Repository navigation
AOT: preg_replace($stringLocal) returns empty array — TYPE_VALUE takes invokeArray (ext/pcre/php_pcre.c) #35059
Description
Category
bug · AOT wrong-output · preg_replace TYPE_VALUE subject · peer str_replace #23912
Problem
Thin-AOT preg_replace($pat, $rep, $subject) where $subject is a string local (JIT TYPE_VALUE) takes JitPregReplace::invokeArray because JitPregSubject::isStringOrCoercibleNullSubject only accepts TYPE_STRING. The array path yields array(); feeding that to base64_decode / string ops can SIGSEGV. Literal subjects still fold/lower correctly, so compile-time-looking green cases miss the bug.
| Repro | Zend / VM | AOT (master @ 38bf960, aot-smoke 8/8) |
|---|---|---|
preg_replace('/abc(\\d+)xyz/', '$1', 'abc123xyz') literal subject |
'123' |
'123' |
$h='abc123xyz'; preg_replace(..., $h) |
'123' |
array() |
mimeheader extract with $h subject |
'Y2Fmw6k=' |
array() (+ SIGSEGV if used as string) |
php-src reference
- php/php-src
ext/pcre/php_pcre.c—php_pcre_replace/Z_PARAM_STR_OR_ARRAY
PHP implementation target
ext/standard/preg_replace.php— same#23912guard asstr_replace: treatTYPE_VALUE+!JitStrReplaceSubject::isKnownArrayas stringish →invokeString. Mirror onpreg_filter/preg_replace_callbackif the same branch exists. No newruntime/*.c.
Repro
./script/aot-smoke.sh
./script/docker-exec.sh -- bash -lc 'php bin/compile.php -o /tmp/pr test/repro/aot_preg_b_varsubj.php && /tmp/pr'Done when
- AOT matches Zend/VM for string-local subjects
-
./script/aot-smoke.shstays 8/8 - Targeted phpunit guard green
claim: advanced-stdlib-ext — TYPE_VALUE string subject → invokeString (peer #23912)
Activity
AOT: preg_replace TYPE_VALUE string subject uses invokeString (#35059) (