Stdlib: parse_str() nested bracket keys — VM Refcount abort regression (#6013 follow-up) #6521

Category

stdlib · php-src-strict | runtime

Problem

parse_str() with nested bracket notation (b[c]=2&b[d][]=3&b[d][]=4) aborts the VM with:

Refcount is > 1, but was asserted to be 1

instead of building the nested array Zend returns. #6013 closed the JIT/AOT/php-in-PHP micro-runtime path; VM VmParseStr::mergeInto() is still broken for nested keys + list append.

This blocks query-string parsing in web/runtime code (#5965, #5330).

php-src reference

• php/php-src ext/standard/parse_str.c — PHP_FUNCTION(parse_str), php_parse_str()
• Nested key walk: bracket segments + [] list append semantics

Repro (verified 2026-06-06)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php test/repro-maintainer/parity_parse_str_brackets_regression.php
php bin/vm.php test/compliance/cases/stdlib/parse_str_brackets.phpt
php -r "\$o=[]; parse_str(\"a=1&b[c]=2&b[d][]=3&b[d][]=4\",\$o); var_export(\$o);"
'

Scope (this repo) — PHP-in-PHP first

php-src-strict

• Match Zend nested structure and scalar/list typing exactly
• Enum case variable names → TypeError (separate guard family; do not regress while fixing merge)

Done when

• Repro + test/compliance/cases/stdlib/parse_str_brackets.phpt green on VM
• No refcount abort on nested bracket + [] append keys
• ./script/ci-fast.sh --filter parse_str_brackets green
• JIT/AOT compliance row green when php-in-php: parse_str() JIT — delete __phpc_parse_str_* LLVM micro-runtime (phase 2 of #6013) #6308 aligns lowering (optional same PR if trivial)

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php test/compliance/cases/stdlib/parse_str_brackets.phpt
vendor/bin/phpunit --filter parse_str_brackets
'

Related

• php-in-php: parse_str() JIT/AOT — delete lib/AOT/runtime/phpc_parse_str.c, share VmParseStr PHP semantics #6013 (closed) JIT path · php-in-php: parse_str() JIT — delete __phpc_parse_str_* LLVM micro-runtime (phase 2 of #6013) #6308 delete JIT micro-runtime · Stdlib: request_parse_body() — PHP 8.4 HTTP body parser without superglobals (ext/standard/http.c) #5965 request_parse_body · Epic: Self-host critical path — compiler compiles itself (M3→M5) #1492