Regression: DOMDocument::loadHTML(File)/DOMNodeList::item excess argc silently accepted — Zend ArgumentCountError (ext/dom)

[PurHur]

Category

Regression · php-src-strict · excess argc · ext/dom

Problem

DOMDocument::loadHTML(), DOMDocument::loadHTMLFile(), and DOMNodeList::item() silently accept excess arguments on VM. Zend throws ArgumentCountError. Sibling class of closed ChildNode #30814 / XMLReader #30641; open peers XMLWriter #30818 / SimpleXML #30828.

Probed 2026-08-13 — host Zend PHP 8.2.32 vs VM @ fb52e8743e.

Repro	Zend 8.2.32	VM
(new DOMDocument)->loadHTML('<p>x</p>', 0, 'x')	ArgumentCountError: … at most 2 …, 3 given	ok (ACCEPTED)
->loadHTMLFile('/etc/hosts', 0, 'x')	… at most 2 …, 3 given	ACCEPTED
$d->getElementsByTagName('a')->item(0, 'x')	… exactly 1 …, 2 given	returns node (ACCEPTED)

Note: loadXML / saveHTML / createElement / appendChild already throw ACE on VM — only these HTML/NodeList entry points are soft.

php-src reference

• php/php-src ext/dom/document.c — dom_document_loadhtml / loadhtmlfile
• php/php-src ext/dom/nodelist.c — item
• php/php-src ext/dom/php_dom.stub.php

PHP implementation target

• ext/dom/DocumentLoadHTML.php, DocumentLoadHTMLFile.php (+ JitDomLoadHTML* / helpers)
• ext/dom/NodeListItem.php (+ JitDomNodeListItem*)
• Shared Zend-shaped argc guard; no new C in runtime/

Repro

./script/docker-exec.sh -- bash -lc 'php -r '\''=new DOMDocument(); try { ->loadHTML("<p>x</p>",0,"x"); echo "ACCEPTED\n"; } catch (Throwable ) { echo ->getMessage(),"\n"; }'\'''
./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r '\''=new DOMDocument(); try { ->loadHTML("<p>x</p>",0,"x"); echo "ACCEPTED\n"; } catch (Throwable ) { echo ->getMessage(),"\n"; }'\'''

Done when

• VM (+ JIT when wired): excess argc → Zend-shaped ArgumentCountError for loadHTML, loadHTMLFile, DOMNodeList::item
• Repro under test/repro/ + smallest compliance VM/JIT pair
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

Follow-up probe (same commit): DOMNamedNodeMap::item() / getNamedItem() also silently accept excess argc on VM (Zend ACE). Please include in the same fix batch as DOMNodeList::item — same defect class under ext/dom/NamedNodeMapItem.php / NamedNodeMapGetNamedItem.php.

[PurHur]

claim: PHP Compiler Ext — DOM & XML — starting this run

Picking #30835 (loadHTML/loadHTMLFile/NodeList::item + NamedNodeMap follow-up). Will mirror closed ChildNode #30814 / XMLReader #30641 argc guards.

[PurHur]

Merged #30842 (264ab0654c)

Verification

• Zend / bin/vm.php / bin/jit.php on test/repro/maintainer_gap_dom_loadhtml_nodelist_excess_argc_30835.php — identical ACE messages + legal arity still works
• vendor/bin/phpunit --filter DomLoadHtmlNodelistExcessArgc30835 — OK (2)
• Sibling --filter "DomChildNodeRemoveExcessArgc30814|DomExcessArgc30616" — OK (4)

Also covers follow-up NamedNodeMap::item / getNamedItem excess argc.