Repository navigation
Regression: substr() negative offset + nested string builtin arg #1 — returns offset not slice (re-#10673, ext/standard/string.c) #13616
Description
Category
stdlib · php-src-strict · regression
Problem
Closed #10673 regressed: when substr() argument #1 is a nested string-return builtin and argument #2 is a negative offset, VM returns the decimal offset string (-4, -2, …) instead of the correct tail slice.
Zend pattern used for file modes: substr(sprintf('%o', fileperms($path)), -4).
Positive offsets with the same nesting work (substr(sprintf('%s','abc'), 0, 2) → ab).
php-src reference
ext/standard/string.c—php_substr,php_sprintfZend/zend_execute.c— nestedZEND_CALLtemporaries
Repro (verified 2026-06-29)
php test/repro/maintainer_gap_substr_sprintf_nested.php
php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php| Call | Zend | VM |
|---|---|---|
substr(sprintf('%o', 33188), -4) |
0644 |
-4 ❌ |
substr(dechex(255), -2) |
ff |
-2 ❌ |
substr(str_pad('1',5,'0'), -3) |
000 |
-3 ❌ |
substr(sprintf('%o', fileperms($f)), -4) after chmod($f,0644) |
0644 |
-4 ❌ |
substr(sprintf('%s','abcdef'), 0, 2) (control) |
ab |
ab ✓ |
Scope (PHP-in-PHP first)
| Layer | Path |
|---|---|
| VM call bridge | nested return-value materialization for string builtins used as substr subject |
| Stdlib | ext/standard/ — no new runtime/*.c branches |
| Related | #9547 family (nested array builtins); this repro is string-return + negative offset |
Done when (php-src-strict)
- All rows in repro table match Zend
-
test/repro/maintainer_gap_substr_sprintf_nested.phpexits 0 on VM - Targeted compliance guard under
test/compliance/cases/stdlib/
Verification
php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php
Activity
PurHur commentedon Jun 29, 2026
claim: cursor-agent-lane-c — batch (issues #13616); VM nested string builtin + substr negative offset regression (lib/ call bridge, not ext/ implementation)
Fix substr() nested string builtin + negative offset arg wiring (#13616…
PurHur commentedon Jun 29, 2026
Merged via #13632
Fix: sibling inline call-arg producer wiring in
lib/Compiler.php—UnaryMinuspreludes between hoisted FuncCall producers no longer breaksiblingMultiArgProducerWiresByDistinctDeadArgOrdinal; nested-only producers (e.g.filepermsfeedingsprintf) are skipped when resolvingfirstSiblingforsubstr(..., -N)chains.Verification:
repro exit=0; compliance green.