Fix GH-21639: Keep frameless call args stable during reentry

Author: prateekbhujel

Zend/tests/gh21639.phpt

@@ -0,0 +1,122 @@
+--TEST--
+GH-21639: Frameless calls keep volatile CV arguments alive during __toString()
+--FILE--
+<?php
+class ImplodeElement {
+    public function __toString(): string {
+        global $separator, $pieces;
+
+        $separator = null;
+        $pieces = null;
+
+        return "C";
+    }
+}
+
+$separator = str_repeat(",", 1) . " ";
+$pieces = [new ImplodeElement(), 42];
+
+var_dump(implode($separator, $pieces));
+var_dump($separator, $pieces);
+
+class ImplodeElementWithoutSeparator {
+    public function __toString(): string {
+        global $oneArgPieces;
+
+        $oneArgPieces = null;
+
+        return "D";
+    }
+}
+
+$oneArgPieces = [new ImplodeElementWithoutSeparator(), 42];
+
+var_dump(implode($oneArgPieces));
+var_dump($oneArgPieces);
+
+class InArrayNeedle {
+    public function __toString(): string {
+        global $inArrayHaystack;
+
+        $inArrayHaystack = null;
+
+        return "needle";
+    }
+}
+
+$inArrayHaystack = [new InArrayNeedle()];
+
+var_dump(in_array("needle", $inArrayHaystack));
+var_dump($inArrayHaystack);
+
+class StrtrReplacement {
+    public function __toString(): string {
+        global $strtrReplacements;
+
+        $strtrReplacements = null;
+
+        return "b";
+    }
+}
+
+$strtrReplacements = ["a" => new StrtrReplacement()];
+
+var_dump(strtr("a", $strtrReplacements));
+var_dump($strtrReplacements);
+
+class StrReplaceSubject {
+    public function __toString(): string {
+        global $strReplaceSubject;
+
+        $strReplaceSubject = null;
+
+        return "a";
+    }
+}
+
+$strReplaceSubject = [new StrReplaceSubject(), "aa"];
+
+var_dump(str_replace("a", "b", $strReplaceSubject));
+var_dump($strReplaceSubject);
+
+class StrContainsHaystack {
+    public function __toString(): string {
+        global $strContainsNeedle;
+
+        $strContainsNeedle = null;
+
+        return "abc";
+    }
+}
+
+class StrContainsNeedle {
+    public function __toString(): string {
+        return "b";
+    }
+}
+
+$strContainsHaystack = new StrContainsHaystack();
+$strContainsNeedle = new StrContainsNeedle();
+
+var_dump(str_contains($strContainsHaystack, $strContainsNeedle));
+var_dump($strContainsNeedle);
+?>
+--EXPECT--
+string(5) "C, 42"
+NULL
+NULL
+string(3) "D42"
+NULL
+bool(true)
+NULL
+string(1) "b"
+NULL
+array(2) {
+  [0]=>
+  string(1) "b"
+  [1]=>
+  string(2) "bb"
+}
+NULL
+bool(true)
+NULL

Zend/zend.c

@@ -812,6 +812,7 @@ static void executor_globals_ctor(zend_executor_globals *executor_globals) /* {{
 	ZVAL_UNDEF(&executor_globals->user_error_handler);
 	ZVAL_UNDEF(&executor_globals->user_exception_handler);
 	executor_globals->current_execute_data = NULL;
+	executor_globals->frameless_reentry_copies = NULL;
 	executor_globals->current_module = NULL;
 	executor_globals->exit_status = 0;
 #if XPFPA_HAVE_CW