Regression: PHP 8.4 forward-profile http/stream builtins visible to function_exists on reference harness (re-#16086, ext/standard)

[PurHur]

Category

Regression · php-src-strict · forward-profile phantom introspection

Problem

With PHP_COMPILER_PROFILE=8.4 on the 8.4.0-dev reference harness (Zend 8.2 semantics), several PHP 8.4-only symbols report present via function_exists() even though Zend 8.2 returns false. Issue #16086 closed the fpow/mb_str_pad/bcmath phantom path; http_get_last_response_headers() and stream_context_set_options() still leak through BuiltinIntrospectionPolicy / registration advertises helpers.

Probe (PHP_COMPILER_PROFILE=8.4)	Zend 8.2	VM (2026-07-05)
function_exists('http_get_last_response_headers')	false	true
function_exists('http_clear_last_response_headers')	false	true
function_exists('stream_context_set_options')	false	true
function_exists('fpow')	false	false (OK post-#16086)

php-src reference

• php/php-src ext/standard/basic_functions.c — function_exists registry / version gates
• php/php-src ext/standard/streams.c — stream_context_set_options (PHP 8.4)
• php/php-src ext/standard/http.c — response header helpers (PHP 8.4)

PHP implementation target

• ext/standard/BuiltinIntrospectionPolicy.php — route http/stream 8.4 symbols through advertises* helpers that return false on 8.4.0-dev reference (same pattern as advertisesFpow())
• lib/CompilerVersion.php — add/adjust advertisesHttpResponseHeaders() / advertisesStreamContextSetOptions() if needed
• Keep symbols callable when both profile and php-src version allow; only fix introspection

Repro

./script/docker-exec.sh -- bash -lc '
  PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/maintainer_gap_http_response_headers_phantom_reference.php
  PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/maintainer_gap_stream_context_set_options_phantom_reference.php
'

Done when

• Both probes print ok (exit 0) with PHP_COMPILER_PROFILE=8.4 against Zend 8.2 reference semantics
• Forward builtins still callable when runtime + php-src both allow
• Unit guard in test/unit/ForwardProfilePhantomIntrospectionTest.php (or sibling)
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler STD Lib — starting this run

[PurHur]

Merged via #16352.

Fix: advertisesHttpLastResponseHeaders() / advertisesStreamContextSetOptions() in CompilerVersion.php; BuiltinIntrospectionPolicy gates the four symbols on stable 8.4.0+ only (same pattern as #16086 fpow/bcmath).

Verification (PHP_COMPILER_PROFILE=8.4):

• test/repro/maintainer_gap_http_response_headers_phantom_reference.php → ok
• test/repro/maintainer_gap_stream_context_set_options_phantom_reference.php → ok
• ForwardProfilePhantomIntrospectionTest → 5/5 green
• Forward builtins remain callable (http_callable=1, stream_callable=1)