`object_properties_load()` bypasses readonly property checks

[TimWolla]

Description

The following code:

<?php

$r = new \Random\Randomizer(new \Random\Engine\PcgOneseq128XslRr64());
$r->__unserialize([['engine' => new \Random\Engine\Xoshiro256StarStar()]]);
var_dump($r->engine::class);

Resulted in this output:

string(32) "Random\Engine\Xoshiro256StarStar"

But I expected this output instead:

Error: Cannot modify readonly property Random\Randomizer::$engine

PHP Version

git master (probably any version)

Operating System

No response

[TimWolla]

This is quite similar to #9186.

[nielsdos]

It bypasses all sorts of things: #9708

[iluuu1994]

It bypasses all sorts of things: #9708

Oof, that's not great. It seems we're missing at least type checks/coercion and exception handling (abort when the destructor fails).

Reference handling is somewhat odd, in that references are copied to the property, except if the reference has RC=1, then they are unwrapped. This leads to some odd behavior (https://3v4l.org/ojCPY), which depends on other references to the reference existing. This makes some sense, in that references are supposed to be transparent, but still seems odd. Reference operations are usually very explicit.

Anyway, given references are copied, this also means we'll need to coerce the value inside the reference, so this has some observable side-effects.