Fix by-ref unpack sending of offsets

Fixes phpGH-12404

Author: iluuu1994

Zend/tests/arg_unpack/gh14202.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-14202: Fetch splat arg value by RW
+--FILE--
+<?php
+$args = [1];
+$ref = [&$args];
+function test(&$v) {
+	$v = 7;
+};
+test(...$ref[0]);
+var_dump($args[0]);
+?>
+--EXPECT--
+int(7)

Zend/zend_compile.c

@@ -3685,7 +3685,11 @@ static uint32_t zend_compile_args(
 			uses_arg_unpack = 1;
 			fbc = NULL;
 
-			zend_compile_expr(&arg_node, arg->child[0]);
+			if (zend_is_variable(arg->child[0])) {
+				zend_compile_var(&arg_node, arg->child[0], BP_VAR_RW, /* by_ref */ false);
+			} else {
+				zend_compile_expr(&arg_node, arg->child[0]);
+			}
 			opline = zend_emit_op(NULL, ZEND_SEND_UNPACK, &arg_node, NULL);
 			opline->op2.num = arg_count;
 			opline->result.var = EX_NUM_TO_VAR(arg_count - 1);

Zend/zend_vm_def.h

@@ -5306,6 +5306,9 @@ ZEND_VM_C_LABEL(send_again):
 
 			zend_iterator_dtor(iter);
 		}
+	} else if (Z_TYPE_P(args)) {
+		args = Z_INDIRECT_P(args);
+		ZEND_VM_C_GOTO(send_again);
 	} else if (EXPECTED(Z_ISREF_P(args))) {
 		args = Z_REFVAL_P(args);
 		ZEND_VM_C_GOTO(send_again);