Closure named argument unpacking between temporary closures can cause a crash #19653
Description
Description
The following code:
<?php
function func1(string $a1 = 'a1', string $a2 = 'a2', string $a3 = 'a3') {
echo __FUNCTION__ . "() a1=$a1 a2=$a2 a3=$a3\n";
}
function usage1(?Closure $func1 = null) {
echo __FUNCTION__ . "() ";
($func1 ?? func1(...))(a3: 'm3+');
}
usage1();
$func1 = function (string ...$args) {
echo "[function] ";
func1(...$args, a2: 'm2+');
};
usage1(func1: $func1);Resulted in this output:
usage1() func1() a1=a1 a2=a2 a3=m3+
usage1() zend_mm_heap corrupted
Aborted
But I expected this output instead:
usage1() func1() a1=a1 a2=a2 a3=m3+
usage1() [function] func1() a1=a1 a2=m2+ a3=m3+
moreover, if I comment out the first call to usage1 with empty argument list, the second call succeeds
PHP Version
PHP 8.4.11 (cli) (built: Aug 3 2025 08:49:56) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.11, Copyright (c) Zend Technologies
with Zend OPcache v8.4.11, Copyright (c), by Zend Technologies
Operating System
No response