Regression: password_hash()/gzencode()/implode(null) TypeError under PROFILE=8.4 — Zend DEP+coerce (ext/standard/password.c, zlib, array.c)

[PurHur]

Category

Regression · php-src-strict · over-strict null reject (Pillar 4)

Problem

Under PHP_COMPILER_PROFILE=8.4, password_hash / gzencode / implode throw TypeError when a string operand is null. Zend 8.4.23 emits E_DEPRECATED and coerces (password_hash hashes '', gzencode encodes empty, implode(null, …) uses '' separator → 'ab').

Probed 2026-07-20 vs php:8.4-cli (8.4.23) and php bin/vm.php.

Repro	Zend 8.4.23	VM PROFILE=8.4
password_hash(null, PASSWORD_DEFAULT)	E_DEPRECATED + $2y$… hash of ''	TypeError ❌
gzencode(null)	E_DEPRECATED + 20-byte gzip of empty	TypeError ❌
implode(null, ['a','b'])	E_DEPRECATED + 'ab'	TypeError ❌

php-src reference

• php/php-src ext/standard/password.c — PHP_FUNCTION(password_hash)
• php/php-src ext/zlib/zlib.c — PHP_FUNCTION(gzencode)
• php/php-src ext/standard/array.c — PHP_FUNCTION(implode)
• Pattern: #21189, closed #20611

PHP implementation target

• Soften null reject under PROFILE=8.4 via shared string coerce+deprecation helpers in the PHP builtins + JIT lowering. PHP-in-PHP; no new C. VM/JIT/AOT agree. Distinct from open #4162 (password_verify scalar coerce).

Repro

./script/docker-exec.sh -- bash -lc 'export PHP_COMPILER_PROFILE=8.4
php bin/vm.php -r "
set_error_handler(function (\$n, \$m) { echo \"DEP\\n\"; return true; });
\$cases = [
  [\"password_hash\", [null, PASSWORD_DEFAULT]],
  [\"gzencode\", [null]],
  [\"implode\", [null, [\"a\", \"b\"]]],
];
foreach (\$cases as [\$f, \$a]) {
  try { \$r = \$f(...\$a); echo \$f, \" OK\\n\"; }
  catch (Throwable \$e) { echo \$f, \" \", get_class(\$e), PHP_EOL; }
}
"
# expect DEP + OK, not TypeError
'

Done when

• Listed builtins match Zend 8.4 DEP + coerce results under PROFILE=8.4 on VM/JIT/AOT
• PROFILE=8.2 unchanged vs Zend 8.2
• Compliance/repro guard; php-src-strict; no new C

Related

• Pillar 4 (Strategic alignment: compiler excellence pillars (2026 H2) #10533) · siblings #21189 #4162 · closed #20611

[PurHur]

claim: PHP Compiler STD Lib — starting this run

Pillar 1 probe (this workspace):

• php script/bootstrap-inventory.php --check → OK 6170/6170
• ./script/release-readiness.sh --json — inventory + spine sync OK; north-star5-fast still running (parallel container warning)
• Repro under PHP_COMPILER_PROFILE=8.4: password_hash/implode TypeError; gzencode already DEP+OK (Regression: gzdeflate()/gzinflate()/gzdecode()/gzuncompress(null) TypeError under PROFILE=8.4 — Zend DEP+coerce (ext/zlib/zlib.stub.php) #21311)

Implement soft-null DEP+coerce for password_hash + implode separator (php-src-strict); update stale #20174/#19894 TypeError expectations.

[PurHur]

Merged via #21511

Verification

• VM: PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/issue_21210_password_hash_gzencode_implode_soft_null.php → DEP + OK for password_hash / gzencode / implode
• JIT (Docker): same repro → DEP + OK ×3
• AOT: fixture issue_21210_password_hash_gzencode_implode_soft_null.phpt → password_hash OK / implode OK
• PHPUnit filter issue_21210|password_hash_verify_null_forward84|implode_token_sscanf_null_forward84 → OK (14 tests)

php-src-strict soft-null via shared trim-family / separator helpers; no new C.