`foreach` by reference followed by value iteration segfaults on indexed arrays

[nahime0]

Description

A by-reference foreach over an indexed array can leave the array in a bad runtime state for a later by-value foreach over the same array.

PHP 8.4.19 prints the expected mutated values. The current Elephc tree compiles successfully, but the generated binary exits with SIGSEGV.

Minimal repro

<?php
$a = [1, 2, 3];
foreach ($a as &$v) { $v *= 2; }
unset($v);
foreach ($a as $v) { echo $v; }

Steps to reproduce

1. Save the repro as main.php.
2. Run php -d display_errors=1 -d error_reporting=E_ALL main.php.
3. Compile with Elephc and run the produced binary.

Expected behavior

PHP output:

246

The Elephc-compiled binary should print the same output and exit 0.

Actual behavior

• PHP 8.4.19: stdout 246, exit 0
• Elephc current tree: compile succeeds, binary exits SIGSEGV (-11) with no stdout/stderr

Direct indexed reads after the by-ref loop still work:

<?php
$a = [1, 2, 3];
foreach ($a as &$v) { $v *= 2; }
unset($v);
echo $a[0], $a[1], $a[2];

That prints 246 under Elephc, so the crash seems specific to the later by-value foreach path.

Environment

• Elephc crate version during build: 0.23.7
• Git commit: 09cb0523
• OS: macOS arm64
• PHP baseline: PHP 8.4.19 (cli)