Skip to content

Runtime: object array offset — isset()/array_key_exists() must TypeError (Illegal offset type) #6500

Closed

Description

@PurHur

Category

language | runtime

Problem

Using a plain object as an array lookup key must throw TypeError: Illegal offset type. This compiler emits an internal Unknown index type 5 (or similar) from hash-table helpers instead of a catchable Zend-compatible TypeError.

Distinct from #5853 (enum case write offsets) and #5755 (enum case lookup in builtins) — this is the general illegal offset type guard for arbitrary objects on read/exists paths.

php-src reference

Repro

<?php
class K {}
$a = [];
$a[new K] = 1; // may also need guard on write (separate from enum #5853)

try {
    var_export(array_key_exists(new K, $a));
} catch (Throwable $e) {
    echo get_class($e), ': ', $e->getMessage(), "\n";
}

try {
    var_export(isset($a[new K]));
} catch (Throwable $e) {
    echo get_class($e), ': ', $e->getMessage(), "\n";
}
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php -r "
class K {} \$a=[]; \$a[new K]=1;
try { array_key_exists(new K, \$a); } catch (Throwable \$e) { echo get_class(\$e), \": \", \$e->getMessage(); }
" 2>&1
'
Check Zend PHP 8.x bin/vm.php
array_key_exists(new K, $a) TypeError: Illegal offset type Unknown index type 5 ❌
isset($a[new K]) TypeError: Illegal offset type Unknown index type 5 ❌

php-src-strict

Scope

Path Work
lib/VM/HashTable.php (or offset helpers) Reject object keys with TypeError message matching Zend
ext/standard/array_key_exists.php / isset lowering Ensure guard before hash probe
lib/JIT/ Mirror guard in lowered isset / array_key_exists when in scope
Tests test/compliance/cases/language/illegal_offset_object.phpt

Done when

  • array_key_exists($obj, $arr), isset($arr[$obj]), and key_exists($obj, $arr) throw TypeError: Illegal offset type
  • Repro passes under php bin/vm.php inside script/docker-exec.sh
  • ./script/ci-fast.sh --filter illegal_offset_object green
  • No regression on int/string key paths

Related

Activity

  1. added
    enhancementNew feature or request
    area:vmVirtual machine
    implementation-readySpec complete: repro, php-src ref, done-when — safe for workers to claim
    on Jun 6, 2026
  2. PurHur commented on Jun 6, 2026

    @PurHur
    OwnerAuthor

    claim: worker-lane-c — starting this run

  3. PurHur commented on Jun 6, 2026

    @PurHur
    OwnerAuthor

    Merged via #6508.

    Verification:

    • Issue repro: array_key_exists(new K, $a), isset($a[new K]), key_exists(new K, $a) all throw TypeError: Illegal offset type (isset uses Illegal offset type in isset or empty).
    • vendor/bin/phpunit --filter illegal_offset_object test/compliance/VMTest.php — OK (1 test)
    • No regression on enum_illegal_array_offset compliance cases.

    Implementation: Extended EnumCaseSupport::rejectIllegalArrayOffset() for plain objects/arrays; aligned array_key_exists VM+JIT and JIT isset hashtable paths.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:vmVirtual machineenhancementNew feature or requestimplementation-readySpec complete: repro, php-src ref, done-when — safe for workers to claimphase-2:languagePhase 2 – language features

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions