Fix GH-24154: Function JIT ++/-- on typed property holding a reference

[lazerg]

Since 1b2bde4, zend_jit_inc_typed_prop() and zend_jit_dec_typed_prop() only deref the copy, so var_ptr still points at the reference. The type check then fails on the reference itself, and the error path destroys it and overwrites the property slot. This puts the ZVAL_DEREF(var_ptr) back. The regression is only on master.

Fixes GH-24154

[ndossche]

indeed, the optimized macro must only be used when the original zval pointer isn't used
cc @TimWolla

[Girgias]

There should be an explanation or comment somewhere (possibly on the declaration of ZVAL_COPY_DEREF) that the optimized macro cannot be used sometimes. As this is extremely unintuitive.

[TimWolla]

indeed, the optimized macro must only be used when the original zval pointer isn't used

If it isn't tested it doesn't exist. So worth it for the new test 😄