Repository navigation
Regression: password_needs_rehash() nested password_hash() callee — fatal TYPE_DOUBLE typo (ext/standard/password.c) #17708
Description
Category
Regression · php-src-strict
Problem
password_needs_rehash() works when the hash string is bound to a variable, but fatals when password_hash() is nested as the first argument. Root cause includes VmPassword::algoTypeLabel() referencing nonexistent Variable::TYPE_DOUBLE (should be TYPE_FLOAT), masking the real argument-binding bug with an internal Error.
| Repro | Zend 8.2+ | VM (2026-07-10) |
|---|---|---|
password_needs_rehash($h, PASSWORD_BCRYPT, ['cost'=>4]) |
true/false per cost |
OK |
password_needs_rehash(password_hash('x', PASSWORD_BCRYPT), PASSWORD_BCRYPT, ['cost'=>4]) |
true |
Fatal: Undefined constant Variable::TYPE_DOUBLE |
php-src reference
- php/php-src
ext/standard/password.c—php_password_needs_rehash()argument parsing
PHP implementation target
ext/standard/VmPassword.php— fixalgoTypeLabel()to useVariable::TYPE_FLOAT; audit nested-call arg slots inpassword_needs_rehash::execute()ext/standard/password_needs_rehash.php— VM execute path- JIT:
lib/JIT/JitPasswordNeedsRehash.phpif the same mis-bind appears under LLVM
Repro
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_password_needs_rehash_nested_hash.php'Done when
- Nested and variable-bound calls agree with Zend on bcrypt cost compare
- Mis-typed
$algosurfacesTypeError, never internalTYPE_DOUBLEfatal - Compliance
.phptguard undertest/compliance/cases/password/ - php-src-strict; no php-compiler-strict shortcut
Activity
PurHur commentedon Jul 10, 2026
claim: PHP Compiler STD Lib — starting this run
PurHur commentedon Jul 10, 2026
claim: PHP Compiler STD Lib Advanced — batch (issues #17708, #17707, #17709)
PurHur commentedon Jul 10, 2026
Merged via #17727.
Verification
php bin/vm.php test/repro/maintainer_gap_password_needs_rehash_nested_hash.php→ okbool(true)matching variable-bound form (bcrypt cost 10 vs requested 4)password_verify('x', password_hash(...))nested callee also fixed by INIT deferralpassword_needs_rehash_nested_hash.phpt+ JIT variant greenphp bin/compile.php -l test/fixtures/aot/compile-only/password_needs_rehash_nested_hash.phpexit 0Stdlib: fix password_needs_rehash() nested password_hash() callee (#1…
PurHur commentedon Jul 10, 2026
Merged in PR #17728 — VM repro + compliance guards green. See PR body for verification transcript.
Merge origin/master — keep upstream nested password_needs_rehash repro (
Stdlib: session headers guard, iconv incomplete notice, password TYPE…
chore: drop 24 more stale maintainer_gap repros (wave30 batch 2, #16660…