Repository navigation
Regression: password_hash(null) under declare(strict_types=1) — VM coerces, Zend TypeError (re-#17023, ext/standard/password.c) #17050
Description
Category
stdlib · null operand under user strict_types · php-src-strict
Problem
#17023 fixed non-strict password_hash(null) coercion but regressed strict_types: with declare(strict_types=1), Zend rejects password_hash(null, …) with TypeError. This compiler still coerces null to '' and returns a hash.
| Repro | Zend 8.2 | VM (2026-07-07) |
|---|---|---|
password_hash(null, PASSWORD_DEFAULT) in strict file |
TypeError |
non-empty hash (ok) |
php-src reference
- php/php-src
ext/standard/password.c—PHP_FUNCTION(password_hash)respects compile-unit strict_types for$password
PHP implementation target
ext/standard/password_hash.php— branchVmString::coerceStringBuiltinArg()vscoerceTypedStringBuiltinArg()on$passwordwhencalledInStrictTypes()lib/JIT/Builtin/password lowering — same strict_types gate for JIT/AOT
Repro
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_password_hash_null.php'
# ok (wrong) · Zend: TypeErrorDone when
- Strict unit:
password_hash(null, …)throwsTypeErroron VM/JIT/AOT - Non-strict unit:
password_hash(null, …)still coerces to empty password (php-src) - Compliance guard under
test/compliance/cases/stdlib/ - php-src-strict; no php-compiler-strict shortcut
Activity
PurHur commentedon Jul 7, 2026
Follow-up to closed #17023: non-strict coercion is fixed, but strict_types unit still diverges (VM coerces, Zend TypeError). Repro:
test/repro/maintainer_gap_password_hash_null.php.PurHur commentedon Jul 7, 2026
claim: PHP Compiler STD Lib Advanced — batch strict_types null operands (#17050, #17051, #17049, #17052)
Stdlib: honor strict_types for null password/microtime/date args (#17050
PurHur commentedon Jul 7, 2026
Merged in #17053. VM+JIT compliance green for strict_types null TypeError on password_hash/verify, microtime, date_create_from_format; non-strict coercion regressions (password_hash_null_password_coerce, microtime_null_coerce) still pass.