Stdlib: SplFixedArray OOB offsetSet uncaught — Zend catchable RuntimeException (ext/spl/spl_fixedarray.c) #21994

Category

bug · php-src-strict · SplFixedArray exception delivery

Problem

Out-of-range SplFixedArray writes must throw a user-catchable RuntimeException (Index invalid or out of range). Zend's try { $a[5]=1; } catch (Throwable) catches it. The VM prints an Uncaught RuntimeException fatal and never enters the user catch — exception escapes the script try/catch around the dim write.

In-tree throw site: ext/spl/SplFixedArrayBuiltin.php (offsetSet).

Probed 2026-07-22 vs host Zend 8.2.32.

php-src reference

• php/php-src ext/spl/spl_fixedarray.c — spl_fixedarray_object_write_dimension / zend_throw_exception
• Exception must unwind through user try/catch like other PHP exceptions

PHP implementation target

• ext/spl/SplFixedArrayBuiltin.php — ensure throw uses VM exception path (not abort/fatal bypass)
• lib/VM.php / lib/VM/ArrayAccessDimension.php — dim-write from ArrayAccess must deliver thrown exceptions to active try handlers
• No new C runtime logic

Repro

./script/docker-exec.sh -- bash -lc 'cat > /tmp/spl_oob.php <<'"'"'PHP'"'"'
<?php
$a = new SplFixedArray(3);
try { $a[5] = 1; echo "no-throw\n"; }
catch (Throwable $e) { echo "caught:", get_class($e), "\n"; }
PHP
php /tmp/spl_oob.php
php bin/vm.php /tmp/spl_oob.php'

Done when

• VM prints caught:RuntimeException (matches Zend)
• JIT/AOT agree when in scope
• Compliance .phpt under test/compliance/cases/
• php-src-strict; no php-compiler-strict shortcut