Fix GH-21687: assertion failure in zend_enum_fetch_case_name after array_walk

array_walk() wraps object properties in IS_REFERENCE when passing
them to the callback. For enum objects, this converts the name
property from IS_STRING to IS_REFERENCE in-place. A subsequent
var_dump() calls zend_enum_fetch_case_name() which asserts IS_STRING
on the property, triggering an assertion failure.

Dereference through IS_REFERENCE in both zend_enum_fetch_case_name()
and zend_enum_fetch_case_value() before accessing the value.

Closes GH-21687

Author: iliaal

Zend/tests/gh21687.phpt

@@ -0,0 +1,18 @@
+--TEST--
+GH-21687 (Assertion failure in zend_enum_fetch_case_name after array_walk on enum)
+--FILE--
+<?php
+enum Foo: int {
+    case Bar = 0;
+}
+
+$bar = Foo::Bar;
+array_walk($bar, function($v) {});
+var_dump($bar);
+echo $bar->name . "\n";
+echo $bar->value . "\n";
+?>
+--EXPECT--
+enum(Foo::Bar)
+Bar
+0

Zend/zend_enum.h

@@ -69,6 +69,7 @@ static zend_always_inline zval *zend_enum_fetch_case_name(zend_object *zobj)
 	ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_ENUM);
 
 	zval *name = OBJ_PROP_NUM(zobj, 0);
+	ZVAL_DEREF(name);
 	ZEND_ASSERT(Z_TYPE_P(name) == IS_STRING);
 	return name;
 }
@@ -77,7 +78,10 @@ static zend_always_inline zval *zend_enum_fetch_case_value(zend_object *zobj)
 {
 	ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_ENUM);
 	ZEND_ASSERT(zobj->ce->enum_backing_type != IS_UNDEF);
-	return OBJ_PROP_NUM(zobj, 1);
+
+	zval *value = OBJ_PROP_NUM(zobj, 1);
+	ZVAL_DEREF(value);
+	return value;
 }
 
 END_EXTERN_C()