Fix by-ref unpack sending of offsets

Fixes phpGH-12404

Author: iluuu1994

Zend/tests/arg_unpack/gh14202.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-14202: Fetch splat arg value by RW
+--FILE--
+<?php
+$args = [1];
+$ref = [&$args];
+function test(&$v) {
+	$v = 7;
+};
+test(...$ref[0]);
+var_dump($args[0]);
+?>
+--EXPECT--
+int(7)

Zend/zend_compile.c

@@ -3685,7 +3685,11 @@ static uint32_t zend_compile_args(
 			uses_arg_unpack = 1;
 			fbc = NULL;
 
-			zend_compile_expr(&arg_node, arg->child[0]);
+			if (zend_is_variable(arg->child[0])) {
+				zend_compile_var(&arg_node, arg->child[0], BP_VAR_RW, /* by_ref */ false);
+			} else {
+				zend_compile_expr(&arg_node, arg->child[0]);
+			}
 			opline = zend_emit_op(NULL, ZEND_SEND_UNPACK, &arg_node, NULL);
 			opline->op2.num = arg_count;
 			opline->result.var = EX_NUM_TO_VAR(arg_count - 1);

Zend/zend_vm_def.h

@@ -5114,7 +5114,12 @@ ZEND_VM_HANDLER(165, ZEND_SEND_UNPACK, ANY, ANY)
 	uint32_t arg_num;
 
 	SAVE_OPLINE();
-	args = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+
+	if (OP1_TYPE == IS_VAR) {
+		args = GET_OP1_ZVAL_PTR_PTR_UNDEF(BP_VAR_RW);
+	} else {
+		args = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	}
 	arg_num = ZEND_CALL_NUM_ARGS(EX(call)) + 1;
 
 ZEND_VM_C_LABEL(send_again):