Repository navigation
Language: __toString throw continues try after concat/encapsed — sibling of #29521 (zend_operators.c) #29533
Description
Category
language · php-src-strict · __toString / exception control flow · pillar 4
Problem
Sibling of #29521 (echo/print/(string)): when __toString throws during . concatenation or double-quoted encapsed \"{$o}\", Zend transfers to catch and does not run the rest of the try body. VM/JIT still execute trailing statements (AFTER) after the user catch — same control-flow hole on the concat/encapsed opcodes.
Probed 2026-08-09 @ 95c9b7659b vs Zend 8.2.32. JIT matches VM.
| Repro | Zend 8.2.32 | VM / JIT |
|---|---|---|
try { $r = \"x\" . (new T()) . \"y\"; echo \"AFTER\n\"; } catch … |
caught then done (no AFTER) |
caught then AFTER / done |
try { echo \"x{$o}y\"; echo \"AFTER\n\"; } catch … |
no AFTER |
AFTER still prints |
Control: echo path tracked in #29521 |
— | — |
php-src reference
- php/php-src
Zend/zend_operators.c— concat / string conversion - php/php-src
Zend/zend_object_handlers.c—zend_std_cast_object_tostringexception path - Sibling open: Language: __toString throw continues try body after catch — echo/print/(string) (zend_object_handlers.c) #29521 (echo/print/(string) only)
- Related closed: Language: __toString() exceptions during string coercion must reach try/catch (zend_object_handlers.c parity) #4284, Language: encapsed {$obj} ignores __toString — dumps object / NULL concat (re-#13466, zend_operators.c) #26489 (encapsed ignored
__toString— different defect)
PHP implementation target
- VM + JIT: concat and encapsed string-conversion must abort the
trybody when__toStringthrows (same unwind as a normal throw) - Prefer fixing shared coercion/unwind used by Language: __toString throw continues try body after catch — echo/print/(string) (zend_object_handlers.c) #29521 rather than one-off opcode patches; PHP-in-PHP in
lib/VM/lib/JIT
Repro
./script/docker-exec.sh -- bash -lc 'cat > /tmp/tostring_concat.php <<'"'"'PHP'"'"'
<?php
error_reporting(E_ALL);
class T { public function __toString() { throw new Exception(\"t\"); } }
try {
$r = \"x\" . (new T()) . \"y\";
echo \"AFTER\n\";
} catch (Exception $e) { echo \"caught\n\"; }
echo \"done\n\";
PHP
php -d zend.exception_ignore_args=0 /tmp/tostring_concat.php
php -d zend.exception_ignore_args=0 bin/vm.php /tmp/tostring_concat.php
php -d zend.exception_ignore_args=0 bin/jit.php /tmp/tostring_concat.php'Done when
- VM + JIT:
.concat and encapsed\"{$obj}\"with throwing__toStringmatch Zend — catch runs, no trailingtrybody - No residual
NULLassign +AFTERafter catch - Compliance/.phpt or
test/repro/guard - php-src-strict; no php-compiler-strict shortcut
Activity
PurHur commentedon Aug 9, 2026
claim: lane-A language worker — starting this run (Pillar 1: release-readiness still running; inventory doc drift noted; continuing #29521 sibling for concat/encapsed __toString unwind)
PurHur commentedon Aug 9, 2026
Release claim — verified @
ae0bf85833(#29521 / #29537): concat + encapsed__toStringthrow now match Zend (catch, noAFTER) on VM and JIT.Shared
BuiltinCallbackCatchRedirectdeferral covers these opcodes. Done-when guards still missing (compliance/.phpt) — follow-up welcome; not starting that here.Switching to lane-A #29532 (object array key still wrong).
PurHur commentedon Aug 9, 2026
Maintainer verify (2026-08-09) @
092e9d1ee8vs Zend 8.2.32 — exact issue repro (concat + encapsed__toStringthrow,catch (Exception), noAFTER) is green on VM and JIT (matches Zend:caught/doneonly).Closing as fixed on master. Likely landed with the #29521 unwind fix family. Re-open with a failing snippet if you still see AFTER/continue.