Fix assertion failure when &__get forwards through initialized lazy proxy

When read_property forwards to the real instance and gets back
&EG(uninitialized_zval), return rv with ZVAL_NULL instead. This
preserves the invariant that read_property won't return the
uninitialized sentinel when get_property_ptr_ptr returned NULL.

Author: iliaal

Zend/tests/lazy_objects/gh21478-proxy-get-ref-forward.phpt

@@ -0,0 +1,32 @@
+--TEST--
+GH-21478: No assertion failure when &__get forwards through initialized lazy proxy
+--FILE--
+<?php
+class Foo {
+    public $_;
+
+    public function &__get($name) {
+        global $proxy;
+        printf("%s(\$%s) on %s\n", __METHOD__, $name, $this::class);
+        return $proxy->{$name};
+    }
+}
+
+class Bar extends Foo {}
+
+$rc = new ReflectionClass(Bar::class);
+$proxy = $rc->newLazyProxy(function () {
+    echo "Init\n";
+    return new Foo();
+});
+
+$real = $rc->initializeLazyObject($proxy);
+$a = &$real->x;
+var_dump($a);
+?>
+--EXPECTF--
+Init
+Foo::__get($x) on Foo
+
+Warning: Undefined property: Foo::$x in %s on line %d
+NULL

Zend/zend_object_handlers.c

@@ -905,7 +905,12 @@ ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int
 			uint32_t guard_type = ((type == BP_VAR_IS) && zobj->ce->__isset)
 				? IN_ISSET : IN_GET;
 			if ((*instance_guard) & guard_type) {
-				return zend_std_read_property(instance, name, type, cache_slot, rv);
+				retval = zend_std_read_property(instance, name, type, cache_slot, rv);
+				if (retval == &EG(uninitialized_zval)) {
+					ZVAL_NULL(rv);
+					retval = rv;
+				}
+				return retval;
 			}
 		}
 	}