Stdlib: nested substr(sprintf()) — inner string lost, wrong slice (ext/standard/string.c)

Problem

When substr() takes a nested sprintf() call as its first argument, the inner formatted string is not passed correctly. The outer substr sees a corrupted subject and returns the wrong tail.

Breaks common file-mode formatting: substr(sprintf('%o', fileperms($f)), -4) should yield 0644, not -4.

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_substr_sprintf_nested.php; php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php'

Runtime	`substr(sprintf('%o', 33188), -4)`
Zend	`0644`
VM	`-4`

Isolated calls work on both runtimes:

sprintf('%o', 33188); // 100644
substr('100644', -4); // 0644

Related family: #9547 (nested array-return builtins → null). This repro is string-return nesting (sprintf → substr).

php-src reference

ext/standard/string.c — php_substr, php_sprintf
Zend/zend_execute.c — nested call temporaries

PHP implementation target

VM call bridge / temporary materialization for nested builtin return values (shared fix with Regression: nested array-return builtin in call argument evaluates to null (ext/standard/array.c, streams.c) #9547 where possible)
ext/standard/ — no new C runtime branches

Done when (php-src-strict)

substr(sprintf('%o', $mode), -4) matches Zend for typical fileperms() values
Other nested string builtins (trim(str_replace(...)), etc.) spot-checked
Targeted compliance guard + test/repro/maintainer_gap_substr_sprintf_nested.php

claim: worker-lane-c — starting this run (VM nested builtin call bridge; not ext/standard-only scope)

Fix nested substr(sprintf()) losing inner return value (#10673). (#10685

Merged via #10685.

Root cause: php-cfg lowers substr(sprintf(...), -N) as adjacent producers [sprintf, UnaryMinus, substr]. isSiblingMultiArgFuncCallProducer rejected sprintf when a unary prelude sat between it and substr, so the inner sprintf return never wired to substr arg 0.

Fix: allow unary-prelude siblings and map distance-2 FuncCall producers to consumer arg 0 in lib/Compiler.php.

Verification (green):

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php'
# 0644
./script/docker-exec.sh -- bash -lc 'php vendor/bin/phpunit --filter nested_substr_sprintf'
# OK

Fix substr() nested string builtin + negative offset arg wiring (#13616…

Merge origin/master into agent/issue-11336-date-sun-info-inline-strto…

claim: cursor-agent-lane-b — regression re-open: substr(sprintf(...), -N) misbind on master (InlineCallArgProducerSlotTest red)

Navigation Menu

Repository navigation

Stdlib: nested substr(sprintf()) — inner string lost, wrong slice (ext/standard/string.c) #10673

Problem

php-src reference

PHP implementation target

Done when (php-src-strict)

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Stdlib: nested substr(sprintf()) — inner string lost, wrong slice (ext/standard/string.c) #10673

Description

Problem

php-src reference

PHP implementation target

Done when (php-src-strict)

Activity

PurHur commented on Jun 23, 2026

PurHur commented on Jun 23, 2026

PurHur commented on Jul 4, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions