Language: isset/unset on inaccessible private props skip __isset/__unset (re-#3298, zend_object_handlers.c)

[PurHur]

Category

Language · php-src-strict · magic property visibility (regression vs #3298)

Problem

When a property is declared private/protected but not visible from the calling scope, Zend still routes isset / empty / unset through __isset / __unset. The VM treats the declared slot as present and skips magic (and for unset, silently no-ops).

Probed 2026-07-31 on host PHP 8.2 vs php bin/vm.php (same tree):

Repro	Zend 8.2	VM
isset($a->x) on private $x + __isset	prints ISSET_x, then true	true only (no __isset)
unset($a->x) on private $x + __unset	prints UNSET_x	no __unset
same class, isset from subclass method on protected $x	uses real property (true)	same
outside isset on protected $x + __isset returning false	ISSET_x / false	true (no magic)

Note: __get on the same private property does fire (parity OK) — only the has/unset paths are wrong.

php-src reference

• php/php-src Zend/zend_object_handlers.c — zend_std_has_property, zend_std_unset_property (visibility failure → magic)
• Prior: Language: __isset / __unset magic methods — isset() and unset() on objects (Zend parity) #3298 (closed) — basic missing-property __isset/__unset; this is the inaccessible declared property path

PHP implementation target

• lib/VM/ObjectEntry.php / lib/VM.php — TYPE_ISSET / TYPE_UNSET / empty on object dims: if property exists but is not visible from current scope, dispatch __isset/__unset instead of reading the private slot or no-op
• Keep PHP-in-PHP; no new runtime/*.c logic
• Compliance: test/compliance/cases/language/magic_isset_inaccessible.phpt (and unset twin)

Repro

./script/docker-exec.sh -- bash -lc 'cat > /tmp/isset_priv.php <<'"'"'PHP'"'"'
<?php
class A {
  private $x = 1;
  public function __isset($n) { echo "ISSET_$n\n"; return true; }
  public function __unset($n) { echo "UNSET_$n\n"; }
}
$a = new A();
var_export(isset($a->x)); echo "\n";
unset($a->x);
PHP
php bin/vm.php /tmp/isset_priv.php'

Done when

• Outside-scope isset/empty on private/protected declared props call __isset with Zend truth table
• Outside-scope unset calls __unset (no silent no-op; no private-slot leak)
• Subclass/in-scope access still uses the real property (no spurious magic)
• Compliance PHPT guard; php-src-strict; VM (+ JIT if in scope) match Zend

[PurHur]

claim: lane-B implementer — starting this run

[PurHur]

Merged #25705 (af6f905b)

Verification

Issue repro (VM):

ISSET_x
true
UNSET_x

Without __unset: Cannot access private/protected property …; magic unset leaves private slot intact (value=1).

vendor/bin/phpunit --filter 'magic_isset|magic_unset' test/compliance → OK (12 tests, VM+JIT) including new magic_isset_inaccessible / magic_unset_inaccessible.

Not covered

JIT-specific lowering beyond compliance JITTest path; helper-runtime prelink staleness on master (unrelated).