Fix GH-8364: msgfmt_format $values may not support references

We need to deref any references passed in the `$values` array.  While
we could handle this in the type switch, doing it right away in the
foreach loop makes that more explicit, and also circumvents the missing
range checks for integers which are not passed as int or double.

Closes GH-8407.

Author: cmb69

NEWS

@@ -16,6 +16,9 @@ PHP                                                                        NEWS
   . Fixed bug #77023 (FPM cannot shutdown processes). (Jakub Zelenka)
   . Fixed comment in kqueue remove callback log message. (David Carlier)
 
+- Intl:
+  . Fixed bug GH-8364 (msgfmt_format $values may not support references). (cmb)
+
 - MySQLi:
   . Fixed bug GH-8267 (MySQLi uses unsupported format specifier on Windows).
     (cmb)

ext/intl/msgformat/msgformat_helpers.cpp

@@ -392,6 +392,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 	zend_ulong		 num_index;
 
 	ZEND_HASH_FOREACH_KEY_VAL(args, num_index, str_index, elem) {
+		ZVAL_DEREF(elem);
 		Formattable& formattable = fargs[argNum];
 		UnicodeString& key = farg_names[argNum];
 		Formattable::Type argType = Formattable::kObject, //unknown

ext/intl/tests/gh8364.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug GH-8364 (msgfmt_format $values may not support references)
+--SKIPIF--
+<?php
+if (!extension_loaded("intl")) die("skip intl extension not available");
+?>
+--FILE--
+<?php
+$formatter = new MessageFormatter('en', 'translate {0}');
+$args = ['string', 'string'];
+foreach ($args as &$arg) {
+//     do nothing;
+}
+$result = $formatter->format($args);
+var_dump($result);
+var_dump(intl_get_error_code());
+?>
+--EXPECT--
+string(16) "translate string"
+int(0)