Fix serializing ZEND_AST_SHELL_EXEC

Currently, `foo` is reserialized as `'foo'` due to misuse of zend_ast_export().
ZEND_AST_SHELL_EXEC can only contain ZEND_AST_ZVAL(string) or ZEND_AST_ENCAPS_LIST,
so just handle the ZEND_AST_ZVAL(string) case directly.

Zend/tests/ast_serialize_backtick_literal.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Serialization of backtick literal is incorrect
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+
+assert_options(ASSERT_WARNING);
+assert(false && `echo -n ""`);
+--EXPECTF--
+Warning: assert(): assert(false && `echo -n ""`) failed in %s/ast_serialize_backtick_literal.php on line 4

Zend/zend_ast.c

@@ -1217,7 +1217,11 @@ simple_list:
 			if (ast->child[0]->kind == ZEND_AST_ENCAPS_LIST) {
 				zend_ast_export_encaps_list(str, '`', (zend_ast_list*)ast->child[0], indent);
 			} else {
-				zend_ast_export_ex(str, ast->child[0], 0, indent);
+				zval *zv;
+				ZEND_ASSERT(ast->child[0]->kind == ZEND_AST_ZVAL);
+				zv = zend_ast_get_zval(ast->child[0]);
+				ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);
+				zend_ast_export_qstr(str, '`', Z_STR_P(zv));
 			}
 			smart_str_appendc(str, '`');
 			break;