Description:
------------
I have no idea if my explanation of this bug is correct, but here's a guess anyway.

PHP does not seem to garbage collect return values from functions, when they are operated-assigned (eg. $v = func() + 5; or $v = func()." ";) to a variable in the caller. but this is fine for direct assignments (eg. $v = func();)

It would seem from this that PHP is storing functions' return values internally as if they were pointed to by a variable (that doesn't exist in the script), and using copy-on-write to avoid copying this data when it's assigned to an actual script variable. However copy-on-write, doesn't trigger when there is an operation on this data before this assignment.


Reproduce code:
---------------
<?php

define('LF', chr(10));

// define('REALLY_LONG_STRING', str_repeat("really ", 65536)."long string");

function generic($for, $title) {
	mem('g+');
	$data = '<abbr title="information for '.$for.'">'.$title.'</abbr>';
	// $data = '<abbr title="information for '.$for.'">'.$title.'</abbr>'.REALLY_LONG_STRING;
	mem('g-');
	return $data;
}

function lol1() {
	mem('l1+');
	$data = " ".generic("name", "test")." ";
	mem('l1-');
	return $data;
}

function lol2() {
	mem('l2+');
	$data = generic("name", "test");
	mem('l2-');
	return $data;
}

echo memory_get_usage().LF;
for ($i=0; $i<8; $i++) {
	$a[] = lol2();
	echo memory_get_usage().LF;
	$a[] = lol1();
	echo memory_get_usage().LF;
}

?>


Expected result:
----------------
see below

Actual result:
--------------
635168
635240 l2+
635496 g+
635672 g-
635672 l2- (no memory leak here)
635928
636024 l1+
636072 g+
636184 g-
636248 l1- (this value should only be 2 bytes larger than the previous)
636336