Memory Leak in CallPhpFunctions

[sjinks]

Test case:

--TEST--
Call PHP Function
--SKIPIF--
<?php include 'skipif.inc'; ?>
--FILE--
<?php
class MyClass
{
    function method($a, $b, $c)
    {
        return $a + $b + $c;
    }
}

function myFunction($a, $b, $c)
{
    return $a + $b + $c;
}

echo call_php_function(function($a, $b, $c) { return $a + $b + $c; }), PHP_EOL;
echo call_php_function("myFunction"), PHP_EOL;
echo call_php_function(array(new MyClass(), 'method')), PHP_EOL;
?>
--EXPECT--
6
6
6

Memory leaks:

[Sun Dec 18 23:14:44 2016]  Script:  '/PHP-CPP/test/tests/0002.php'
/tmp/php-build/source/7.0.9/Zend/zend_hash.c(1789) :  Freeing 0x7FB801402660 (56 bytes), script=/github/PHP-CPP/test/tests/0002.php
[Sun Dec 18 23:14:44 2016]  Script:  '/PHP-CPP/test/tests/0002.php'
/tmp/php-build/source/7.0.9/Zend/zend_hash.c(1827) :  Freeing 0x7FB801460C80 (264 bytes), script=/PHP-CPP/test/tests/0002.php
[Sun Dec 18 23:14:44 2016]  Script:  '/PHP-CPP/test/tests/0002.php'
/tmp/php-build/source/7.0.9/Zend/zend_objects.c(162) :  Freeing 0x7FB801477C30 (40 bytes), script=/PHP-CPP/test/tests/0002.php
[Sun Dec 18 23:14:44 2016]  Script:  '/PHP-CPP/test/tests/0002.php'
/tmp/php-build/source/7.0.9/Zend/zend_string.h(121) :  Freeing 0x7FB801477C80 (40 bytes), script=/PHP-CPP/test/tests/0002.php
Last leak repeated 1 time
[Sun Dec 18 23:14:44 2016]  Script:  '/PHP-CPP/test/tests/0002.php'
/tmp/php-build/source/7.0.9/Zend/zend_closures.c(367) :  Freeing 0x7FB80147C000 (296 bytes), script=/PHP-CPP/test/tests/0002.php
=== Total 6 memory leaks detected ===

zend_string.h(121): "myFunction", 'method'
zend_objects.c(162): new MyClass()
zend_closures.c(367): function($a, $b, $c) { return $a + $b + $c; }
zend_hash.c: array(new MyClass(), 'method')

Php::Value call_php_function(Php::Parameters& params)
{
	if (!params[0].isCallable()) {
		throw Php::Exception("Not a callable type.");
	}

	return params[0](1, 2, 3);
}

/* ... */

	extension.add<call_php_function>("call_php_function", {
		Php::ByVal("addFunc", Php::Type::Callable)
	});

[sjinks]

Value::~Value()
{
    // reduce the refcount - if necessary
    Z_TRY_DELREF_P(_val);
}

If reference count for _val goes down to 0, the zval is not freed. Probably zval_ptr_dtor should be used instead.

Related: #249, ad4eaa6