From 3692a5fa57dca1a9a462a7c5922838786860e28f Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 23 Feb 2026 02:14:03 +0100
Subject: [PATCH 1/3] Tweak stack limit values for gh20583.phpt

Graciously tested by Andy Postnikov (andypost).

See GH-21086
Closes GH-21274
---
 ext/standard/tests/http/http_build_query/gh20583.phpt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ext/standard/tests/http/http_build_query/gh20583.phpt b/ext/standard/tests/http/http_build_query/gh20583.phpt
index 5ea0dbe9006b..2d93d3b6f448 100644
--- a/ext/standard/tests/http/http_build_query/gh20583.phpt
+++ b/ext/standard/tests/http/http_build_query/gh20583.phpt
@@ -10,11 +10,11 @@ if (getenv('SKIP_ASAN')) {
 }
 ?>
 --INI--
-zend.max_allowed_stack_size=128K
+zend.max_allowed_stack_size=256K
 --FILE--
 <?php
 $a = null;
-for ($i = 0; $i < 1000; $i++) {
+for ($i = 0; $i < 3000; $i++) {
  $a = [$i => $a];
 }
 try {

From f07809f495e49de0edbfa04f888c16d994ceb4fb Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 23 Feb 2026 02:17:56 +0100
Subject: [PATCH 2/3] Tweak stack limit values for gh20840.phpt

Graciously tested by Andy Postnikov (andypost).

See GH-21086
Closes GH-21275
---
 ext/standard/tests/general_functions/gh20840.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/standard/tests/general_functions/gh20840.phpt b/ext/standard/tests/general_functions/gh20840.phpt
index 99df478c1f26..35d72cf0fb5d 100644
--- a/ext/standard/tests/general_functions/gh20840.phpt
+++ b/ext/standard/tests/general_functions/gh20840.phpt
@@ -12,7 +12,7 @@ if (getenv('SKIP_ASAN')) {
 }
 ?>
 --INI--
-zend.max_allowed_stack_size=128K
+zend.max_allowed_stack_size=256K
 --FILE--
 <?php
 class Node {

From db0e365f5a10db361ba3c962ce84ff92378edb7b Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Tue, 24 Feb 2026 02:15:07 +0100
Subject: [PATCH 3/3] Fix missing reference unwrap for FE_FETCH_R in JIT
 (GH-21265)

Fixes GH-21264
---
 ext/opcache/jit/zend_jit_ir.c        |  7 +++++
 ext/opcache/tests/jit/gh21264-1.phpt | 47 ++++++++++++++++++++++++++++
 ext/opcache/tests/jit/gh21264-2.phpt | 31 ++++++++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 ext/opcache/tests/jit/gh21264-1.phpt
 create mode 100644 ext/opcache/tests/jit/gh21264-2.phpt

diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index ace120668204..19b3ce125733 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -14105,6 +14105,13 @@ static int zend_jit_fe_fetch(zend_jit_ctx *jit, const zend_op *opline, uint32_t
 				return 0;
 			}
 		} else {
+			// JIT: ZVAL_DEREF(value);
+			if (val_info & MAY_BE_REF) {
+				ir_ref ref = jit_ZVAL_ADDR(jit, val_addr);
+				ref = jit_ZVAL_DEREF_ref(jit, ref);
+				val_addr = ZEND_ADDR_REF_ZVAL(ref);
+				val_info &= ~MAY_BE_REF;
+			}
 			// JIT: ZVAL_COPY(res, value);
 			jit_ZVAL_COPY(jit, var_addr, -1, val_addr, val_info, true);
 		}
diff --git a/ext/opcache/tests/jit/gh21264-1.phpt b/ext/opcache/tests/jit/gh21264-1.phpt
new file mode 100644
index 000000000000..ec6cf407fa3b
--- /dev/null
+++ b/ext/opcache/tests/jit/gh21264-1.phpt
@@ -0,0 +1,47 @@
+--TEST--
+GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=function
+--FILE--
+<?php
+
+class C {
+    public array $array;
+
+    public static function identity($x) {
+        return $x;
+    }
+
+    public function test() {
+        return array_map(self::identity(...), $this->array);
+    }
+}
+
+function test() {
+    $c = new C;
+    $element = 'qux';
+    $c->array = [&$element, &$element];
+    var_dump($c->test());
+}
+
+test();
+test();
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(3) "qux"
+  [1]=>
+  string(3) "qux"
+}
+array(2) {
+  [0]=>
+  string(3) "qux"
+  [1]=>
+  string(3) "qux"
+}
diff --git a/ext/opcache/tests/jit/gh21264-2.phpt b/ext/opcache/tests/jit/gh21264-2.phpt
new file mode 100644
index 000000000000..0729546a959d
--- /dev/null
+++ b/ext/opcache/tests/jit/gh21264-2.phpt
@@ -0,0 +1,31 @@
+--TEST--
+GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=tracing
+--FILE--
+<?php
+
+class C {
+    public $prop = 0;
+}
+
+function test($array) {
+    $c = new C;
+    foreach ($array as $c->prop) {
+        $c->prop++;
+    }
+}
+
+$element = 0;
+$array = [&$element, &$element];
+test($array);
+test($array);
+var_dump($element);
+
+?>
+--EXPECT--
+int(0)