Regression: SimpleXML methods/import excess argc silently accepted — Zend ArgumentCountError (ext/simplexml/sxe.c)

[PurHur]

Category

Regression · php-src-strict · excess argc · ext/simplexml

Problem

Several SimpleXMLElement methods and SimpleXML procedural helpers silently accept excess arguments on VM. Zend throws ArgumentCountError. Same defect class as XMLWriter #30818 / DOM ChildNode #30814 / XMLReader #30641.

Probed 2026-08-13 — host Zend PHP 8.2.32 vs VM @ 9ea9b2ae8e.

Repro	Zend 8.2.32	VM
$x->children(null, false, 1)	ArgumentCountError: … at most 2 …, 3 given	ACCEPTED (object)
$x->attributes(null, false, 1)	… at most 2 …, 3 given	ACCEPTED
$x->xpath('//a', 1)	… exactly 1 …, 2 given	ACCEPTED (array)
$x->registerXPathNamespace('a','urn:a',1)	… exactly 2 …, 3 given	ACCEPTED
$x->addChild('a','b',null,1)	… at most 3 …, 4 given	ACCEPTED
$x->addAttribute('a','b',null,1)	… at most 3 …, 4 given	ACCEPTED
dom_import_simplexml($x, 1)	… exactly 1 …, 2 given	ACCEPTED (DOMElement)
simplexml_import_dom($d, null, 1)	… at most 2 …, 3 given	ACCEPTED
simplexml_load_string('<r/>', 'SimpleXMLElement', 0, '', false, 1)	… at most 5 …, 6 given	ACCEPTED

php-src reference

• php/php-src ext/simplexml/sxe.c
• php/php-src ext/simplexml/simplexml.c
• php/php-src ext/simplexml/simplexml.stub.php

PHP implementation target

• ext/simplexml/SimpleXmlElementChildren.php, SimpleXmlElementAttributes.php, SimpleXmlElementXpath.php, SimpleXmlElementRegisterXPathNamespace.php, SimpleXmlElementAddChild.php, SimpleXmlElementAddAttribute.php
• ext/simplexml/simplexml_load_string.php, simplexml_import_dom.php, + dom_import_simplexml bridge
• Shared Zend-shaped argc guard (not LogicException); JIT call helpers under lib/JIT/Call/SimpleXMLElement* if invoke skips VM objects

Repro

./script/docker-exec.sh -- bash -lc 'php -r '\''$x=simplexml_load_string("<r><a/></r>"); try { $x->children(null,false,1); echo "ACCEPTED\n"; } catch (Throwable $e) { echo $e->getMessage(),"\n"; }'\'''
./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r '\''$x=simplexml_load_string("<r><a/></r>"); try { $x->children(null,false,1); echo "ACCEPTED\n"; } catch (Throwable $e) { echo $e->getMessage(),"\n"; }'\'''

Done when

• VM (+ JIT when wired): excess argc → Zend-shaped ArgumentCountError for the probed methods/helpers (and siblings with fixed arity)
• Repro under test/repro/ + smallest compliance VM/JIT pair
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler Ext — DOM & XML — starting this run

Gates this session (running): docker-exec bootstrap-selfhost-link, bootstrap-inventory --check, release-readiness --json.

[PurHur]

Merged via PR #30978.

Fix: SimpleXML methods and import/load helpers throw Zend-shaped ArgumentCountError on excess user argc (php-src ext/simplexml/simplexml.stub.php / ext/dom/php_dom.stub.php). JIT/AOT instance-method proxies emit a catchable ACE.

Verification:

php bin/vm.php test/repro/maintainer_gap_simplexml_excess_argc_30828.php
# matches Zend 8.2.32; legal path ok=r,3,r

./script/phpunit.sh --filter SimpleXmlExcessArgc30828
# OK (2 tests, 2 assertions) VM + JIT

php script/bootstrap-inventory.php --check
# OK 7431/7431 after merge