Repository navigation
Regression: str_replace()/str_ireplace() string $search + array $replace returns first element — Zend TypeError (re-#11056, ext/standard/string.c) #22827
Description
Category
bug · php-src-strict · stdlib string replace (pillar 4)
Problem
After array $search/$replace support landed (#11056), the inverse guard was lost: when $search is a string and $replace is an array, Zend throws TypeError (Argument #2 ($replace) must be of type string when argument #1 ($search) is a string). The VM silently uses $replace[0] and returns a string.
Probed 2026-07-24 on master workspace vs Zend 8.2.32 (php-compiler:22.04-dev).
| Repro | Zend 8.2.32 | VM (2026-07-24) |
|---|---|---|
str_replace('a', ['x','y'], 'a') |
TypeError |
'x' |
str_ireplace('A', ['x','y'], 'a') |
TypeError |
'x' |
str_replace(['a','b'], ['A','B'], 'ab') |
'AB' (ok) |
'AB' (ok) |
php-src reference
- php/php-src
ext/standard/string.c—php_str_replace_common/ arg info: array$replaceonly legal when$searchis array - php/php-src
ext/standard/basic_functions.stub.php—str_replace/str_ireplacesignatures
PHP implementation target
ext/standard/string replace implementation (+ JIT lowering if present) — rejectis_string($search) && is_array($replace)with Zend's TypeError message before indexing$replace[0]- Prefer shared VM/JIT guard; no new C in
runtime/
Repro
./script/docker-exec.sh -- bash -lc 'php -r '\''try { var_export(str_replace("a", ["x","y"], "a")); } catch (Throwable $e) { echo get_class($e), ":", $e->getMessage(), "\n"; }'\'''
./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r '\''try { var_export(str_replace("a", ["x","y"], "a")); } catch (Throwable $e) { echo get_class($e), ":", $e->getMessage(), "\n"; }'\'''
# or write the same snippet to a temp file and run php / php bin/vm.php on itMinimal script:
<?php
try {
var_export(str_replace('a', ['x', 'y'], 'a'));
echo "\n";
} catch (Throwable $e) {
echo get_class($e), ':', $e->getMessage(), "\n";
}
try {
var_export(str_ireplace('A', ['x', 'y'], 'a'));
echo "\n";
} catch (Throwable $e) {
echo get_class($e), ':', $e->getMessage(), "\n";
}Done when
- VM matches Zend: both calls throw
TypeErrorwith the php-src message (php-src-strict) - Array
$search+ array$replacepath still works ('AB') - Compliance
.phptundertest/compliance/cases/stdlib/(ortest/repro/+ targeted phpunit) - No php-compiler-strict shortcut; JIT/AOT agree when in scope
Related
- Closed Stdlib: str_replace()/str_ireplace() array $search/$replace — TypeError not array form (ext/standard/string.c) #11056 (array form support) — this is the missing inverse TypeError
- Strategic pillar 4 · Strategic alignment: compiler excellence pillars (2026 H2) #10533
Activity
PurHur commentedon Jul 24, 2026
claim: PHP Compiler STD Lib — starting this run
Pillar 1 snapshot (pre-claim):
php script/bootstrap-inventory.php --check: file-list/doc stale (ArrayUnshiftRuntime warning drift) — not a hard inventory count fail./script/release-readiness.sh --json: running / will paste outcome with PRmake bootstrap-selfhost-link: in progress via docker-execImplementing #22827: TypeError when string
$search+ array$replaceforstr_replace/str_ireplace(php-srcext/standard/string.c).Stdlib: TypeError for str_replace string $search + array $replace (#2…
PurHur commentedon Jul 24, 2026
Merged via PR #22844.
Fix: VM rejects string
$search+ array$replacewith Zend's TypeError; JIT/AOT usesJitStrReplaceSearchReplaceGuard(php-srcext/standard/string.c). Array$search/$replacepath unchanged (AB).Verification:
php bin/vm.php test/repro/issue_22827_…matches Zend;./script/phpunit.sh --filter str_replace_string_search_array_replaceOK; AOT fixture abort exit 255 with Uncaught TypeError.Pillar 1 note:
north-star5-faststill red on master (gen-0 4f-m / #8713) — unrelated to this stdlib fix.