Regression: password_hash() global const algo null when optional $options passed (ext/standard/password.c)

[PurHur]

Category

stdlib + compile lowering · php-src-strict

Problem

password_hash($password, PASSWORD_BCRYPT) works, and password_hash($password, 1, ['cost' => 4]) works, but password_hash($password, PASSWORD_BCRYPT, ['cost' => 4]) passes null as argument #2 ($algo) → TypeError. Zend accepts the call and returns a bcrypt hash string.

Related but distinct from #9275 (PASSWORD_DEFAULT resolves null in other contexts).

Repro

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_password_hash_options.php 2>&1'
# no-opt ok
# with-opt TypeError: Argument #2 ($algo) must be of type string|int, null given
# lit-opt ok

test/repro/maintainer_gap_password_hash_options.php:

password_hash('test', PASSWORD_BCRYPT);              // ok
password_hash('test', PASSWORD_BCRYPT, ['cost' => 4]); // TypeError — must hash
password_hash('test', 1, ['cost' => 4]);             // ok

php-src reference

• ext/standard/password.c — PHP_FUNCTION(password_hash)

Implementation (PHP-in-PHP)

• Likely call lowering / optional-arg slot bug when a global constant occupies arg Php stdlib specs implementation #2 and a literal array is arg Stdlib: ceil, floor, intval and expanded PHPT specs #3 — fix in lib/Compiler.php / VM call path, not new C
• Verify ext/standard/password_hash.php receives the resolved algo int/string

Done when

• All three repro lines succeed on VM (and JIT/AOT if in scope)
• Targeted compliance/unit guard referencing this repro
• No regression on two-arg password_hash() paths (Stdlib: PASSWORD_DEFAULT constant resolves NULL — password_hash() TypeError (ext/standard/password.c) #9275)

[PurHur]

claim: cursor-agent-lane-b — starting this run (call lowering / optional-arg slot when global const is arg #2; compiler scope in lib/Compiler.php)

[PurHur]

Merged via #10617.

Root cause: precedingInlineCallArgProducersBeforeCfgOp stopped at the trailing inline Array_ before password_hash(...) and dropped the hoisted ConstFetch for PASSWORD_BCRYPT, so arg #2 was an uninitialized dead temp (null at runtime).

Verification:

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_password_hash_options.php'
# no-opt ok / with-opt ok / lit-opt ok
php vendor/bin/phpunit test/unit/InlineCallArgProducerSlotTest.php --filter testPasswordHashConstFetchAndArrayOptionSlots
# OK