Regression: preg_replace_callback() $count by-ref stays 0 — replacements ok (re-#4442, ext/pcre/php_pcre.c)

[PurHur]

Category

stdlib · php-src-strict

Problem

preg_replace_callback() replacement string matches Zend, but the optional 5th $count by-ref argument is left at 0 on VM. Closures/limit work; only the out-param is wrong. Likely Internal by-ref binding or VmPregReplaceCallback::invoke write-back (re-#4442 claimed full signature parity).

Repro	Zend 8.2 (2026-07-16)	VM (2026-07-16)
$c=0; echo preg_replace_callback('/a/', fn($m)=>'A', 'aa', -1, $c).\"|$c\"	AA|2	AA|0
same with $limit=2 on 'aaa'	AAa|2	AAa|0

php-src reference

• php/php-src ext/pcre/php_pcre.c — PHP_FUNCTION(preg_replace_callback) / php_pcre_preg_replace_impl $count out-parameter

PHP implementation target

• ext/standard/preg_replace_callback.php — ensure $frame->calledArgs[4] is the user by-ref slot before ->int($count)
• ext/standard/VmPregReplaceCallback.php — confirm $replacements write-back; today caller seeds $count=0 then assigns after invoke
• Prefer PHP-in-PHP fix; no new runtime/*.c logic

Repro

./script/docker-exec.sh -- bash -lc 'php -r '\''$c=0; $r=preg_replace_callback("/a/", fn($m)=>"A", "aa", -1, $c); echo "$r|$c\n";'\'''
./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r '\''$c=0; $r=preg_replace_callback("/a/", fn($m)=>"A", "aa", -1, $c); echo "$r|$c\n";'\'''

Done when

• Repro prints AA|2 on VM (and JIT/AOT when args ≥5 are lowered)
• $count remains 0 when zero replacements
• Compliance .phpt under test/compliance/cases/ (or extend existing preg callback cases)
• php-src-strict; no php-compiler-strict shortcut

Related

#4442 (closed — full signature) · #10278 (preg_replace count) · #12904 (preg_filter count)

[PurHur]

claim: worker-lane-C — starting this run

Trust snapshot (pre-claim):

• bootstrap-inventory --check: OK 5179/5179
• release-readiness --json: still running
• Lane C (19637 % 3 == 2); Regression; no open PR; no prior claim

[PurHur]

claim: PHP Compiler STD Lib Advanced — batch after #19628 (preg_replace_callback $count by-ref; with #19639 preg_filter)

[PurHur]

Merged in #19645

Root cause: BuiltinByRefParams registered preg_replace &$count (index 4) but not preg_replace_callback / preg_filter / preg_replace_callback_array, so the 5th arg was sent by value and writeback never reached the caller.

Fix: add those by-ref indices in lib/BuiltinByRefParams.php.

Verification:

Zend/VM/JIT: AA|2
./script/phpunit.sh --filter 'preg_replace_callback_limit_count|testPregReplaceFamilyCountByRef' → OK (3 tests)
bootstrap-inventory --check → OK 5179/5179