Fix GH-17187: unreachable program point in zend_hash

A bunch of different issues:
1) The referenced value is copied without incrementing the refcount.
The reason the refcount isn'

Fix GH-17187: unreachable program point in zend_hash

A bunch of different issues:
1) The referenced value is copied without incrementing the refcount.
The reason the refcount isn't incremented is because otherwise
the array modifications would violate the RC1 constraints.
Solve this by copying the reference itself instead and always
read the referenced value.
2) No type checks on the array data, so malicious scripts could
cause type confusion bugs.
3) Potential overflow when the arrays resize and we access ctag.

Closes GH-17205.

show more ...