Non-pure default arguments are mistakenly cached #9965

Description

PHP compiles function default arguments to constant ASTs. The AST is evaluated when the function is called. When the result of the evaluation is a non-refcounted value, PHP assumes that the AST is pure (will always evaluate to the same value) and will then cache the value and skip re-evaluation in the next function call. This assumption is incorrect.

<?php

class Foo {
    public function __toString() {
        static $i = 0;
        return (string) $i++;
    }
}

function test(string $foo = new Foo() . '') {
    var_dump($foo);
}

test();
test();
test();

Resulted in this output:

string(1) "0"
string(1) "0"
string(1) "0"

But I expected this output instead:

string(1) "0"
string(1) "1"
string(1) "2"

Instead what should be done is evaluation of the AST should report whether the AST was pure or not. This currently mainly depends on whether new was used.

PHP Version

PHP 8.1

Operating System

No response