Fixed bug #70321 (Magic getter breaks reference to array property)

Note that the UNEXPECTED(zv) was turned into EXPECTED(zv), as zv is mostly set in the context where it is used and usually anyway is checked first with OP*_TYPE == IS_VAR; or maybe just completely remove that (UN)EXPECTED at this place...

NEWS

@@ -7,6 +7,7 @@ PHP                                                                        NEWS
   . Fixed bug #70300 (Syntactical inconsistency with new group use syntax).
     (marcio dot web2 at gmail dot com)
   . Fixed bug causing exception traces with anon classes to be truncated. (Bob)
+  . Fixed bug #70321 (Magic getter breaks reference to array property). (Bob)
 
 - PDO_OCI:
   . Fixed bug #70308 (PDO::ATTR_PREFETCH is ignored). (Chris Jones)

Zend/tests/bug70321.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #70321 (Magic getter breaks reference to array property)
+--FILE--
+<?php
+
+class foo {
+	private $bar;
+	public function __construct() {
+		$this->bar = new bar();
+	}
+
+	public function &__get($key) {
+		$bar = $this->bar;
+		// no direct reference to $this->bar
+		return $bar;
+	}
+}
+
+class bar { public $baz = []; }
+
+$foo = new foo();
+$foo->bar->baz[] = function() {};
+var_dump($foo->bar->baz);
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  object(Closure)#%d (0) {
+  }
+}

Zend/zend_execute.c

@@ -89,7 +89,7 @@ static const zend_internal_function zend_pass_function = {
 #define zval_ptr_dtor(zv) i_zval_ptr_dtor(zv ZEND_FILE_LINE_CC)
 
 #define READY_TO_DESTROY(zv) \
-	(UNEXPECTED(zv) && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1)
+	(EXPECTED(zv) && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1 && (EXPECTED(Z_ISREF_P(zv) == 0) || Z_REFCOUNTED_P(Z_REFVAL_P(zv)) && Z_REFCOUNT_P(Z_REFVAL_P(zv)) == 1))
 
 #define EXTRACT_ZVAL_PTR(zv, check_null) do {		\
 	zval *__zv = (zv);								\