Repository navigation
Regression: nested string/scalar-return builtin in call argument evaluates to null (extends #9547, Zend/zend_execute.c) #10495
Description
Category
stdlib · VM call lowering · php-src-strict
Problem
When a builtin that returns a string or other scalar (not only arrays) is used inline as an argument to another call, the nested expression evaluates to null instead of the return value. Assigning the same call to a variable first works.
Distinct from #9547 (array-return builtins such as array_keys() / stream_get_filters()). Same root cause class — nested FUNCCALL return slot not forwarded — but string/scalar returns are still broken.
php-src reference
- php/php-src
Zend/zend_execute.c— nested call argument evaluation / temporary return consumption - php/php-src
ext/standard/type.c—get_debug_type,gettype - php/php-src
ext/standard/var.c—var_export - php/php-src
ext/json/php_json.c—json_encode
Repro
test/repro/nested_string_builtin_call_arg.php:
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php test/repro/nested_string_builtin_call_arg.php
php bin/vm.php test/repro/nested_string_builtin_call_arg.php'| Expression | Zend | VM (bug) |
|---|---|---|
var_export(get_debug_type(null), true) |
'null' |
NULL |
var_export(gettype(null), true) |
'NULL' |
NULL |
var_export(json_encode(null), true) |
'null' |
NULL |
var_export(get_class(new stdClass()), true) |
'stdClass' |
NULL |
$x = get_debug_type(null); var_export($x, true) (control) |
'null' |
'null' |
Scope (PHP-in-PHP)
| Area | Path |
|---|---|
| VM call lowering | nested call-as-argument must preserve callee return slot |
| Compiler | lib/Compiler.php opcode emission for nested FUNCCALL |
| Stdlib | no C runtime workaround |
Done when (php-src-strict)
- Repro matches Zend for nested
get_debug_type,gettype,json_encode,get_class -
#9547nested array-return cases stay green - Compliance guard under
test/compliance/cases/stdlib/nested_string_builtin_arg.phpt
Activity
PurHur commentedon Jun 22, 2026
claim: cursor-agent-lane-c — starting this run
Fix nested scalar-return builtin call args evaluating to null (#10495)…
PurHur commentedon Jun 22, 2026
Merged via #10582.
Fix: When php-cfg hoists trailing literal
ConstFetchbetween nestedFuncCallnodes (var_export(get_debug_type(null), true)), wire innerFUNCCALL_EXEC_RETURNto outerTYPE_ARG_SENDviaisNestedCallArgProducerSeparatedByConsumerLiteralPreludes()inlib/Compiler.php.Verification:
```bash
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php -r "echo var_export(get_debug_type(null), true), "\n";"
./vendor/bin/phpunit --filter nested_string_builtin_arg test/compliance/
'
```
VM prints
'null'(wasNULL); compliancenested_string_builtin_arg.phptgreen.Fix arrow fn $this outside object context (#10558) (#10584)
PurHur commentedon Jun 22, 2026
claim: cursor-agent-lane-c — starting this run (continuation on agent/issue-10495-nested-string-builtin-arg)
PurHur commentedon Jun 22, 2026
Merged via #10586.
Fix:
compileCallArgSendsno longer skipsfindInlineExprCallArgProducerSlotwhenhasProduceris true for php-cfg dead nested-call arg temps (var_export(get_debug_type(null), true)pattern).Verification (Docker):
VM prints
'null','NULL','null','stdClass'; unit test green.Fix nested scalar-return builtin call args evaluating to null (#10495)…