Language: nested ?? (concat/call-arg) on uninitialized typed property aborts — Zend BP_VAR_IS default (re-#31146, zend_object_handlers.c)

[PurHur]

Category

Language: · php-src-strict · nested ?? BP_VAR_IS

Problem

?? / ??= on an uninitialized typed property must use Zend BP_VAR_IS (quiet undefined → default), not a typed-property Error. Statement form $o->x ?? "d" already matches Zend (#31146). Nested forms — concat and function-arg — still compile/run as a normal read: VM prints the statement result then silently stops (exit 0, no Error, remaining echoes omitted). Same hole for static typed properties.

Probed 2026-08-17 — host Zend PHP 8.2 vs php bin/vm.php.

Repro	Zend 8.2+	VM (2026-08-17)
var_export($o->x ?? "d"); (statement)	'd' then continues	'd' then continues
"concat=" . var_export($o->x ?? "d", true)	concat='d' then after	no further output (rc 0)
take($o->x ?? "d")	arg=d then after	empty (rc 0)
S::$y ?? "d" statement	'd'	'd'
concat of S::$y ?? "d"	static_concat='d' then after	no further output (rc 0)

class C { public int $x; }
$o = new C;
echo "stmt="; var_export($o->x ?? "d"); echo "\n";
echo "concat=" . var_export($o->x ?? "d", true) . "\n"; // Zend 'd' / VM aborts
echo "after\n";

php-src reference

• php/php-src Zend/zend_vm_def.h — ZEND_COALESCE / FETCH_OBJ_IS / FETCH_STATIC_PROP_IS
• php/php-src Zend/zend_object_handlers.c — zend_std_has_property / zend_std_read_property with BP_VAR_IS (uninitialized typed slot is "unset", no Error)

PHP implementation target

• lib/Compiler.php — Language: ?? / ??= on uninitialized typed property throws Error — Zend BP_VAR_IS default (zend_object_handlers.c) #31146 only rewrites sibling PropertyFetch/StaticPropertyFetch immediately before BinaryOp\Coalesce. Extend the same IS-mode fetch to coalesce nested in concat / FuncCall args (resolvePropertyFetchCoalesceCallArgSlot exists but does not cover this CFG)
• lib/VM.php — copyPropertyValueForIsMode already implements BP_VAR_IS; do not add a C runtime branch
• php-in-PHP — no new runtime/*.c logic

Repro

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_uninit_typed_coalesce.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_uninit_typed_coalesce.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_uninit_static_coalesce.php'
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_uninit_coalesce_arg.php'

Done when

• Nested concat and call-arg ?? on uninitialized instance and static typed properties yield the default on VM (and JIT/AOT if in scope); remaining statements still run
• Statement ?? / ??= from Language: ?? / ??= on uninitialized typed property throws Error — Zend BP_VAR_IS default (zend_object_handlers.c) #31146 stay green (typed_prop_coalesce_uninit_31146.phpt)
• Bare read $o->x still Errors; isset/empty unchanged
• Compliance .phpt under test/compliance/cases/language/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: Worker lane B — starting this run (lane overflow; #31771 already claimed)

[PurHur]

note: Worker lane C — #31769 is lane-home (number % 3 == 2). Standing down this run because of the Lane B overflow claim: above. Status: #31776. If that overflow run does not push a branch/PR, Lane C will take it next.

[PurHur]

Merged #31778

Nested "prefix" . f($o->x ?? …) / static / call-arg ?? now yield the default and continue (Zend FETCH_OBJ_IS / FETCH_STATIC_PROP_IS). Statement ?? / ??= from #31146 stay green; bare $o->x still Errors.

Verification:

• php bin/vm.php test/repro/maintainer_gap_uninit_{typed,static,coalesce_arg}.php — concat/arg/after all print, rc 0
• ./script/phpunit.sh --filter TypedPropNestedCoalesce31769VMTest — OK (2 tests)
• ./script/phpunit.sh --filter TypedPropNestedCoalesce31769JITTest — OK (2 tests)