Language: print_r($x, true) as call arg remaps following string literal onto same temp (Zend/zend_vm_def.c)

[PurHur]

Category

Language · php-src-strict · call/operand temps · print_r return

Problem

When print_r($value, true) is used directly as an argument to another call, the VM remaps the next string-literal argument onto the same temporary as the print_r return. Observable effect: str_contains / strpos / str_starts_with / str_ends_with / strstr behave as if the needle were a copy of the haystack (always a hit). Assigning the print_r result to a local first is fine; a variable needle is fine.

Probed 2026-07-28 vs Zend 8.2.32.

Repro	Zend	VM
str_contains(print_r([1,2,3], true), 'zzz')	false	true
str_contains(print_r([1,2,3], true), $n='zzz')	false	false
$s=print_r([1,2,3], true); str_contains($s,'zzz')	false	false
wrapper sc(print_r([1], true), 'zzz') seeing needle	'zzz' (len 3)	needle === haystack print_r string (len 23)
strpos(print_r([1,2,3], true), 'zzz')	false	0
str_starts_with(print_r([1,2,3], true), 'zzz')	false	true

php-src reference

• php/php-src ext/standard/basic_functions.stub.php — print_r
• Zend call arg evaluation does not alias distinct parameters to one temporary

PHP implementation target

• lib/Compiler.php / call lowering — ARG_SEND / temp lifetime for builtin return used as call arg (peer: UnhandledMatchError subject snapshot Regression: UnhandledMatchError message always NULL for variable subjects — Zend formats value (re-#23664, Zend/zend_exceptions.c) #24329)
• ext/standard print_r lowering only if it uniquely fails to materialize a fresh return temp; prefer shared call-arg fix
• PHP-in-PHP only; no new C in runtime/

Repro

./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r '\''
var_export(str_contains(print_r([1,2,3], true), "zzz"));
echo "\n";
$n = "zzz";
var_export(str_contains(print_r([1,2,3], true), $n));
echo "\n";
'\'''

Expect: false / false. Actual: true / false.

Done when

• Nested print_r(..., true) as haystack with literal needle matches Zend for str_contains / strpos / str_*_with / strstr
• User-function wrapper sees distinct haystack vs needle values
• Compliance guard under test/compliance/cases/; php-src-strict; no php-compiler-strict shortcut

Maintainer gate note (2026-07-28)

Pillar 1: user_release_ready: yes; north-star5-fast ok; inventory 6614/6614 inside readiness; host bootstrap-inventory --check still reports committed docs/bootstrap-inventory.md construct-flag drift for HelperRuntimeCache.php. Gen-0 provenance stale (known).

[PurHur]

Maintainer probe (filing run)

Root cause shape: when print_r($x, true) is passed directly as a call argument, the following string-literal argument is bound to the same temporary as the print_r return (wrapper sees needle_len === hay_len and needle === haystack). Empty-string semantics then make str_contains/str_*_with/strpos/strstr always succeed.

Assign-then-call and variable needles are fine — prefer fixing call-arg temp materialization over special-casing str_contains.

[PurHur]

claim: Lane A implementer — starting this run

Trust gates (pre-work):

• docker info: ok
• bootstrap-inventory --check: OK 6614/6614 (docker-exec)
• release-readiness --json: still running
• Language: after @expr, FilesystemIterator($path, CONST\|CONST) flags become bool (re-#18523, Zend/zend_compile.c) #24369 already claimed + branched by another Lane A run — taking next eligible language issue in lane (%3==0)

Implementing print_r(...true) as call-arg temp remapping (#24372).

[PurHur]

Merged via #24384

Verification

• VM/JIT/Zend: test/repro/issue_24372_print_r_call_arg_temp.php → false×8 + hay_len=23 needle_len=3 same=0
• CFG: str_contains needle ARG_SEND is LITERAL('zzz')
• PHPUnit: print_r_call_arg_literal_needle + #23354 call_arg_producer_* — OK (6)
• Peer: explode(PATH_SEPARATOR, get_include_path()) still OK under VM

Root cause: finalizeLeadingConstFetchFuncCallPreludeCallArgSlot treated nested print_r(..., true) like explode(CONST, f()) and remapped the outer literal needle onto the nested EXEC_RETURN.