Fix memory leak after GC inside a foreach loop (php#12572)

Fixes oss-fuzz #54515

Author: dstogov

Zend/tests/gc_047.phpt

@@ -0,0 +1,20 @@
+--TEST--
+GC 047: Leak after GC inside a foreach loop
+--INI--
+zend.enable_gc=1
+--FILE--
+<?php
+$a = [0, 1];
+foreach($a as &$v) {
+    $a[0] =& $a;
+    $a[1] = array();
+    $a[1][0] =& $a[1];
+    $b = 1;
+    $a =& $b;
+    gc_collect_cycles();
+    break;
+}
+var_dump(gc_collect_cycles());
+?>
+--EXPECT--
+int(2)

Zend/zend_gc.c

@@ -1696,7 +1696,7 @@ static void zend_gc_root_tmpvars(void) {
 			}
 
 			uint32_t kind = range->var & ZEND_LIVE_MASK;
-			if (kind == ZEND_LIVE_TMPVAR) {
+			if (kind == ZEND_LIVE_TMPVAR || kind == ZEND_LIVE_LOOP) {
 				uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
 				zval *var = ZEND_CALL_VAR(ex, var_num);
 				if (Z_REFCOUNTED_P(var)) {