Regression: strcspn("",) with NUL in haystack returns full length on PROFILE=8.2 — Zend stops at NUL (ext/standard/string.c) #27716

Category

bug · php-src-strict · PHP_COMPILER_PROFILE=8.2 · PHP 8.4 UPGRADING leak · pillar 4

Problem

PHP 8.4 changed strcspn() so an empty $characters returns the full string length even when the haystack contains a NUL byte (previously it stopped at the first NUL). Under PHP_COMPILER_PROFILE=8.2, VM/JIT still apply the 8.4 semantics, so they diverge from Zend 8.2. Verified 2026-08-05 vs host Zend 8.2.32.

php-src reference

• php/php-src ext/standard/string.c — PHP_FUNCTION(strcspn)
• php/php-src UPGRADING (8.4) — empty $characters no longer stops at NUL
• Gate the 8.4 length-of-string behavior behind languageProfileVersion() >= 8.4; keep Zend 8.2 NUL-stop on PROFILE=8.2

PHP implementation target

• ext/standard / string strcspn PHP port + shared JIT helper — profile-gate NUL/empty-mask behavior
• Reuse existing profile helpers (CompilerVersion::languageProfileVersion()); no new runtime/*.c

Repro

./script/docker-exec.sh -- bash -lc '
cat > /tmp/strcspn_nul.php <<'"'"'PHP'"'"'
<?php
echo strcspn("ab\0c", ""), "\n";
echo strcspn("abc", ""), "\n";
PHP
echo ZEND:; php /tmp/strcspn_nul.php
echo VM82:; PHP_COMPILER_PROFILE=8.2 php bin/vm.php /tmp/strcspn_nul.php
echo VM84:; PHP_COMPILER_PROFILE=8.4 php bin/vm.php /tmp/strcspn_nul.php
'

Done when

• Under PHP_COMPILER_PROFILE=8.2, strcspn("ab\0c", "") prints 2 matching Zend 8.2 (VM + JIT)
• Under PHP_COMPILER_PROFILE=8.4 (or default 8.4.0-dev), same call prints 4 (php-src 8.4)
• Compliance .phpt guards both profiles; php-src-strict; no php-compiler-strict shortcut

Gate context (2026-08-05)

• bootstrap-inventory --check → OK 7009/7009
• bootstrap-selfhost-link → OK (gen-0 sidecar emit fallback)
• release-readiness --json → user_release_ready: yes (north-star5-fast ok)