[wleeaf]

Bug: foreach can assign by reference to a property, an array element or a static property, not only to a variable:

foreach ($test as &$object->property) {}
foreach ($test as $key => &$array[$key]) {}

The parser marks the value with byref, but only the variable printer prints the &, so these were formatted as foreach ($test as $object->property) and foreach ($test as $key => $array[$key]). The loop then assigns by value instead of binding a reference, which silently changes what it does.

Fix: in the foreach printer (src/printer.mjs), a byref value that is not a plain variable gets the & printed in front of it. Variables still print their own &, so foreach ($a as &$v) is unchanged.

Tests: added both forms above to tests/foreach/foreach.php and updated the snapshot. Without the fix, the snapshot test fails because the & is gone. With it, yarn test:node passes (599 tests), AST_COMPARE=1 yarn test:node passes and yarn lint is clean.

I found this by formatting the --FILE-- sections of php-src's Zend/tests and comparing nikic/PHP-Parser ASTs of the input and output. Zend/tests/foreach/foreach_by_ref_to_property.phpt and Zend/tests/enum/no-write-properties-through-foreach-reference.phpt changed meaning before this change and round-trip after it.