Stdlib: array_push()/array_unshift()/array_multisort() — argument unpacking (...$values) VM Refcount fatal (ext/standard/array.c, php-src-strict) #6689

Category

stdlib | language (call lowering)

Problem

Zend accepts argument unpacking (...$values) on builtins whose first parameter is a by-reference array (array_push, array_unshift, array_multisort). Our VM aborts with an internal Refcount is > 1, but was asserted to be 1 instead of mutating the array or completing the sort.

This is a variadic unpack + by-ref slot bug in shared call lowering, not a missing builtin implementation.

php-src reference

• php/php-src ext/standard/array.c — php_array_push, php_array_unshift, php_array_multisort
• php/php-src Zend/zend_execute.c — ZEND_SEND_UNPACK expansion before internal handler

Repro

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php test/repro/array_push_unshift_unpack_refcnt.php          # Zend: unshift=[3,4,1,2] push=[1,2,3,4]
php bin/vm.php test/repro/array_push_unshift_unpack_refcnt.php # VM: Refcount is > 1, but was asserted to be 1
php test/repro/array_multisort_unpack_refcnt.php               # Zend: ok
php bin/vm.php test/repro/array_multisort_unpack_refcnt.php    # VM: same Refcount fatal
'

Minimal inline:

<?php
$a = [1, 2];
array_unshift($a, ...[3, 4]); // VM fatal

$b = [1, 2];
array_push($b, ...[3, 4]);    // VM fatal

array_multisort(...[[3, 1, 2], ['c', 'a', 'b']]); // VM fatal

Scope (PHP-in-PHP first)

Expected (php-src-strict)

Match Zend: arrays mutate / sort completes; no VM abort. JIT/AOT mirror VM once call lowering is fixed.

Verification

• Add test/compliance/cases/stdlib/array_push_unpack.phpt (and unshift/multisort siblings)
• Filter: vendor/bin/phpunit test/compliance/VMTest.php --filter array_push_unpack

Done when

• array_unshift($a, ...$vals), array_push($b, ...$vals), and array_multisort(...$cols) complete without VM refcount fatal
• Output matches Zend on repro scripts in test/repro/array_push_unshift_unpack_refcnt.php and array_multisort_unpack_refcnt.php
• test/compliance/cases/stdlib/array_push_unpack.phpt (+ unshift/multisort siblings) green under php bin/vm.php
• vendor/bin/phpunit test/compliance/VMTest.php --filter array_push_unpack passes inside script/docker-exec.sh
• Pairs Stdlib: array_unshift()/array_merge()/array_multisort() — empty argument unpacking (...[]) arity parity (ext/standard/array.c, php-src-strict) #6690 (empty ...[] arity) — both green before closing unpack family