Fix use-after-free of an array callable freed during validation

[iliaal]

Resolving a compound [$obj, "Class::method"] callable runs user code before the method is found: the class part may autoload, and the compound form emits an E_DEPRECATED that reaches a user error handler. Either can drop the last reference to the receiver, which zend_is_method_callable() only borrows through fcc->object, so the caller then addrefs and calls into freed memory.

class Victim { public $tag = "alive"; public function target() { echo $this->tag; } }
class Holder extends Victim {}
set_error_handler(function ($n, $s) { if (str_contains($s, 'Callables of the form')) { $GLOBALS['cb'] = null; gc_collect_cycles(); } return true; });
$cb = [new Holder(), 'Victim::target'];
call_user_func($cb); // SIGSEGV

Holding the callable array is not enough: [&$obj, 'Victim::target'] keeps only the reference wrapper alive, and array_map() is affected the same way. The receiver is now held across the compound lookup, and validation fails with "object was destroyed while resolving the callable" when nothing else owns it afterwards, since fcc->object cannot carry ownership back to the caller.

[arnaud-lb]

It seems that fixing #20018 would fix this as well?

[iliaal]

Yours does, verified at de280ff (handler runs, callable freed, no crash). #22515 doesn't: it excludes ZEND_INIT_USER_CALL in zend_can_defer_error(), so the deprecation still fires inside zend_is_callable_ex(). Dropping that exclusion from my branch fixes the repro but breaks gh16799 and the gh_21699 trio, so it isn't a one-liner. 8.5 and 8.4 crash on the same repro too.

[Girgias]

After the refactorings, is it not possible to move this to zend_is_method_callable and do the same sort of zval prevention that we do in increment_string just within the E_DEPRECATED path so that 99.999999% of code doesn't hit this useless performance hit.

[iliaal]

Done in 9d5ab06. The hold can't end the way increment_string's does, because fcc->object is borrowed and the caller only addrefs it after we return. So when the handler leaves the receiver with no other owner, validation fails with "object was destroyed while resolving the callable" instead of calling into it. Moving it there also covers [&$obj, 'C::m'] and array_map(), which the VM-side array hold missed since the array only owned the reference wrapper. Non-compound callables never enter the branch.