Regression: http_build_query() 4th encoding_type arg — data operand null (ext/standard/http.c) #12008

Category

stdlib · php-src-strict

Problem

http_build_query() with all four positional parameters mis-binds operands on the VM when $encoding_type (PHP_QUERY_RFC1738 / PHP_QUERY_RFC3986) is supplied. Zend returns the encoded query string; VM throws TypeError: Argument #1 ($data) must be of type array, null given even though the first argument is an inline array literal.

http_build_query(['a' => ['x', 'y']], '', '&', PHP_QUERY_RFC1738);
// Zend: a%5B0%5D=x&a%5B1%5D=y
// VM: TypeError on $data (null)

Distinct from #11300 (nested literal LogicException without 4th arg) and #8733 (enum value encoding).

php-src reference

• php/php-src ext/standard/http.c — php_url_encode_hash_ex, http_build_query()
• PHP_QUERY_RFC1738 / PHP_QUERY_RFC3986 encoding flags

PHP implementation today

• ext/standard/http_build_query.php — VmArray::requireArrayParam($frame->calledArgs[0], …)
• ext/standard/VmHttpBuildQuery.php — RFC1738/3986 encoding

Repro

test/repro/maintainer_gap_http_build_query_encoding_type.php

./script/docker-exec.sh -- php bin/vm.php test/repro/maintainer_gap_http_build_query_encoding_type.php
./script/docker-exec.sh -- php test/repro/maintainer_gap_http_build_query_encoding_type.php

Implementation hints (PHP-in-PHP)

• Fix VM builtin optional-parameter slotting for 3rd/4th args (numeric_prefix, arg_separator, encoding_type)
• Verify named encoding_type: path once positional call is fixed
• JIT/AOT: ext/standard/JitHttpBuildQuery.php / HttpBuildQueryJitHelper.php

Done when

• Repro prints ok on VM for PHP_QUERY_RFC1738 and PHP_QUERY_RFC3986
• 1–3 arg forms unchanged
• Compliance guard committed

Refs #1492, #11300, #4781.