Why does PHP allow passing a literal to a pass-by-reference parameter in one case but not others?

Question

The function array_shift() takes one parameter by reference. Passing an array literal causes a fatal error:

$ php -r 'var_export(array_shift(array("Test #0"));';echo

Fatal error: Only variables can be passed by reference in Command line code on line 1

This fails as expected. However, PHP behaves strangely when the function is called with call_user_func_array:

<?php
var_export(call_user_func_array("array_shift", array(array("Test #1"))));
echo "\n";

$arg1 = array("Test #2");
var_export(call_user_func_array("array_shift", array($arg1)));
echo "\n";

$args = array(array("Test #3"));
var_export(call_user_func_array("array_shift", $args));
echo "\n";

When executed:

$ php test.php

'Test #1'

Warning: Parameter 1 to array_shift() expected to be a reference, value given in /Users/kcc/test.php on line 6 NULL

Warning: Parameter 1 to array_shift() expected to be a reference, value given in /Users/kcc/test.php on line 10 NULL

It's understandable that call_user_func_array() wouldn't trigger a fatal error, but why does the first form work fine?

Answer 1

From the call_user_func_array() documentation:

Before PHP 5.4, referenced variables in param_arr are passed to the function by reference, regardless of whether the function expects the respective parameter to be passed by reference. This form of call-time pass by reference does not emit a deprecation notice, but it is nonetheless deprecated, and has been removed in PHP 5.4. Furthermore, this does not apply to internal functions, for which the function signature is honored. Passing by value when the function expects a parameter by reference results in a warning and having call_user_func() return FALSE (there is, however, an exception for passed values with reference count = 1, such as in literals, as these can be turned into references without ill effects — but also without writes to that value having any effect —; do not rely in this behavior, though, as the reference count is an implementation detail and the soundness of this behavior is questionable).

(emphasis mine)

Since PHP 5.4, call_user_func_array() passes all of its arguments by value to the specified $callback, except in the case of the exception bolded in the manual quote above.

In Test #1, you have a pure literal, so you hit the special exception described in the documentation: the literal can be turned into a reference with no unwanted side-effects (because it will just be thrown away when call_user_func_array() is done).

In Test #2 and Test #3, you don't have a pure literal, and because internally, array_shift is defined as taking its parameter by reference, call_user_func_array() raises the warning described above.

In PHP 7, Test #1 is "fixed", and now correctly emits the warning.