Skip to content

Core: fix missing deprecation when accessing null array key with JIT #20883

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexandre-daubois wants to merge 2 commits into
base: PHP-8.5
Choose a base branch
from
+9 −3
Open

Core: fix missing deprecation when accessing null array key with JIT #20883

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2fc9f07
Core: fix missing deprecation when accessing null array key with JIT
alexandre-daubois Jan 9, 2026
681ef28
address Ilija and Dmitry comments
alexandre-daubois Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ PHP NEWS
function triggered by bailout in php_output_lock_error()). (timwolla)
. Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
. Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
. Fix deprecation now showing when accessing null key of an array with JIT.
(alexandre-daubois)

- MbString:
. Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is
Expand Down
6 changes: 4 additions & 2 deletions Zend/Optimizer/sccp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,8 +363,7 @@ static inline zend_result zval_to_string_offset(zend_long *result, zval *op) {
static inline zend_result fetch_array_elem(zval **result, zval *op1, zval *op2) {
switch (Z_TYPE_P(op2)) {
case IS_NULL:
*result = zend_hash_find(Z_ARR_P(op1), ZSTR_EMPTY_ALLOC());
return SUCCESS;
return FAILURE;
case IS_FALSE:
*result = zend_hash_index_find(Z_ARR_P(op1), 0);
return SUCCESS;
Expand Down Expand Up @@ -428,6 +427,9 @@ static inline zend_result ct_eval_isset_isempty(zval *result, uint32_t extended_
}

static inline zend_result ct_eval_isset_dim(zval *result, uint32_t extended_value, zval *op1, zval *op2) {
if (Z_TYPE_P(op2) == IS_NULL) {
return FAILURE;
}
Copy link
Member

@iluuu1994 iluuu1994 Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this still necessary? Shouldn't fetch_array_elem() already handle it?

Copy link
Member Author

@alexandre-daubois alexandre-daubois Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would say it is. If op1 is not an array (e.g. isset($a[null])), the condition below this one (if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {) would be false and we would completely ditch any check on a null key.

Adding this early return avoids compile-time checks that would silence this kind of operation. If I get it right 😄

Copy link
Member

@iluuu1994 iluuu1994 Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The deprecation was only added for arrays though, as far as I understand.

if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
zval *value;
if (fetch_array_elem(&value, op1, op2) == FAILURE) {
Expand Down
4 changes: 3 additions & 1 deletion ext/opcache/tests/jit/fetch_dim_r_001.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,16 @@ function foo() {
}
foo();
?>
--EXPECT--
--EXPECTF--
int(1)
int(3)
int(2)
int(1)
int(3)
int(1)
int(2)

Deprecated: Using null as an array offset is deprecated, use an empty string instead in %s on line %d
int(4)
int(5)
int(5)
Expand Down
Loading