diff --git a/src/CompilerBase.php b/src/CompilerBase.php index b2d736be..e5355646 100644 --- a/src/CompilerBase.php +++ b/src/CompilerBase.php @@ -1072,6 +1072,21 @@ class CompilerBase implements PropertyAccessContext return $this->wrapVoidExprAsNull($expr, $this->parseExpr($expr)); } + /** + * Snapshot a reference-returning call before a by-value container can retain + * its php::Ref. Assigning to an existing Var detaches the reference, unlike + * constructing a Variant directly from Ref. Keep the assignment inline so + * earlier arguments or array elements retain PHP's evaluation order. + */ + protected function materializeRefReturnAsValue(NodeAbstract $value, string $expr): string + { + if ($value instanceof Expr\CallLike && $this->resolveRefReturningCall($value) !== false) { + $tmpVar = $this->addTmpVar(Type::VAR); + return '(' . $tmpVar . ' = ' . $expr . ')'; + } + return $expr; + } + protected function getObjectPropVarName(string $object, string $prop): string { return self::OBJECT_PROP . $object . self::NAMESPACE_SEPARATOR . $prop; diff --git a/src/Generator/CallArgumentGenerator.php b/src/Generator/CallArgumentGenerator.php index 0347667e..79431f24 100644 --- a/src/Generator/CallArgumentGenerator.php +++ b/src/Generator/CallArgumentGenerator.php @@ -586,6 +586,13 @@ trait CallArgumentGenerator protected function materializeCallArgValue(NodeAbstract $value, string $expr): string { + // A call that returns by reference yields a live php::Ref aliasing the + // callee's storage. When such a call feeds a by-value argument, PHP takes + // a value snapshot at evaluation time (left to right), so later mutations + // to the aliased storage must not be observable. The dynamic ArgList keeps + // references verbatim (Ctor::CopyRef), so we dereference into a temporary + // value at the point of the call. + $expr = $this->materializeRefReturnAsValue($value, $expr); if (!$this->shouldMaterializeCallArg($value)) { return $expr; } diff --git a/src/Parser/ArrayExpressionTrait.php b/src/Parser/ArrayExpressionTrait.php index a920f62b..819cf8cf 100644 --- a/src/Parser/ArrayExpressionTrait.php +++ b/src/Parser/ArrayExpressionTrait.php @@ -60,7 +60,7 @@ trait ArrayExpressionTrait $this->indentLevel++; foreach ($items as $item) { $this->assertExprCanBeUsedAsValue($item->value, 'array value'); - $value = $this->parseIdentifier($item->value); + $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value)); if ($item->key) { $this->assertExprCanBeUsedAsValue($item->key, 'array key'); $key = $this->parseArrayKey($item->key); @@ -221,7 +221,7 @@ trait ArrayExpressionTrait } $value = $this->convertToRef($item->value); } else { - $value = $this->parseIdentifier($item->value); + $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value)); } if ($item->unpack) { $this->context->beforeStmtLines[] = $this->getIndent() . $tmpVar . '.merge(' . $value . ');'; diff --git a/tests/compiler/ref/dynamic-return-reference-argument.phpt b/tests/compiler/ref/dynamic-return-reference-argument.phpt new file mode 100644 index 00000000..aede4d2a --- /dev/null +++ b/tests/compiler/ref/dynamic-return-reference-argument.phpt @@ -0,0 +1,80 @@ +--TEST-- +Reference-returning calls are copied by value when used as call arguments or array elements +--FILE-- + test1(), test2()]); + var_dump(value_order('arg-left'), ref_order('arg-ref')); + var_dump([value_order('array-left'), ref_order('array-ref')]); +} + +function &test1() +{ + $callback = 'test2'; + return $callback(); +} + +function &test2() +{ + static $value = 0; + ++$value; + return $value; +} + +function value_order(string $label): string +{ + echo "$label\n"; + return $label; +} + +function &ref_order(string $label) +{ + static $value = 42; + echo "$label\n"; + return $value; +} +?> +--EXPECT-- +int(1) +int(2) +int(2) +int(2) +int(0) +int(0) +int(1) +int(2) +array(2) { + [0]=> + int(3) + [1]=> + int(4) +} +array(2) { + ["first"]=> + int(5) + [0]=> + int(6) +} +arg-left +arg-ref +string(8) "arg-left" +int(42) +array-left +array-ref +array(2) { + [0]=> + string(10) "array-left" + [1]=> + int(42) +}