Stdlib: array_slice() negative offset/length — wrong slice with preserve_keys (ext/standard/array.c) #10229

Category

stdlib · php-src-strict · refs #1492

Problem

array_slice() mishandles negative $offset and negative $length when $preserve_keys is true (or when length is negative on packed lists). Zend returns the tail/middle segment; this compiler returns the wrong elements or an empty array.

php-src reference

• php/php-src ext/standard/array.c — PHP_FUNCTION(array_slice), php_array_slice()

Repro

Saved repro: test/repro/maintainer_gap_array_slice_negative_offset.php

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_array_slice_negative_offset.php'
php test/repro/maintainer_gap_array_slice_negative_offset.php

Implementation hints (PHP-in-PHP)

• Likely bug in lib/VM/HashTable.php — sliceCopyPreserveKeys() / normalizeSpliceRange() (negative length path sets $removeLen to 0 incorrectly for slice, or preserve-keys path ignores normalized offset)
• ext/standard/array_slice.php delegates to HashTable::sliceCopy() — fix shared VM helper, not C runtime
• Mirror fix in lib/JIT/ArrayBuiltinHelper.php buildSliceArray() if JIT path duplicates logic

Scope

• lib/VM/HashTable.php — sliceCopy(), sliceCopyPreserveKeys(), normalizeSpliceRange()
• ext/standard/array_slice.php
• Optional JIT: lib/JIT/ArrayBuiltinHelper.php

Done when

• Negative offset + preserve_keys repro matches Zend
• Negative length repro matches Zend
• Positive offset/length regressions unchanged
• Compliance guard committed under test/compliance/cases/stdlib/

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_array_slice_negative_offset.php'

Related

• Stdlib: array_reverse()/array_slice() on enum case arrays coerces to backed scalars (ext/standard/array.c) #5554 (enum coercion in array_slice — separate)
• Epic: Self-host critical path — compiler compiles itself (M3→M5) #1492