Properly handle __debugInfo() returning an array reference

Currently, this fails because the type is IS_REFERENCE instead of
IS_ARRAY, but this could be confusing because a function return value is
normally dereferenced automatically in a lot of cases.

Closes GH-18762.

NEWS

@@ -14,6 +14,7 @@ PHP                                                                        NEWS
   . Drop support for -z CLI/CGI flag. (nielsdos)
   . Fixed GH-17956 - development server 404 page does not adapt to mobiles.
     (pascalchevrel)
+  . Properly handle __debugInfo() returning an array reference. (nielsdos)
 
 - CURL:
   . Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY

Zend/tests/__debugInfo_reference.phpt

@@ -0,0 +1,22 @@
+--TEST--
+__debugInfo with reference return
+--FILE--
+<?php
+
+class Test {
+    private $tmp = ['x' => 1];
+
+    public function &__debugInfo(): array
+    {
+        return $this->tmp;
+    }
+}
+
+var_dump(new Test);
+
+?>
+--EXPECT--
+object(Test)#1 (1) {
+  ["x"]=>
+  int(1)
+}

Zend/zend_object_handlers.c

@@ -206,6 +206,9 @@ ZEND_API HashTable *zend_std_get_debug_info(zend_object *object, int *is_temp) /
 	}
 
 	zend_call_known_instance_method_with_0_params(ce->__debugInfo, object, &retval);
+	if (UNEXPECTED(Z_ISREF(retval))) {
+		zend_unwrap_reference(&retval);
+	}
 	if (Z_TYPE(retval) == IS_ARRAY) {
 		if (!Z_REFCOUNTED(retval)) {
 			*is_temp = 1;