Regression: SplDoublyLinkedList::offsetSet(null, $v) overwrites index 0 — Zend appends (ext/spl/spl_dllist.c)

[PurHur]

Category

Regression: · php-src-strict · SPL ArrayAccess null index = append

Problem

SplDoublyLinkedList::offsetSet(null, $value) (and $dll[] = $value / $dll[null] = $value) must append a new element (Zend). VM treats null as integer index 0 and overwrites the head — wrong length and wrong contents. Zend does not emit E_DEPRECATED for this null (append is intentional).

Related soft-null TypeErrors on offsetGet/offsetUnset/offsetExists/add(null) are siblings but distinct from this append rule.

Probed 2026-08-17 — host Zend PHP 8.2+ vs php bin/vm.php.

Repro	Zend 8.2+	VM (2026-08-17)
push a,b then offsetSet(null, 'NEW')	[0]=a [1]=b [2]=NEW count=3	[0]=NEW [1]=b count=2

php-src reference

• php/php-src ext/spl/spl_dllist.c — spl_dllist_object_write_dimension / null offset → push
• php/php-src ext/spl/spl_dllist.stub.php — offsetSet(mixed $index, mixed $value)

PHP implementation target

• ext/spl/ SplDoublyLinkedList::offsetSet — when $index === null, append (same as push); do not coerce null→0; PHP-in-PHP in ext/spl/, not new C runtime

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_dllist_offsetset_null_append.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_dllist_offsetset_null_append.php'

Done when

• offsetSet(null, …) appends on VM (count+1, value at end); dim-write $dll[] / $dll[null] agree
• Compliance .phpt guard under test/compliance/cases/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Compiler STD Lib Advanced — batch (#31722✅ #31723✅ #31730✅, now #31731)

SplDoublyLinkedList::offsetSet(null) append semantics (ext/spl/spl_dllist.c).

[PurHur]

Merged #31737 (or check latest PR from this branch)

Verification

• VM repro → [0]=a [1]=b [2]=NEW count=3
• PHPUnit Issue31731DllistOffsetSetNullAppendTest → OK (offsetSet + $dll[] / $dll[null])

[PurHur]

Confirmed merge: #31737