vm: lower $obj->$x = v / $obj->{$x} = v to OP_OBJECT_DYN_SET

Adds OP_OBJECT_DYN_SET handling the dynamic-name property write
shape that was previously generic-AST-delegated via OpClassConst.

Stack: [receiver, name, value] → optionally push value back.
  A bit 0 = keep-value-on-stack (expr context).

Handler validates the receiver is a ZObjectAccess (throwing
"Attempt to assign property \"NAME\" on TYPE" otherwise) and
dispatches through objI.ObjectSet — which already covers typed
properties, hooks, asymmetric visibility, etc.

emitObjectVarAssign routes runObjectVar with $-prefixed name
(\$obj->\$x = v) through the new opcode; a new
emitObjectDynVarAssign handles runObjectDynVar
(\$obj->{\$x} = v). Receiver-warn semantics match the AST
runners — runObjectVar suppresses the undefined-variable warning
via OpLoadLocal, runObjectDynVar does not (emitExpr → normal warn).

Also brings the dyn-form error message in line with real PHP:
"Attempt to assign property \"foo\" on int" (the AST runner was
omitting the property name).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: MagicalTux

core/vm/opcode.go

@@ -523,6 +523,16 @@ const (
 	OpIssetStaticProp
 	OpEmptyStaticProp
 
+	// OP_OBJECT_DYN_SET handles both `$obj->$x = v` (runObjectVar with
+	// $-prefixed name) and `$obj->{$x} = v` (runObjectDynVar). Stack
+	// pops value, name, receiver (in that order). Encoding:
+	//   A bit 0 = keep-value-on-stack (expr context)
+	// Handler checks receiver is a ZObjectAccess (throws
+	// "Attempt to assign property \"NAME\" on TYPE" otherwise) and
+	// dispatches to objI.ObjectSet which handles typed properties,
+	// hooks, asymmetric visibility, etc.
+	OpObjectDynSet
+
 	// Sentinel — keep last.
 	opLast
 )
@@ -666,4 +676,5 @@ var opNames = [...]string{
 	OpIncDecStaticProp:         "INC_DEC_STATIC_PROP",
 	OpIssetStaticProp:          "ISSET_STATIC_PROP",
 	OpEmptyStaticProp:          "EMPTY_STATIC_PROP",
+	OpObjectDynSet:             "OBJECT_DYN_SET",
 }

core/vm/vm.go

@@ -1377,6 +1377,37 @@ func (f *Frame) runUntilError(ctx phpv.Context) (retVal *phpv.ZVal, finished boo
 				f.push(res)
 			}
 
+		// --- $obj->$x = v / $obj->{$x} = v dyn-name write ------------
+		case OpObjectDynSet:
+			val := f.pop()
+			nameV := f.pop()
+			recv := f.pop()
+			if recv == nil || recv.Value() == nil {
+				propName := ""
+				if nameV != nil {
+					propName = string(nameV.AsString(ctx))
+				}
+				return nil, false, phpobj.ThrowError(ctx, phpobj.Error,
+					fmt.Sprintf("Attempt to assign property \"%s\" on null", propName))
+			}
+			objI, ok := recv.Value().(phpv.ZObjectAccess)
+			if !ok {
+				typeName := compiler.PhpValueTypeName(recv)
+				propName := ""
+				if nameV != nil {
+					propName = string(nameV.AsString(ctx))
+				}
+				return nil, false, phpobj.ThrowError(ctx, phpobj.Error,
+					fmt.Sprintf("Attempt to assign property \"%s\" on %s", propName, typeName))
+			}
+			if err := objI.ObjectSet(ctx, nameV, val); err != nil {
+				return nil, false, err
+			}
+			// A bit 0: keep value on stack (expr context).
+			if ins.A()&1 != 0 {
+				f.push(val)
+			}
+
 		// --- global $x ---------------------------------------------
 		case OpGlobalBind:
 			nameV := f.pop()

core/vm/vmcompiler/emit_expr.go

@@ -884,17 +884,25 @@ func (e *emitter) emitAssign(n operatorNode) error {
 	// the AST runner. IsSlotSafe rejects bodies with these writes,
 	// so the hashtable is in sync when the AST reads locals.
 	if ov, ok := n.OperatorA().(objectVarNode); ok {
-		// `$obj->prop = v`: emit natively for static-name, non-nullsafe.
-		// OP_OBJECT_SET dispatches via ZObject's ObjectSet which already
-		// handles typed properties, hooks, and asymmetric visibility.
-		// Expr-context uses the B=1 keep-value flag so the assignment
-		// result lands on the stack.
-		name := ov.ObjectVarName()
-		if !ov.ObjectVarIsNullSafe() && !(len(name) > 0 && name[0] == '$') {
+		// `$obj->prop = v` / `$obj->$x = v`: emit natively for
+		// non-nullsafe access. emitObjectVarAssign routes the static-name
+		// form through OP_OBJECT_SET and the dyn-name ($-prefixed) form
+		// through OP_OBJECT_DYN_SET — both dispatch via ZObject.ObjectSet
+		// (typed properties, hooks, asymmetric visibility). Expr-context
+		// uses the keep-value flag so the assignment result lands on the
+		// stack.
+		if !ov.ObjectVarIsNullSafe() {
 			return e.emitObjectVarAssign(ov, n.OperatorB(), e.stmtCtx)
 		}
 		return e.emitAssignViaAST(n)
 	}
+	if compiler.IsObjectDynVarReadNode(n.OperatorA()) && !compiler.ObjectDynVarIsNullSafe(n.OperatorA()) {
+		// `$obj->{$x} = v`: dyn-name property write via OP_OBJECT_DYN_SET.
+		if dv, ok := n.OperatorA().(objectDynVarReadNode); ok {
+			return e.emitObjectDynVarAssign(dv, n.OperatorB(), e.stmtCtx)
+		}
+		return e.emitAssignViaAST(n)
+	}
 	if compiler.IsStaticPropertyTarget(n.OperatorA()) {
 		// `Foo::$bar = v`: emit natively when the LHS is the static-name
 		// form (`*runClassStaticVarRef`). AssignClassStaticProp handles

core/vm/vmcompiler/emit_object.go

@@ -73,9 +73,6 @@ func (e *emitter) emitObjectVarAssign(lhs objectVarNode, rhs phpv.Runnable, stmt
 		return unsupportedf("nullsafe property assign")
 	}
 	name := lhs.ObjectVarName()
-	if len(name) > 0 && name[0] == '$' {
-		return unsupportedf("dynamic property name in assign")
-	}
 	// PHP's write-context for `$x->prop = v`: an undefined `$x` does
 	// NOT emit "Undefined variable" — the AST's runVariable.Run sees
 	// Parent=runOperator(write) and short-circuits the warning. For
@@ -91,6 +88,27 @@ func (e *emitter) emitObjectVarAssign(lhs objectVarNode, rhs phpv.Runnable, stmt
 			return err
 		}
 	}
+	// `$obj->$x = v` has varName prefixed with `$`. Push the local
+	// holding the dyn name on the stack and use OP_OBJECT_DYN_SET.
+	if len(name) > 0 && name[0] == '$' {
+		localIdx := e.localIndex(name[1:])
+		e.emit(vm.OpLoadLocal, localIdx, 0, 0)
+		e.pushStack(1)
+		if err := e.withSubexpr(func() error { return e.emitExpr(rhs) }); err != nil {
+			return err
+		}
+		var a uint16
+		if !stmtCtx {
+			a |= 1 // keep value on stack
+		}
+		e.emit(vm.OpObjectDynSet, a, 0, 0)
+		if stmtCtx {
+			e.popStack(3) // pop receiver+name+value, push nothing
+		} else {
+			e.popStack(2) // pop receiver+name+value, push value back → net -2
+		}
+		return nil
+	}
 	if err := e.withSubexpr(func() error { return e.emitExpr(rhs) }); err != nil {
 		return err
 	}
@@ -107,6 +125,40 @@ func (e *emitter) emitObjectVarAssign(lhs objectVarNode, rhs phpv.Runnable, stmt
 	return nil
 }
 
+// emitObjectDynVarAssign emits `$obj->{$x} = v` natively. Receiver and
+// name are evaluated and pushed; OP_OBJECT_DYN_SET dispatches to
+// ZObject.ObjectSet (typed props, hooks, asymmetric visibility).
+//
+// Note: unlike runObjectVar.WriteValue, the runObjectDynVar AST runner
+// does NOT call SetWriteContext on its receiver. An undefined simple-
+// variable receiver still emits the "Undefined variable" warning. Use
+// OP_LOAD_LOCAL_OR_WARN here to match AST semantics — the dyn form
+// behaves like a value read on the receiver, then a write on the
+// resolved property.
+func (e *emitter) emitObjectDynVarAssign(lhs objectDynVarReadNode, rhs phpv.Runnable, stmtCtx bool) error {
+	recv := lhs.ObjectDynVarReceiver()
+	if err := e.withSubexpr(func() error { return e.emitExpr(recv) }); err != nil {
+		return err
+	}
+	if err := e.withSubexpr(func() error { return e.emitExpr(lhs.ObjectDynVarNameExpr()) }); err != nil {
+		return err
+	}
+	if err := e.withSubexpr(func() error { return e.emitExpr(rhs) }); err != nil {
+		return err
+	}
+	var a uint16
+	if !stmtCtx {
+		a |= 1
+	}
+	e.emit(vm.OpObjectDynSet, a, 0, 0)
+	if stmtCtx {
+		e.popStack(3)
+	} else {
+		e.popStack(2)
+	}
+	return nil
+}
+
 // emitObjectVarCompoundAssign emits `$obj->prop OP= rhs` for static-name,
 // non-nullsafe property access. The receiver is evaluated once; the
 // resulting value handle is reused for both objectGet (read current) and