Bug #72598 [NEW]: Reference is lost after array_slice()

From: dominikschilling+php at gmail dot com Operating system: PHP version: 7.1Git-2016-07-14 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Reference is lost after array_slice() Description: ------------ I noticed a weird issue when running the unit tests of WordPress with PHP 7.1.0. Our ticket: https://core.trac.wordpress.org/ticket/37295 The failing test: https://travis-ci.org/aaronjorbin/develop.wordpress/jobs/142322444#L387-L396 It looks like array_slice() is removing the reference of a variable under certain conditions. The test script is a short form of what WordPress is doing here. Test script: --------------- <?php global $wp_filter; $wp_filter[ 'pre_get_posts' ][ 9 ][ 1 ] = [ 'function' => 'function_which_expects_a_reference', 'accepted_args' => 1 ]; $wp_filter[ 'pre_get_posts' ][ 9 ][ 2 ] = [ 'function' => 'function_which_expects_a_reference', 'accepted_args' => 1 ]; class FooBar { function __construct() { do_action_ref_array( 'pre_get_posts', [ &$this ] ); } } function do_action_ref_array( $tag, $args ) { global $wp_filter; reset( $wp_filter[ $tag ] ); do { foreach ( current( $wp_filter[ $tag ] ) as $the_ ) { $a = array_slice( $args, 0, (int) $the_['accepted_args'] ); xdebug_debug_zval( 'a' ); call_user_func_array( $the_['function'], $a ); } } while ( next( $wp_filter[ $tag ] ) !== false ); } function function_which_expects_a_reference( &$variable ) {} new FooBar(); Expected result: ---------------- a: (refcount=1, is_ref=0)=array (0 => (refcount=3, is_ref=1)=class FooBar { }) a: (refcount=1, is_ref=0)=array (0 => (refcount=3, is_ref=1)=class FooBar { }) Actual result: -------------- a: (refcount=1, is_ref=0)=array (0 => (refcount=1, is_ref=1)=class FooBar { }) a: (refcount=1, is_ref=0)=array (0 => (refcount=4, is_ref=0)=class FooBar { }) PHP Warning: Parameter 1 to function_which_expects_a_reference() expected to be a reference, value given in /php71.php on line 21 PHP Stack trace: PHP 1. {main}() /php71.php:0 PHP 2. FooBar->__construct() /php71.php:28 PHP 3. do_action_ref_array() /php71.php:8 Warning: Parameter 1 to function_which_expects_a_reference() expected to be a reference, value given in /php71.php on line 21 Call Stack: 0.0006 361384 1. {main}() /php71.php:0 0.0030 362576 2. FooBar->__construct() /php71.php:28 0.0030 362976 3. do_action_ref_array() /php71.php:8 -- Edit bug report at https://bugs.php.net/bug.php?id=72598&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72598&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72598&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72598&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72598&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72598&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72598&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72598&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72598&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72598&r=support Expected behavior: https://bugs.php.net/fix.php?id=72598&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72598&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72598&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72598&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72598&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72598&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72598&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72598&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72598&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72598&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72598&r=mysqlcfg