Fix use-after-free of an array callable freed during validation

[iliaal]

INIT_USER_CALL reads the callable array from op2 without holding a reference, so an error handler reached by the compound-callable deprecation can free the receiver before the call frame is built.

class Victim { public $tag = "alive"; public function target() { echo $this->tag; } }
class Holder extends Victim {}
set_error_handler(function ($n, $s) { if (str_contains($s, 'Callables of the form')) { $GLOBALS['cb'] = null; gc_collect_cycles(); } return true; });
$cb = [new Holder(), 'Victim::target'];
call_user_func($cb); // SIGSEGV

array_map() and friends are unaffected: the callable arrives as an argument, so the frame holds a reference for the call. Master only, matching php#22881.

[iliaal]

Promoted upstream: php#23014