ptr;
+	/* TODO: use zend_safe_assign_to_variable_noref() on master */
+	zval_ptr_dtor(value);
+	ZVAL_COPY_VALUE(value, &backup);
+	return zend_std_write_property(zobj, name, value, cache_slot);
 }
 /* }}} */