Regression: setcookie(..., null) $expires_or_options under strict_types succeeds — Zend TypeError (ext/standard/head.c)

[PurHur]

Category

stdlib · php-src-strict

Problem

Under declare(strict_types=1), setcookie($name, $value, null) must TypeError on array|int $expires_or_options. VM coerces/@-suppresses and returns true. Related closed work (#21735) fixed wrong DEP parameter index under soft typing; this is the strict_types TypeError gap. Check setrawcookie twin when fixing.

Repro	Zend 8.2.32 (2026-08-15)	VM (2026-08-15)
declare(strict_types=1); setcookie('n', 'v', null)	`TypeError: setcookie(): Argument #3 ($expires_or_options) must be of type array	int, null given`

php-src reference

• php/php-src ext/standard/head.c — PHP_FUNCTION(setcookie)
• php/php-src ext/standard/head.stub.php — setcookie(string $name, string $value = "", array|int $expires_or_options = 0, ...): bool

PHP implementation target

• ext/standard/setcookie.php / SetcookieOptions.php / JitSetcookieOptions — under caller strict_types, null $expires_or_options → TypeError (same for setrawcookie if shared parse)
• No new C in runtime/

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_setcookie_null_expires.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_setcookie_null_expires.php'

Inline:

<?php
declare(strict_types=1);
error_reporting(E_ALL);
try {
    var_export(@setcookie('n', 'v', null));
    echo "\n";
} catch (Throwable $e) {
    echo get_class($e) . ': ' . $e->getMessage() . "\n";
}

Done when

• VM/JIT/AOT under strict_types match Zend TypeError for setcookie(..., null) $expires_or_options
• setrawcookie twin checked/fixed if shared path
• Compliance .phpt guard under test/compliance/cases/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: Worker Lane C — starting this run

[PurHur]

Merged via #31305

Verification: Zend/VM/JIT/AOT all emit TypeError: setcookie(): Argument #3 ($expires_or_options) must be of type array|int, null given under declare(strict_types=1). Soft DEP retained outside strict. Twin setrawcookie covered (#31286). ./script/phpunit.sh --filter SetcookieNullExpires31229 → OK (3 tests).