Stop turbo-ext from touching refcounts of immutable arrays and interned strings

[ondrejmirtes]

Supersedes #6558. It keeps @zonuexe's commit and adds fixes for the other places in turbo-ext with the same class of bug.

In PHP, a shared read-only array or string must never have its refcount incremented. For arrays that means the shared empty array of a [] literal (it lives in .rodata), for strings any interned string, which with opcache lives in shared memory. ZVAL_ARR and Z_ADDREF_P still increment it, which writes into memory that may be read-only.

Commits

1. Pass immutable array arguments non-refcounted through zv::Args
   • This is the commit from Pass immutable array arguments non-refcounted through zv::Args #6558 by @zonuexe. zv::Args wrapped a HashTable * with a bare ZVAL_ARR, and the addref in zend_call_function() then wrote into zend_empty_array.
   • The crash is reachable when ForeachHandler hands empty conditional holder tables to a PHP override of MutatingScope::addConditionalExpressions().
   • I amended the test to call setAccessible(true) before ReflectionProperty::getValue() (required on PHP < 8.1, where the old-PHPUnit jobs failed with Cannot access non-public member). I added the matching ignore to build/php-85.neon, like the one for ObjectTypeTest.
   • Verified by rebuilding the extension with only the zv.h change reverted: the array{} data set exits with 138 (SIGBUS) on macOS arm64. With the change it passes, and without the extension it passes either way.
2. Do not addref interned parameter names in native PhpDocsResolver
   • positionalNames() did Z_ADDREF_P on each parameter's Variable name. The native parser allocates those strings, but names built by PHP code (e.g. a new Variable('foo') literal) are interned.
   • It is now Z_TRY_ADDREF_P.
   • The new PhpDocsResolverTest builds the method node in PHP. Before the fix it exits with 138 under -d opcache.enable_cli=1 -d opcache.protect_memory=1 with the extension loaded; after the fix it passes. CI doesn't run with protect_memory, so there the test only checks the resolved parameter types. It won't catch a regression of the refcount write itself.
3. Share the per-slot key table through copyOfTable in VariableLivenessResolver
   • This replaces a bare ZVAL_ARR + Z_ADDREF on a borrowed table with zv::Arr::copyOfTable().
   • It can't crash today, because keysBySlot entries are always separated tables. Hardening only.
4. Separate optional keys after taking the snapshot in makeOffsetRequired()
   • The "snapshot" shared the table that the loop deletes from, so the deletes went into a table with refcount 2 while it was being iterated.
   • The results were right, but it trips HT_ASSERT_RC1 on debug PHP builds. Taking the snapshot before separate() fixes it, still with one duplication.
5. make bump-turbo

Audit

I checked every other ZVAL_ARR/RETURN_ARR, every refcount change on arrays, the raw array writes and every zv::Args use in turbo-ext/src. The other sites wrap freshly allocated tables, already mark shared constants as non-refcounted, or only read the table.

Closes #6558

🤖 Generated with Claude Code

https://claude.ai/code/session_01EKX5yrrUnnbeRtc2oURC2u