By-ref foreach over a static array property leaks three blocks

[mirchaemanuel]

Summary

A by-reference foreach over a static array property leaks three heap blocks. Output is correct.

Repro

<?php
class C { public static array $x = [1, 2]; }
foreach (C::$x as &$v) { $v = $v * 2; }
unset($v);
echo implode(",", C::$x);

main 2829ce0ab, macOS ARM64, --heap-debug:

2,4
HEAP DEBUG: allocs=7 frees=4 live_blocks=3

PHP 8.4.23 prints the same 2,4. The static property is mutated correctly — this is purely a lifetime issue.

Notes

Found while fixing #642 (by-ref foreach over an instance property, which corrupted the property outright). The static path behaves correctly by comparison — the writes land and nothing is freed early — but it does not balance its allocations.

Measured identically before and after that fix, so it is pre-existing and independent: the static path is untouched by #651.

[mirchaemanuel]

Additional measurement that pins this as independent of #651 (the by-ref foreach fix for instance properties), taken by compiling the same two programs with both compilers:

	unpatched main	with #651
instance property $o->x	corrupted, no output	2,4 — allocs=8 frees=8 live_blocks=0 clean
static property C::$x	2,4 — allocs=7 frees=4 live_blocks=3	2,4 — allocs=7 frees=4 live_blocks=3

So the instance path goes from corrupting to heap-clean, while the static path is byte-for-byte identical before and after — same allocs, same frees, same residue. The static access lowers through LoadStaticProperty rather than PropGet, which is both why it never showed the instance corruption and why PropGetForWrite does not apply to it. Whatever holds the three extra references is specific to that path.