zend_vm_def: Handle references for ZEND_TYPE_ASSERT

Author: TimWolla

Zend/zend_vm_def.h

@@ -8869,6 +8869,12 @@ ZEND_VM_HOT_HANDLER(211, ZEND_TYPE_ASSERT, CONST, ANY, NUM)
 	uint8_t expected_type = opline->extended_value & 0xff;
 	/* Simple types can be checked directly. */
 	if (UNEXPECTED(actual_type != expected_type)) {
+		zend_reference *ref = NULL;
+		if (Z_ISREF_P(value)) {
+			value = Z_REFVAL_P(value);
+			ref = Z_REF_P(value);
+		}
+
 		zend_function *fbc;
 		{
 			zval *fname = (zval*)RT_CONSTANT(opline, opline->op1);
@@ -8879,7 +8885,7 @@ ZEND_VM_HOT_HANDLER(211, ZEND_TYPE_ASSERT, CONST, ANY, NUM)
 		uint16_t argno = opline->extended_value >> 16;
 		zend_arg_info *arginfo = &fbc->common.arg_info[argno - 1];
 
-		if (!zend_check_user_type_slow(&arginfo->type, value, /* ref */ NULL, /* is_return_type */ false)) {
+		if (!zend_check_user_type_slow(&arginfo->type, value, ref, /* is_return_type */ false)) {
 			const char *param_name = get_function_arg_name(fbc, argno);
 			zend_string *expected = zend_type_to_string(arginfo->type);
 			zend_type_error("%s(): Argument #%d%s%s%s must be of type %s, %s given", ZSTR_VAL(fbc->common.function_name), argno, param_name ? " ($" : "", param_name ? param_name : "", param_name ? ")" : "", ZSTR_VAL(expected), zend_zval_value_name(value));