So this solves the assertion failure. But I wonder what this new reflection method actually tests...

I.e. the following code will throw:

<?php
$dom = new DOMDocument;
$dom->doctype = null; // Error!

but it claims this property is writable:

<?php
$rc = new ReflectionClass($dom);
var_dump($rc->getProperty('doctype')->isWritable(null)); // bool(true)

Fair point, returning true for read-only props like doctype is misleading. I'm not sure what the right call is here.

Would it make more sense to fix this on the DOM side, giving these @virtual properties proper get-only hooks so reflection can answer correctly, rather than working
around it in reflection itself? Hooks were designed for this shape, and it'd also benefit anything else that introspects them. It's a bigger patch, but probably the
more correct direction.

As a narrow alternative for the crash-fix, we could throw ReflectionException whenever the property is ZEND_ACC_VIRTUAL without hooks, something like "Cannot
determine writability of virtual property DOMDocument::$doctype without property hooks." Keeps the method honest (correct bool or "don't know") without pretending to
know.

Happy to go either way, or hold off on this PR if you'd rather sort it at the DOM level.

The properties of dom that aren't writable are marked as readonly. This isn't really right as some dom manipulations can change those properties indirectly anyway. This is a leftover from back in the days.
It would be more correct to redeclare them as private(set) instead of readonly, in conjunction with this patch. This might break property redeclarations though so that's definitely master-only material.