Fixed GH-12428: Assertion with function/tracing JIT

Author: dstogov

ext/opcache/jit/zend_jit_helpers.c

@@ -1938,7 +1938,7 @@ static void ZEND_FASTCALL zend_jit_fetch_obj_is_dynamic(zend_object *zobj, intpt
 		if (EXPECTED(retval)) {
 			intptr_t idx = (char*)retval - (char*)zobj->properties->arData;
 			CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
-			ZVAL_COPY(result, retval);
+			ZVAL_COPY_DEREF(result, retval);
 			return;
 		}
 	}

ext/opcache/tests/jit/gh12428.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-12428: Assertion with function/tracing JIT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+function validate($value)
+{
+    foreach ([0] as $_) {
+        $a = &$value->a;
+        $value->a ?? null;
+    }
+}
+
+validate((object) []);
+validate((object) []);
+validate((object) ['b' => 0]);
+?>
+DONE
+--EXPECT--
+DONE