Bug #75961 [Csd->ReO]: Strange references behavior

Edit report at https://bugs.php.net/bug.php?id=75961&edit=1 ID: 75961 Updated by: nikic@php.net Reported by: imbolk at gmail dot com Summary: Strange references behavior -Status: Closed +Status: Re-Opened Type: Bug Package: Scripting Engine problem Operating System: all PHP Version: 7.1.14 Block user comment: N Private report: N New Comment: I've reverted this change in https://github.com/php/php-src/commit/fd5bd37ab129595d51cc05199437c8af3388b3b9, because it is causing use-after-free under certain circumstances. IMHO the actual bug here is in array_map, not in array_walk. array_map should not be leaking references into the callback. Previous Comments: ------------------------------------------------------------------------ [2018-03-05 14:34:24] nikic@php.net Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=fd5bd37ab129595d51cc05199437c8af3388b3b9 Log: Revert "Fixed bug #75961 (Strange references behavior)" ------------------------------------------------------------------------ [2018-02-17 08:39:43] laruence@php.net Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=94e9d0a2ae76bad712495d820d3962e401085fef Log: Fixed bug #75961 (Strange references behavior) ------------------------------------------------------------------------ [2018-02-17 08:38:45] laruence@php.net Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=94e9d0a2ae76bad712495d820d3962e401085fef Log: Fixed bug #75961 (Strange references behavior) ------------------------------------------------------------------------ [2018-02-14 16:57:36] imbolk at gmail dot com Description: ------------ Results in PHP 7.1+ and pre-PHP-7.1 are differs. I'm not sure what I have to expect to see but pre-PHP-7.1 result is more intuitive. Test script: --------------- $arr = [[1]]; array_walk($arr, function(){}); array_map('array_shift', $arr); var_dump($arr); Expected result: ---------------- array(1) { [0]=> array(1) { [0]=> int(1) } } Actual result: -------------- array(1) { [0]=> array(0) { } } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75961&edit=1