src/CompilerBase.php

@@ -1072,6 +1072,21 @@ class CompilerBase implements PropertyAccessContext
         return $this->wrapVoidExprAsNull($expr, $this->parseExpr($expr));
     }
 
+    /**
+     * Snapshot a reference-returning call before a by-value container can retain
+     * its php::Ref. Assigning to an existing Var detaches the reference, unlike
+     * constructing a Variant directly from Ref. Keep the assignment inline so
+     * earlier arguments or array elements retain PHP's evaluation order.
+     */
+    protected function materializeRefReturnAsValue(NodeAbstract $value, string $expr): string
+    {
+        if ($value instanceof Expr\CallLike && $this->resolveRefReturningCall($value) !== false) {
+            $tmpVar = $this->addTmpVar(Type::VAR);
+            return '(' . $tmpVar . ' = ' . $expr . ')';
+        }
+        return $expr;
+    }
+
     protected function getObjectPropVarName(string $object, string $prop): string
     {
         return self::OBJECT_PROP . $object . self::NAMESPACE_SEPARATOR . $prop;

src/Generator/CallArgumentGenerator.php

@@ -586,6 +586,13 @@ trait CallArgumentGenerator
 
     protected function materializeCallArgValue(NodeAbstract $value, string $expr): string
     {
+        // A call that returns by reference yields a live php::Ref aliasing the
+        // callee's storage. When such a call feeds a by-value argument, PHP takes
+        // a value snapshot at evaluation time (left to right), so later mutations
+        // to the aliased storage must not be observable. The dynamic ArgList keeps
+        // references verbatim (Ctor::CopyRef), so we dereference into a temporary
+        // value at the point of the call.
+        $expr = $this->materializeRefReturnAsValue($value, $expr);
         if (!$this->shouldMaterializeCallArg($value)) {
             return $expr;
         }

src/Parser/ArrayExpressionTrait.php

@@ -60,7 +60,7 @@ trait ArrayExpressionTrait
         $this->indentLevel++;
         foreach ($items as $item) {
             $this->assertExprCanBeUsedAsValue($item->value, 'array value');
-            $value = $this->parseIdentifier($item->value);
+            $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value));
             if ($item->key) {
                 $this->assertExprCanBeUsedAsValue($item->key, 'array key');
                 $key = $this->parseArrayKey($item->key);
@@ -221,7 +221,7 @@ trait ArrayExpressionTrait
                 }
                 $value = $this->convertToRef($item->value);
             } else {
-                $value = $this->parseIdentifier($item->value);
+                $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value));
             }
             if ($item->unpack) {
                 $this->context->beforeStmtLines[] = $this->getIndent() . $tmpVar . '.merge(' . $value . ');';

tests/compiler/ref/dynamic-return-reference-argument.phpt

@@ -0,0 +1,80 @@
+--TEST--
+Reference-returning calls are copied by value when used as call arguments or array elements
+--FILE--
+<?php
+
+function main()
+{
+    $v1 = &test1();
+    var_dump($v1);
+    $v2 = &test1();
+    var_dump($v2);
+    var_dump($v1, $v2);
+    $v1 = 0;
+    var_dump($v1, $v2);
+    var_dump(test1(), test2());
+    var_dump([test1(), test2()]);
+    var_dump(['first' => test1(), test2()]);
+    var_dump(value_order('arg-left'), ref_order('arg-ref'));
+    var_dump([value_order('array-left'), ref_order('array-ref')]);
+}
+
+function &test1()
+{
+    $callback = 'test2';
+    return $callback();
+}
+
+function &test2()
+{
+    static $value = 0;
+    ++$value;
+    return $value;
+}
+
+function value_order(string $label): string
+{
+    echo "$label\n";
+    return $label;
+}
+
+function &ref_order(string $label)
+{
+    static $value = 42;
+    echo "$label\n";
+    return $value;
+}
+?>
+--EXPECT--
+int(1)
+int(2)
+int(2)
+int(2)
+int(0)
+int(0)
+int(1)
+int(2)
+array(2) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(4)
+}
+array(2) {
+  ["first"]=>
+  int(5)
+  [0]=>
+  int(6)
+}
+arg-left
+arg-ref
+string(8) "arg-left"
+int(42)
+array-left
+array-ref
+array(2) {
+  [0]=>
+  string(10) "array-left"
+  [1]=>
+  int(42)
+}