Description:
------------
If xhprof is enabled, and the php 5.6 executes php function array_shift, then the guts of _phpi_pop indirects through 0 for the return_value_ptr, resulting in a segfault.

The xhprof call through ->handler passes a 3rd argument which is the result of evaluating the C code:
  (EX(function_state).function->common.fn_flags &  ZEND_ACC_RETURN_REFERENCE) ?  &retvar->var.ptr:NULL
and for the case of the array_shift function, this passes NULL as the value of return_value_ptr in the environment of array_shift.

For PHP 5.6, and apparently PHP 5.6 only, the implementation of array_shift calls _phpi_pop which invokes macro RETVAL_ZVAL_FAST which has a code path that stores through return_value_ptr, without doing any checking for null pointers.

There are a handful of uses of RETVAL_ZVAL_FAST in PHP 5.6, all(?) related to array manipulation or iteration.