Regression: in_array()/array_merge()/array_flip()/array_map() null array coerce — Zend TypeError (ext/standard/array.c, re-#21771) #21916

Category

bug · php-src-strict · stdlib / array null TypeError batch

Problem

Against the Docker Zend 8.2 reference, these builtins must TypeError on a null array operand. The VM silently coerces (legacy empty/false results) on default and PHP_COMPILER_PROFILE=8.4.

Peers: #21914 (count/sizeof), #21915 (array_keys). Same root cause as inverted #21771 (8.4 DEP claim must not break 8.2 reference TypeError).

php-src reference

• php/php-src ext/standard/array.c — in_array, php_array_merge, array_flip, array_map, array_sum
• php/php-src Zend/zend_API.c — typed array arg null rejection (8.0–8.3)

PHP implementation target

• Shared null→TypeError guard for array operands in ext/standard/ (+ JIT stubs) under reference profile
• Prefer one helper reused by listed builtins; VM/JIT/AOT agree
• No new runtime/*.c

Repro

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
cat > /tmp/array_null_batch.php <<'"'"'PHP'"'"'
<?php
$cases = [
  "in_array" => fn() => in_array(1, null),
  "array_merge" => fn() => array_merge(null),
  "array_flip" => fn() => array_flip(null),
  "array_map" => fn() => array_map(strval(...), null),
  "array_sum" => fn() => array_sum(null),
];
foreach ($cases as $name => $fn) {
  try { var_export($fn()); echo " ($name)\n"; }
  catch (Throwable $e) { echo $name, " ", get_class($e), "\n"; }
}
PHP
php /tmp/array_null_batch.php
php bin/vm.php /tmp/array_null_batch.php
'

Done when

• Each listed call throws Zend-identical TypeError on VM + JIT (reference profile)
• Compliance .phpt under test/compliance/cases/array/
• php-src-strict; no php-compiler-strict shortcut