Regression: typed string builtins — null $string coerced to '' not TypeError (ext/standard/string.c, ext/standard/url.c)

[PurHur]

Category

stdlib · php-src-strict

Problem

PHP 8 internal functions with string parameter types reject null with TypeError, even when the caller file does not use declare(strict_types=1). This compiler coerces null to '' via VmString::coerceStringBuiltinArg() for many builtins, returning empty output instead of throwing.

Repro	Zend 8.2 (2026-07-12)	VM (2026-07-12)
urlencode(null)	TypeError: ... must be of type string, null given	''
rawurlencode(null)	TypeError	''
htmlspecialchars(null)	TypeError	''
htmlentities(null)	TypeError	''
strtolower(null)	TypeError	''
addcslashes(null, 'a')	TypeError	''
trim(null)	TypeError	TypeError ✓
strip_tags(null)	TypeError	TypeError ✓

Note: #4310 tracks scalar (int/bool) coercion for htmlspecialchars()/htmlentities(); #8730 / #8846 track enum-case operands. This issue is null only on typed $string parameters.

php-src reference

• php/php-src ext/standard/url.c — PHP_FUNCTION(urlencode), PHP_FUNCTION(rawurlencode)
• php/php-src ext/standard/html.c — PHP_FUNCTION(htmlspecialchars)
• php/php-src ext/standard/string.c — PHP_FUNCTION(strtolower), PHP_FUNCTION(addcslashes)
• php/php-src Zend/zend_API.h — typed params reject null unless explicitly nullable

PHP implementation target

• ext/standard/VmString.php — coerceStringBuiltinArg() callers: use InternalStrictArg::rejectNullString() (or equivalent) before coercion for typed internal params
• lib/VM/InternalStrictArg.php — comment at line ~156 incorrectly suggests null→"" for all internals; align with Zend typed-param rules
• Per-builtin VM handlers in ext/standard/*.php + JIT JitStringBuiltinArg paths

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/string_builtin_null.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/string_builtin_null.php'
./script/docker-exec.sh -- bash -lc 'php test/repro/urlencode_null.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/urlencode_null.php'

Done when

• Listed builtins throw Zend-matching TypeError for null $string on VM (non-strict caller)
• JIT/AOT agree where builtins are lowered
• Compliance .phpt guards under test/compliance/cases/stdlib/string_builtin_null.phpt
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler STD Lib — starting this run

[PurHur]

Merged via #18206.

Fix: Typed internal `string` parameters now reject `null` with Zend-matching `TypeError` on VM and JIT (not Z_PARAM_STR coercion to `''`).

Verification:

• `php bin/vm.php test/repro/string_builtin_null.php` — all 8 listed builtins throw TypeError
• `vendor/bin/phpunit --filter string_builtin_null test/compliance/VMTest.php test/compliance/JITTest.php` — OK (2 tests)
• `php bin/compile.php -l test/repro/string_builtin_null.php` — AOT compile OK
• `./script/ci-fast.sh` — green