Regression: DOMDocument::saveXML/saveHTML(int) treats $node as options — Zend TypeError ?DOMNode (ext/dom/document.c)

[PurHur]

Category

stdlib · php-src-strict · ext/dom

Problem

DOMDocument::saveXML() / saveHTML() accept a non-null non-DOMNode first argument on VM/JIT by treating a lone int/float as $options. Zend always types argument #1 as ?DOMNode and TypeErrors.

Repro	Zend 8.2+	VM/JIT (2026-08-16)
$doc->saveXML(1)	TypeError ?DOMNode, int given	serializes whole document (int→options)
$doc->saveXML(LIBXML_NOEMPTYTAG)	same TypeError	applies LIBXML_NOEMPTYTAG as options
$doc->saveHTML(1)	TypeError ?DOMNode, int given	serializes HTML
$doc->saveXML(null, LIBXML_NOEMPTYTAG)	expands empty tags	same (control)
$doc->saveXML("x")	TypeError string	TypeError (message wording differs)

Root cause: DomClassMethod::parseSaveNodeAndOptionsArgs() special-cases a single int/float as $options (comment cites #6140; that issue does not justify the coercion).

php-src reference

• php/php-src ext/dom/php_dom.stub.php — saveXML(?DOMNode $node = null, int $options = 0), saveHTML(?DOMNode $node = null)
• php/php-src ext/dom/document.c — dom_document_save_xml / save_html

PHP implementation target

• ext/dom/DomClassMethod.php — parseSaveNodeAndOptionsArgs() / saveSerializationOptionalDomNodeArg() — always treat arg1 as ?DOMNode; Zend-shaped TypeError
• ext/dom/VmDomJitDispatch.php + DomSaveXMLJitHelper.php — mirror nullable node check for JIT/AOT bridges

Repro

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/issue_dom_savexml_savehtml_node_typeerror.php'
./script/docker-exec.sh -- bash -lc 'php bin/jit.php test/repro/issue_dom_savexml_savehtml_node_typeerror.php'

Done when

• saveXML(1) / saveHTML(1) / saveXML(LIBXML_NOEMPTYTAG) TypeError like Zend (Argument #1 ($node) must be of type ?DOMNode, …)
• saveXML(null, LIBXML_NOEMPTYTAG) still works
• Compliance .phpt under test/compliance/cases/dom/
• php-src-strict; VM + JIT (AOT when bridge in scope)

[PurHur]

claim: PHP Compiler Ext — DOM & XML — starting this run

[PurHur]

Merged #31397

Verification

# VM / JIT repro (match Zend)
saveXML_int=TypeError:DOMDocument::saveXML(): Argument #1 ($node) must be of type ?DOMNode, int given
saveXML_libxml=TypeError:… int given
saveHTML_int=TypeError:DOMDocument::saveHTML(): Argument #1 ($node) must be of type ?DOMNode, int given
saveXML_string=TypeError:… string given
null_options=ok

vendor/bin/phpunit DomSaveXmlSaveHtmlNodeTypeerrorVMTest — OK
vendor/bin/phpunit DomSaveXmlSaveHtmlNodeTypeerrorJITTest — OK
AotTest --filter dom_childnode_after_before_replacewith_remove — OK

Did not change DomSaveXMLJitHelper (helper re-emit hit AOT module-verify noise on this host); VM + JIT + NestedJIT dispatch cover the TypeError path.