Language: instanceof with dynamic class name — TypeError for non-string operand (zend_execute.c parity)

[PurHur]

Category

language

Problem

Compile-time instanceof ClassName and union RHS (A|B) work (#138, #3461). For dynamic RHS $obj instanceof $className, Zend requires operand #2 to be a string (or valid class name string after coercion in legacy modes); passing an int/array/object raises TypeError.

This compiler's VM TYPE_INSTANCEOF always calls $frame->scope[$op->arg3]->toString() on the RHS without a type guard, which can silently stringify or mis-compare instead of throwing.

php-src reference

• php/php-src Zend/zend_execute.c — ZEND_INSTANCEOF / instance_of() type checks
• php/php-src Zend/zend_API.c — instanceof_function_ex()

Repro (failure today)

<?php
declare(strict_types=1);

class C {}
$o = new C();

try {
    var_export($o instanceof 123);
} catch (TypeError $e) {
    echo 'TypeError', "\n";
}

try {
    var_export($o instanceof []);
} catch (TypeError $e) {
    echo 'TypeError', "\n";
}

$name = 'C';
var_export($o instanceof $name);
echo "\n";

HARNESS_DOCKER_RUN_OPTS='--memory=8g --cpus=2' ./script/docker-exec.sh -- bash -lc '
  source script/php-env.sh
  php -r "...snippet above..."
  php bin/vm.php -r "...snippet above..."
'

Call	Zend PHP 8.x	This compiler VM (today)
$o instanceof 123	TypeError	may coerce/compare without TypeError
$o instanceof []	TypeError	may stringify / false without TypeError
$o instanceof $name ($name='C')	true	likely OK — keep working

Scope (this repo)

Module	Path
Compiler	lib/Compiler.php (instanceof lowering when RHS is non-literal)
VM	lib/VM.php (TYPE_INSTANCEOF, valueInstanceOfClassName)
JIT	lib/JIT.php (TYPE_INSTANCEOF branch)
Tests	test/compliance/cases/language/instanceof_dynamic_typeerror.phpt

Done when

• Non-string dynamic RHS (int, float, bool, array, object, resource) throws TypeError with Zend-compatible message.
• String variable / literal class names still resolve via autoload + extends chain (Language: instanceof operator for class checks #138).
• Union RHS (A|B) compile-time form unchanged (Language: instanceof with union types — (A|B) RHS (Zend zend_type.c parity) #3461).
• ./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/compliance/cases/language/instanceof_dynamic_typeerror.phpt' exits 0 (add PHPT).

[PurHur]

claim: php-compiler-worker-lane-b — starting this run

[PurHur]

claim: cursor-agent-lane-b — starting this run

[PurHur]

Merged via #6190.

Verification (green):

• vendor/bin/phpunit test/compliance/VMTest.php --filter language/instanceof_dynamic — OK
• vendor/bin/phpunit test/compliance/JITTest.php --filter language/instanceof_dynamic — OK
• vendor/bin/phpunit test/compliance/VMTest.php --filter language/instanceof_class — OK (regression)

Dynamic instanceof with int/array RHS now raises Error: Class name must be a valid object or a string (Zend parity); string variable class names still work.