Regression: Intl* serialize() allowed — Zend Exception "not allowed" (ext/intl/*.stub.php)

[PurHur]

Category

Regression · php-src-strict · stdlib · intl · serialize · pillar 4

Problem

Zend marks Intl formatter / calendar / collator / resource-bundle classes @not-serializable. The VM emits empty O:…:0:{} payloads instead of throwing.

Verified 2026-07-25 (host Zend PHP 8.2.32 vs php bin/vm.php):

Repro	Zend 8.2+	VM
serialize(new IntlDateFormatter(…))	Exception: Serialization of 'IntlDateFormatter' is not allowed	O:17:"IntlDateFormatter":0:{}
serialize(new NumberFormatter(…))	Exception: … 'NumberFormatter' …	O:15:"NumberFormatter":0:{}
serialize(new Collator(…))	Exception: … 'Collator' …	O:8:"Collator":0:{}
serialize(new MessageFormatter(…))	Exception: … 'MessageFormatter' …	O:16:"MessageFormatter":0:{}
serialize(ResourceBundle::create(…))	Exception: … 'ResourceBundle' …	O:14:"ResourceBundle":0:{}
serialize(IntlCalendar::createInstance())	Exception: … 'IntlGregorianCalendar' …	O:21:"IntlGregorianCalendar":0:{}

Sibling of CurlHandle/SimpleXMLElement serialize bans (#23074, #23072). Separate from ResourceBundle create/fallback parity (#22902, #22854).

php-src reference

• php/php-src ext/intl/dateformat/dateformat.stub.php — @not-serializable on IntlDateFormatter
• php/php-src ext/intl/formatter/formatter.stub.php — NumberFormatter
• php/php-src ext/intl/collator/collator.stub.php — Collator
• php/php-src ext/intl/msgformat/msgformat.stub.php — MessageFormatter
• php/php-src ext/intl/resourcebundle/resourcebundle.stub.php — ResourceBundle
• php/php-src ext/intl/calendar/calendar.stub.php — IntlCalendar / IntlGregorianCalendar

PHP implementation target

• Shared serialize/unserialize deny in ext/intl/ (+ hook from ext/standard/VmSerialize.php) — throw Zend-identical Exception
• Reuse pattern from CurlFileSerializeDeny / SimpleXmlSerializeDeny; PHP-in-PHP; no new runtime/*.c
• Cover subclass name in message (IntlGregorianCalendar when that is the runtime class)

Repro

./script/docker-exec.sh -- bash -lc 'cat > /tmp/intl_ser.php <<'"'"'PHP'"'"'
<?php
\$objs = [
  "IntlDateFormatter" => new IntlDateFormatter("en_US", IntlDateFormatter::FULL, IntlDateFormatter::FULL),
  "NumberFormatter" => new NumberFormatter("en_US", NumberFormatter::DECIMAL),
  "Collator" => new Collator("en_US"),
  "MessageFormatter" => new MessageFormatter("en_US", "{0}"),
  "ResourceBundle" => ResourceBundle::create("en", "ICUDATA"),
  "IntlCalendar" => IntlCalendar::createInstance(),
];
foreach (\$objs as \$n => \$o) {
  try {
    echo \$n, " ALLOW ", substr(serialize(\$o), 0, 40), "\n";
  } catch (Throwable \$e) {
    echo \$n, " ", get_class(\$e), ":", \$e->getMessage(), "\n";
  }
}
PHP
php bin/vm.php /tmp/intl_ser.php
# expect Exception:Serialization of '"'"'<Class>'"'"' is not allowed for each
'

Done when

• serialize() on each listed Intl class throws Zend-identical Exception (message includes the runtime class name)
• unserialize('O:…') for those class names also denied (Zend parity)
• Compliance .phpt under test/compliance/cases/intl/ (or language/serialize)
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

Trust probe (before claim)

Gate	Status	Note
bootstrap-inventory --check	green/warn	construct-flag doc drift only
gen-0 manifest sync	red on master	Pillar 1 restamp in flight after #23090/#23091 — does not block this parity fix

Repro verified host Zend PHP 8.2.32 vs php bin/vm.php 2026-07-25. Pattern: CurlFileSerializeDeny / VmSerialize.php.

[PurHur]

claim: PHP Compiler STD Lib Advanced — batch (issues #23094, #23093, #23092)

Queued after #23093 merge. Deny serialize/unserialize for IntlDateFormatter, NumberFormatter, Collator, MessageFormatter, ResourceBundle, IntlCalendar/IntlGregorianCalendar.

[PurHur]

Merged #23108

Verification

• With host php8.2-intl: serialize + unserialize Exception for IntlDateFormatter, NumberFormatter, Collator, MessageFormatter, ResourceBundle, IntlGregorianCalendar/IntlCalendar
• vendor/bin/phpunit --filter "intl_serialize_disallowed|intl_serialize_unserialize_deny" — OK (4 tests)
• spine + inventory OK

Batch complete: #23094, #23093, #23092 all merged.

[PurHur]

Correction: prior comment was premature — squash merge completed now.

Merged #23108

Verification

• With host php8.2-intl: serialize + unserialize Exception for listed Intl classes (runtime name IntlGregorianCalendar for createInstance())
• Always-on unserialize deny .phpt + OOP .phpt with SKIPIF
• vendor/bin/phpunit --filter "intl_serialize_disallowed|intl_serialize_unserialize_deny" — OK (4 tests)
• spine + inventory OK

Batch complete: #23094 → #23093 → #23092 all merged.