Fix missing reference unwrap for FE_FETCH_R in JIT

ext/opcache/jit/zend_jit_ir.c

@@ -14105,6 +14105,13 @@ static int zend_jit_fe_fetch(zend_jit_ctx *jit, const zend_op *opline, uint32_t
 				return 0;
 			}
 		} else {
+			// JIT: ZVAL_DEREF(value);
+			if (val_info & MAY_BE_REF) {
+				ir_ref ref = jit_ZVAL_ADDR(jit, val_addr);
+				ref = jit_ZVAL_DEREF_ref(jit, ref);
+				val_addr = ZEND_ADDR_REF_ZVAL(ref);
+				val_info &= ~MAY_BE_REF;
+			}
 			// JIT: ZVAL_COPY(res, value);
 			jit_ZVAL_COPY(jit, var_addr, -1, val_addr, val_info, true);
 		}

ext/opcache/tests/jit/gh21264-1.phpt

@@ -0,0 +1,47 @@
+--TEST--
+GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=function
+--FILE--
+<?php
+
+class C {
+    public array $array;
+
+    public static function identity($x) {
+        return $x;
+    }
+
+    public function test() {
+        return array_map(self::identity(...), $this->array);
+    }
+}
+
+function test() {
+    $c = new C;
+    $element = 'qux';
+    $c->array = [&$element, &$element];
+    var_dump($c->test());
+}
+
+test();
+test();
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(3) "qux"
+  [1]=>
+  string(3) "qux"
+}
+array(2) {
+  [0]=>
+  string(3) "qux"
+  [1]=>
+  string(3) "qux"
+}

ext/opcache/tests/jit/gh21264-2.phpt

@@ -0,0 +1,31 @@
+--TEST--
+GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+
+class C {
+    public $prop = 0;
+}
+
+function test($array) {
+    $c = new C;
+    foreach ($array as $c->prop) {
+        $c->prop++;
+    }
+}
+
+$element = 0;
+$array = [&$element, &$element];
+test($array);
+test($array);
+var_dump($element);
+
+?>
+--EXPECT--
+int(0)