Make call_uer_func_array() populate regular values to references, if possible

Zend/tests/bug61273.phpt

@@ -8,7 +8,7 @@ Bug #61273 (call_user_func_array with more than 16333 arguments leaks / crashes)
  * we should trick EG(argument_stack) into growing
  */
 $args = array_fill(0, 64 * 1024 - 64, 0);
-call_user_func_array(function(&$a) {}, $args);
+call_user_func_array(function(&$a) {}, (array)$args);
 echo strval("okey");
 --EXPECTF--
 Warning: Parameter 1 to {closure}() expected to be a reference, value given in %sbug61273.php on line %d

Zend/tests/bug72101.phpt

@@ -8,7 +8,7 @@ class PHPUnit_Framework_MockObject_Stub_ReturnCallback {
         $this->callback = $callback;
     }
     public function invoke($invocation) {
-        return call_user_func_array($this->callback, $invocation->parameters);
+        return call_user_func_array($this->callback, (array)$invocation->parameters);
     }
 }
 

Zend/tests/call_user_func_array_prefer_ref.phpt

@@ -37,11 +37,11 @@ array(1) {
   [0]=>
   array(3) {
     [0]=>
-    int(3)
+    int(1)
     [1]=>
     int(2)
     [2]=>
-    int(1)
+    int(3)
   }
 }
 array(3) {
@@ -56,11 +56,11 @@ array(1) {
   [0]=>
   array(3) {
     [0]=>
-    int(3)
+    int(1)
     [1]=>
     int(2)
     [2]=>
-    int(1)
+    int(3)
   }
 }
 array(3) {

Zend/zend_API.c

@@ -3485,10 +3485,9 @@ ZEND_API int zend_fcall_info_args_ex(zend_fcall_info *fci, zend_function *func,
 
 	ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(args), arg) {
 		if (func && !Z_ISREF_P(arg) && ARG_SHOULD_BE_SENT_BY_REF(func, n)) {
-			ZVAL_NEW_REF(params, arg);
-			if (Z_REFCOUNTED_P(arg)) {
-				Z_ADDREF_P(arg);
-			}
+			ZVAL_NEW_REF(arg, arg);
+			Z_ADDREF_P(arg);
+			ZVAL_REF(params, Z_REF_P(arg));
 		} else {
 			ZVAL_COPY(params, arg);
 		}

Zend/zend_compile.c

@@ -3519,7 +3519,11 @@ int zend_compile_func_cufa(znode *result, zend_ast_list *args, zend_string *lcna
 	}
 
 	zend_compile_init_user_func(args->child[0], 0, lcname);
-	zend_compile_expr(&arg_node, args->child[1]);
+	if (zend_is_variable(args->child[1]) && !zend_is_call(args->child[1])) {
+		zend_compile_var(&arg_node, args->child[1], BP_VAR_W);
+	} else {
+		zend_compile_expr(&arg_node, args->child[1]);
+	}
 	zend_emit_op(NULL, ZEND_SEND_ARRAY, &arg_node, NULL);
 	zend_emit_op(result, ZEND_DO_FCALL, NULL, NULL);
 

Zend/zend_vm_def.h

@@ -4585,14 +4585,18 @@ ZEND_VM_C_LABEL(send_again):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HANDLER(119, ZEND_SEND_ARRAY, ANY, ANY)
+ZEND_VM_HANDLER(119, ZEND_SEND_ARRAY, CONST|TMP|VAR|CV, ANY)
 {
 	USE_OPLINE
 	zend_free_op free_op1;
 	zval *args;
 
 	SAVE_OPLINE();
-	args = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE & (IS_VAR|IS_CV)) {
+		args = GET_OP1_ZVAL_PTR_PTR(BP_VAR_R);
+	} else {
+		args = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	}
 
 	if (UNEXPECTED(Z_TYPE_P(args) != IS_ARRAY)) {
 		if ((OP1_TYPE & (IS_VAR|IS_CV)) && Z_ISREF_P(args)) {
@@ -4617,6 +4621,20 @@ ZEND_VM_HANDLER(119, ZEND_SEND_ARRAY, ANY, ANY)
 		zval *arg, *param;
 
 ZEND_VM_C_LABEL(send_array):
+		if ((OP1_TYPE & (IS_VAR|IS_CV)) && Z_REFCOUNT_P(args) > 1) {
+			ht = Z_ARRVAL_P(args);
+			arg_num = 1;
+			ZEND_HASH_FOREACH_VAL(ht, arg) {
+				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+					if (UNEXPECTED(!Z_ISREF_P(arg))) {
+						SEPARATE_ARRAY(args);
+						break;
+					}
+				}
+				arg_num++;
+			} ZEND_HASH_FOREACH_END();
+		}
+
 		ht = Z_ARRVAL_P(args);
 		zend_vm_stack_extend_call_frame(&EX(call), 0, zend_hash_num_elements(ht));
 
@@ -4625,7 +4643,9 @@ ZEND_VM_C_LABEL(send_array):
 		ZEND_HASH_FOREACH_VAL(ht, arg) {
 			if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
 				if (UNEXPECTED(!Z_ISREF_P(arg))) {
-					if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+					if (OP1_TYPE & (IS_VAR|IS_CV)) {
+						ZVAL_NEW_REF(arg, arg);
+					} else if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
 
 						zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
 							arg_num,
@@ -4658,7 +4678,11 @@ ZEND_VM_C_LABEL(send_array):
 			param++;
 		} ZEND_HASH_FOREACH_END();
 	}
-	FREE_OP1();
+	if (OP1_TYPE & (IS_VAR|IS_CV)) {
+		FREE_OP1_VAR_PTR();
+	} else {
+		FREE_OP1();
+	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }