[lazerg]

When the "Undefined variable" warning for the second operand runs an error handler that unsets the first operand, the helper passes an IS_UNDEF op1 to the operator function and hits the assertion. The arithmetic and bitwise helpers, plus the DIV and POW handlers, now treat op1 as null in that case, the same way an undefined variable is handled.

Fixes #24708

[iliaal]

The mirrored case still asserts with this applied, through the compound assignment:

set_error_handler(function () { unset($GLOBALS['y']); return true; });
$y = 1;
$x += $y;

===, $x->{$y}, isset($x[$y]) and frameless calls such as str_contains($x, $y) also read freed memory when the handler frees an operand. This is the GH-20018 class, so it needs the general deferral (#22515) rather than per-handler checks.

[lazerg]

Closing in favor of #22515. You're right, a check in each handler can't cover the compound assignment or the other cases.