Use consumed_args for array_reduce and some other callback-using functions

Author: drealecs

ext/pcre/php_pcre.c

@@ -1570,6 +1570,7 @@ static zend_string *preg_do_repl_func(zend_fcall_info *fci, zend_fcall_info_cach
 	fci->retval = &retval;
 	fci->param_count = 1;
 	fci->params = &arg;
+	fci->consumed_args = zend_fci_consumed_arg(0);
 	zend_call_function(fci, fcc);
 	zval_ptr_dtor(&arg);
 	if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {

ext/pcre/tests/preg_replace_callback_matches_refcount.phpt

@@ -0,0 +1,37 @@
+--TEST--
+preg_replace_callback(): capture match array refcount stays low during callback
+--FILE--
+<?php
+var_dump(preg_replace_callback('/(.)(.)(.)/', static function ($matches) {
+    debug_zval_dump($matches);
+    return '';
+}, 'abc'));
+
+var_dump(preg_replace_callback_array(['/(.)(.)(.)/' => static function ($matches) {
+    debug_zval_dump($matches);
+    return '';
+}], 'abc'));
+?>
+--EXPECTF--
+array(4) packed refcount(2){
+  [0]=>
+  string(3) "abc"%s
+  [1]=>
+  string(1) "a" interned
+  [2]=>
+  string(1) "b" interned
+  [3]=>
+  string(1) "c" interned
+}
+string(0) ""
+array(4) packed refcount(2){
+  [0]=>
+  string(3) "abc"%s
+  [1]=>
+  string(1) "a" interned
+  [2]=>
+  string(1) "b" interned
+  [3]=>
+  string(1) "c" interned
+}
+string(0) ""

ext/standard/array.c

@@ -6414,6 +6414,7 @@ PHP_FUNCTION(array_reduce)
 	fci.retval = return_value;
 	fci.param_count = 2;
 	fci.params = args;
+	fci.consumed_args = zend_fci_consumed_arg(0);
 
 	ZEND_HASH_FOREACH_VAL(htbl, operand) {
 		ZVAL_COPY_VALUE(&args[0], return_value);

ext/standard/tests/array/array_reduce_accumulator_refcount.phpt

@@ -0,0 +1,35 @@
+--TEST--
+array_reduce(): accumulator refcount stays low during callback
+--FILE--
+<?php
+
+$result = array_reduce([1, 2, 3], function ($acc, $val) {
+    debug_zval_dump($acc);
+    $acc[] = $val;
+    return $acc;
+}, []);
+
+debug_zval_dump($result);
+
+?>
+--EXPECT--
+array(0) interned {
+}
+array(1) packed refcount(2){
+  [0]=>
+  int(1)
+}
+array(2) packed refcount(2){
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+array(3) packed refcount(2){
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}

ext/zend_test/test.c

@@ -603,6 +603,21 @@ static ZEND_FUNCTION(zend_test_call_with_consumed_args)
 	}
 }
 
+static ZEND_FUNCTION(zend_test_refcount)
+{
+	zval *value;
+
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_ZVAL(value)
+	ZEND_PARSE_PARAMETERS_END();
+
+	if (!Z_REFCOUNTED_P(value)) {
+		RETURN_LONG(-1);
+	}
+
+	RETURN_LONG(Z_REFCOUNT_P(value));
+}
+
 static ZEND_FUNCTION(zend_get_unit_enum)
 {
 	ZEND_PARSE_PARAMETERS_NONE();

ext/zend_test/test.stub.php

@@ -305,6 +305,8 @@ function zend_call_method_if_exists(object $obj, string $method, mixed ...$args)
 
     function zend_test_call_with_consumed_args(callable $cb, array $args, int $consumed_args): array {}
 
+    function zend_test_refcount(mixed $value): int {}
+
     function zend_test_zend_ini_parse_quantity(string $str): int {}
     function zend_test_zend_ini_parse_uquantity(string $str): int {}
 

ext/zend_test/test_arginfo.h

@@ -0,0 +1,23 @@
+--TEST--
+ob_start(): consumed callback arg has low refcount
+--EXTENSIONS--
+zend_test
+--FILE--
+<?php
+
+$counts = [];
+ob_start(static function ($buffer) use (&$counts) {
+    $counts[] = zend_test_refcount($buffer);
+    return '';
+});
+echo 'abc';
+ob_end_flush();
+
+var_dump($counts);
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(2)
+}

ext/zend_test/test_decl.h

@@ -972,6 +972,7 @@ static inline php_output_handler_status_t php_output_handler_op(php_output_handl
 			handler->func.user->fci.param_count = 2;
 			handler->func.user->fci.params = ob_args;
 			handler->func.user->fci.retval = &retval;
+			handler->func.user->fci.consumed_args = zend_fci_consumed_arg(0);
 
 			if (SUCCESS == zend_call_function(&handler->func.user->fci, &handler->func.user->fcc) && Z_TYPE(retval) != IS_UNDEF) {
 				if (handler->flags & PHP_OUTPUT_HANDLER_PRODUCED_OUTPUT) {