Description:
------------
Found this using afl-fuzz, see http://lcamtuf.coredump.cx/afl/

To reproduce, compile PHP with CFLAGS=-O3, then run ./sapi/cli/php with the test script
<?php $a[]/=$a=a?>
You should get a segfault.

Bisected this crash back to commit 7a01c44ab268820c2365798fde0fe010cf6c5e20 which was the fix for bug #69905 (similar test case).

The test case I found needed to have an array with an "assign-and-??" operator (/=, *=, +=, etc), combined with an assign operator, with a character on the RHS of the assignment. ($a[]/=$a=a).

Traced the bug to the ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER assuming that the zend_fetch_dimension_address_RW method returned as INDIRECT type, but the patch for bug #69905 returned a NULL type (see Zend/zend_vm_execute.h line 33752 of commit 9f395b9e761a4d714e22366a63e9640cee461bd4). The assert is probably the reason why I needed -O3 in CFLAGS.

Created a patch that applies cleanly to master, and makes no change in the "make test" run after recompilation.

Test script:
---------------
<?php $a[]/=$a=a?>


Expected result:
----------------
Fatal error: Uncaught Error: [] operator not supported for strings in /root/php-crash-tmin:1
Stack trace:
#0 {main}
  thrown in /root/php-crash-tmin on line 1


Actual result:
--------------
(gdb) bt
#0  zend_binary_assign_op_dim_helper_SPEC_CV_UNUSED (binary_op=<optimized out>) at /root/php-src/Zend/zend_vm_execute.h:33769
#1  ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER () at /root/php-src/Zend/zend_vm_execute.h:33860
#2  0x00000000006221fb in execute_ex (ex=<optimized out>) at /root/php-src/Zend/zend_vm_execute.h:406
#3  0x000000000067f4e9 in zend_execute (op_array=0x7ffff70690e0, return_value=0x90, return_value@entry=0x7ffff7014030) at /root/php-src/Zend/zend_vm_execute.h:450
#4  0x00000000005d9ea8 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff7014030, retval@entry=0x0, file_count=file_count@entry=3)
    at /root/php-src/Zend/zend.c:1404
#5  0x00000000005678d0 in php_execute_script (primary_file=primary_file@entry=0x7fffffffd630) at /root/php-src/main/main.c:2475
#6  0x0000000000680c6b in do_cli (argc=2, argv=0xa8d780) at /root/php-src/sapi/cli/php_cli.c:971
#7  0x000000000041ed80 in main (argc=2, argv=0xa8d780) at /root/php-src/sapi/cli/php_cli.c:1338
(gdb) i r
rax            0x4      4
rbx            0x700000009      30064771081
rcx            0x4      4
rdx            0x7ffff7073050   140737337831504
rsi            0x90     144
rdi            0x7ffff7073000   140737337831424
rbp            0x7ffff70140c0   0x7ffff70140c0
rsp            0x7fffffffb160   0x7fffffffb160
r8             0x200    512
r9             0x0      0
r10            0xac6390 11297680
r11            0x7ffff7476870   140737342040176
r12            0x7ffff70140c0   140737337442496
r13            0x0      0
r14            0x7ffff7014030   140737337442352
r15            0x7ffff70720e0   140737337827552
rip            0x670755 0x670755 <ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER+133>
eflags         0x10206  [ PF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0
(gdb) x/i $rip
=> 0x670755 <ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER+133>:       movzbl 0x9(%rbx),%ecx