Use consumed_args for array_reduce and some other callback-using functions

Author: drealecs

ext/pcre/php_pcre.c

@@ -1570,6 +1570,7 @@ static zend_string *preg_do_repl_func(zend_fcall_info *fci, zend_fcall_info_cach
 	fci->retval = &retval;
 	fci->param_count = 1;
 	fci->params = &arg;
+	fci->consumed_args = ZEND_FCI_CONSUMED_ARG(0);
 	zend_call_function(fci, fcc);
 	zval_ptr_dtor(&arg);
 	if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {

ext/standard/array.c

@@ -6409,6 +6409,7 @@ PHP_FUNCTION(array_reduce)
 	fci.retval = return_value;
 	fci.param_count = 2;
 	fci.params = args;
+	fci.consumed_args = ZEND_FCI_CONSUMED_ARG(0);
 
 	ZEND_HASH_FOREACH_VAL(htbl, operand) {
 		ZVAL_COPY_VALUE(&args[0], return_value);

ext/standard/tests/array/array_reduce_accumulator_refcount.phpt

@@ -0,0 +1,35 @@
+--TEST--
+array_reduce(): accumulator refcount stays low during callback
+--FILE--
+<?php
+
+$result = array_reduce([1, 2, 3], function ($acc, $val) {
+    debug_zval_dump($acc);
+    $acc[] = $val;
+    return $acc;
+}, []);
+
+debug_zval_dump($result);
+
+?>
+--EXPECT--
+array(0) interned {
+}
+array(1) packed refcount(2){
+  [0]=>
+  int(1)
+}
+array(2) packed refcount(2){
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+}
+array(3) packed refcount(2){
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}

main/output.c

@@ -972,6 +972,7 @@ static inline php_output_handler_status_t php_output_handler_op(php_output_handl
 			handler->func.user->fci.param_count = 2;
 			handler->func.user->fci.params = ob_args;
 			handler->func.user->fci.retval = &retval;
+			handler->func.user->fci.consumed_args = ZEND_FCI_CONSUMED_ARG(0);
 
 			if (SUCCESS == zend_call_function(&handler->func.user->fci, &handler->func.user->fcc) && Z_TYPE(retval) != IS_UNDEF) {
 				if (handler->flags & PHP_OUTPUT_HANDLER_PRODUCED_OUTPUT) {