Description:
------------
Tracing JIT doesn't take into account the dereference and pass into zend_jit_add_arrays_helper() a reference instead of array.

Test script:
---------------
<?php
function foo(&$a) {
    $n = count($a);	
    $a = $a + [$n=>1];
}
function bar() {
    $x = [];
    for ($i = 0; $i < 200; $i++) {
        foo($x);
    }
    var_dump(count($x));
}
bar();
?>

Expected result:
----------------
int(200)

Actual result:
--------------
int(1) or crash, assertion, ASAN failure