Fix tvSame for null-by-reference values

The dereference was too late.

hphp/runtime/base/tv_comparisons.cpp

@@ -391,14 +391,14 @@ bool tvSame(const TypedValue* tv1, const TypedValue* tv2) {
   assert(tvIsPlausible(tv1));
   assert(tvIsPlausible(tv2));
 
+  tv1 = tvToCell(tv1);
+  tv2 = tvToCell(tv2);
+
   bool const null1 = IS_NULL_TYPE(tv1->m_type);
   bool const null2 = IS_NULL_TYPE(tv2->m_type);
   if (null1 && null2) return true;
   if (null1 || null2) return false;
 
-  tv1 = tvToCell(tv1);
-  tv2 = tvToCell(tv2);
-
   switch (tv1->m_type) {
   case KindOfInt64:
   case KindOfBoolean:

hphp/test/slow/comparisons/refnull.php

@@ -0,0 +1,5 @@
+<?php
+
+$a = array(null);
+$b =&$a[0];
+var_dump(in_array(null, $a, true));

hphp/test/slow/comparisons/refnull.php.expect

@@ -0,0 +1 @@
+bool(true)