Fix AST export of by-reference property hooks

ZEND_ACC_RETURN_REFERENCE shares a bit with ZEND_ACC_PRIVATE_SET, so &get
was exported as private(set) get.

Author: jorgsowa

NEWS

@@ -144,6 +144,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-24480 (Finally block running a second time when a VM interrupt
     throws as the finally block returns to a "return" in its try block).
     (C. Scott Ananian)
+  . Fixed AST export of by-reference property hooks. (Jorg Sowa)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).

Zend/tests/property_hooks/ast_printing_by_ref.phpt

@@ -0,0 +1,34 @@
+--TEST--
+By-reference hook AST printing
+--FILE--
+<?php
+
+try {
+    assert(false && new class {
+        public $prop1 { &get => $this->prop1; }
+        public $prop2 {
+            final &get {
+                return $this->prop2;
+            }
+        }
+        public private(set) int $prop3 { &get => $this->prop3; }
+    });
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+assert(false && new class {
+    public $prop1 {
+        &get => $this->prop1;
+    }
+    public $prop2 {
+        final &get {
+            return $this->prop2;
+        }
+    }
+    public private(set) int $prop3 {
+        &get => $this->prop3;
+    }
+})

Zend/zend_ast.c

@@ -1788,10 +1788,12 @@ static ZEND_COLD void zend_ast_export_hook_list(smart_str *str, zend_ast_list *h
 
 	for (uint32_t i = 0; i < hook_list->children; i++) {
 		zend_ast_decl *hook = (zend_ast_decl *)hook_list->child[i];
-		zend_ast_export_visibility(str, hook->flags, ZEND_MODIFIER_TARGET_PROPERTY);
 		if (hook->flags & ZEND_ACC_FINAL) {
 			smart_str_appends(str, "final ");
 		}
+		if (hook->flags & ZEND_ACC_RETURN_REFERENCE) {
+			smart_str_appendc(str, '&');
+		}
 		smart_str_append(str, hook->name);
 		zend_ast *body = hook->child[2];
 		if (body == NULL) {