vm: lower $b = &$a ref-assign for simple-local LHS natively

Adds OP_STORE_LOCAL_REF, writing a ref-typed ZVal into a local slot
without the COW-Dup that OP_STORE_LOCAL applies to ZtArray values
(frame.go:160-166 follows ref→Nude+Dup, which detaches the ref).

Emit path: $b = &$a where LHS is a simple variable
  - emit RHS (\&$a → OP_CREATE_REF produces ref ZVal)
  - OP_STORE_LOCAL_REF idx=$b localIdx

Handler:
  - pop value
  - if IsRef, call RefInner() to track alias count
  - write directly into the slot (no Dup, no Nude)
  - mirror through ctx.OffsetSet for non-slot-only frames
  - keep-value flag for expr context ($x = ($b = &$a))

Complex LHS (object prop, array elem, static prop) still routes
through AST — those write paths each carry their own ref-installation
semantics that this stage-1 lowering doesn't replicate.

VM output byte-identical to AST baseline across the 7-test smoke
suite (scalar/array/string ref-share, function by-ref pass-through,
unset-detach, ref-chain, and the expr-context $x = ($b = &$a) edge).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: MagicalTux

core/vm/opcode.go

@@ -615,6 +615,25 @@ const (
 	// Reads via objectGet, applies DoInc, writes via objectSet.
 	OpIncDecObjDynProp
 
+	// OP_STORE_LOCAL_REF stores a reference-typed ZVal into a local
+	// slot without dereferencing or COW-Dup'ing. Used for `$b = &$a`
+	// reference assignments where the RHS is `&$expr` (a runRef
+	// expression — produces a ref-typed ZVal via OP_CREATE_REF).
+	//
+	// Encoding:
+	//   A = local slot index
+	//   B bit 0 = keep value on stack (expression context, e.g.
+	//             `$x = ($b = &$a)` — the result of `$b = &$a` is
+	//             the ref ZVal which then gets dereferenced by the
+	//             outer `=`'s value semantics in OpStoreLocal)
+	//
+	// Differs from OP_STORE_LOCAL: that handler Dup's ZtArray values
+	// even when the source is a ref (frame.go:160-166), which detaches
+	// the ref. This handler writes the ref ZVal directly and calls
+	// RefInner() to track the alias count — matches the AST's
+	// `res.IsRef() && r.b is *runRef` branch in run-operator.go.
+	OpStoreLocalRef
+
 	// Sentinel — keep last.
 	opLast
 )
@@ -765,4 +784,5 @@ var opNames = [...]string{
 	OpIncDecStaticPropDyn:         "INC_DEC_STATIC_PROP_DYN",
 	OpObjectDynCompoundAssign:     "OBJECT_DYN_COMPOUND_ASSIGN",
 	OpIncDecObjDynProp:            "INC_DEC_OBJ_DYN_PROP",
+	OpStoreLocalRef:               "STORE_LOCAL_REF",
 }

core/vm/vm.go

@@ -1898,6 +1898,30 @@ func (f *Frame) runUntilError(ctx phpv.Context) (retVal *phpv.ZVal, finished boo
 				f.push(res)
 			}
 
+		// --- `$b = &$a` ref-assign to simple-local LHS ----------------
+		case OpStoreLocalRef:
+			v := f.pop()
+			idx := ins.A()
+			keep := ins.B()&1 != 0
+			if v == nil {
+				v = phpv.ZNULL.ZVal()
+			}
+			if v.IsRef() {
+				v.RefInner()
+			}
+			// Write the ref ZVal directly — no Dup, no Nude unwrap.
+			// This is the path that storeLocal explicitly avoids
+			// (frame.go:160-166 dereferences ref arrays via Nude+Dup).
+			f.locals[idx] = v
+			if !f.fn.SlotOnly {
+				if err := ctx.OffsetSet(ctx, f.fn.Locals[idx], v); err != nil {
+					return nil, false, err
+				}
+			}
+			if keep {
+				f.push(v)
+			}
+
 		// --- `$obj->$x OP= rhs` / `$obj->{$x} OP= rhs` dyn-name prop ---
 		case OpObjectDynCompoundAssign:
 			rhs := f.pop()

core/vm/vmcompiler/emit_expr.go

@@ -879,8 +879,29 @@ func (e *emitter) emitUnary(b phpv.Runnable, op tokenizer.ItemType) error {
 func (e *emitter) emitAssign(n operatorNode) error {
 	// Reference assignment (`$b = &$a`): AST handles the ref-share
 	// semantics. The VM's OpStoreLocal Dups arrays, detaching any
-	// inbound ref — wrong for `=&`.
+	// inbound ref — wrong for `=&`. For the simple-variable LHS,
+	// use OP_STORE_LOCAL_REF which writes the ref ZVal directly.
+	// Complex LHS (object prop, array elem, static prop) still
+	// AST-delegates — those write paths each have their own ref
+	// semantics that we don't yet replicate natively.
 	if compiler.IsRefExpr(n.OperatorB()) {
+		if v, ok := n.OperatorA().(variableNode); ok {
+			stmtCtx := e.stmtCtx
+			if err := e.withSubexpr(func() error { return e.emitExpr(n.OperatorB()) }); err != nil {
+				return err
+			}
+			idx := e.localIndex(v.VariableName())
+			var b uint16
+			if !stmtCtx {
+				b |= 1
+			}
+			e.emit(vm.OpStoreLocalRef, idx, b, 0)
+			if stmtCtx {
+				e.popStack(1)
+			}
+			// expr-context: pop+push of same value → net zero.
+			return nil
+		}
 		return e.emitAssignViaAST(n)
 	}
 	// Plain `=` to a simple local variable.