Merge branch 'PHP-8.1'

* PHP-8.1:
  [ci skip] NEWS
  Fix `WeakMap` object reference offset causing `TypeError` (#8995)

Author: arnaud-lb

Zend/tests/weakrefs/weakmap_object_reference.phpt

@@ -0,0 +1,32 @@
+--TEST--
+WeakMap object reference offset
+--FILE--
+<?php
+
+$map = new WeakMap;
+$obj = new stdClass;
+$obj2 = &$obj;
+
+$map[$obj] = 1;
+var_dump(count($map));
+var_dump($map);
+var_dump(isset($map[$obj]));
+var_dump(!empty($map[$obj]));
+var_dump($map[$obj]);
+
+?>
+--EXPECT--
+int(1)
+object(WeakMap)#1 (1) {
+  [0]=>
+  array(2) {
+    ["key"]=>
+    object(stdClass)#2 (0) {
+    }
+    ["value"]=>
+    int(1)
+  }
+}
+bool(true)
+bool(true)
+int(1)

Zend/zend_weakrefs.c

@@ -332,6 +332,7 @@ static zval *zend_weakmap_read_dimension(zend_object *object, zval *offset, int
 		return NULL;
 	}
 
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return NULL;
@@ -362,6 +363,7 @@ static void zend_weakmap_write_dimension(zend_object *object, zval *offset, zval
 		return;
 	}
 
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return;
@@ -390,6 +392,7 @@ static void zend_weakmap_write_dimension(zend_object *object, zval *offset, zval
 /* int return and check_empty due to Object Handler API */
 static int zend_weakmap_has_dimension(zend_object *object, zval *offset, int check_empty)
 {
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return 0;
@@ -409,6 +412,7 @@ static int zend_weakmap_has_dimension(zend_object *object, zval *offset, int che
 
 static void zend_weakmap_unset_dimension(zend_object *object, zval *offset)
 {
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return;