Fix crash when unpacking into array literal with string keys

Author: nikic

Zend/tests/array_unpack_string_keys.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Using array unpacking in an array literal that also has string keys (OSS-Fuzz #17965)
+--FILE--
+<?php
+$y = [1, 2, 3];
+$z = "bar";
+$x = [...$y, "foo" => $z];
+var_dump($x);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  ["foo"]=>
+  string(3) "bar"
+}

Zend/zend_compile.c

@@ -7888,6 +7888,7 @@ void zend_compile_array(znode *result, zend_ast *ast) /* {{{ */
 		if (elem_ast->kind == ZEND_AST_UNPACK) {
 			zend_compile_expr(&value_node, value_ast);
 			if (i == 0) {
+				opnum_init = get_next_op_number();
 				opline = zend_emit_op_tmp(result, ZEND_INIT_ARRAY, NULL, NULL);
 			}
 			opline = zend_emit_op(NULL, ZEND_ADD_ARRAY_UNPACK, &value_node, NULL);