Language: ReflectionClass::getMethods() exposes parent private methods on child class (ext/reflection/php_reflection.c, php-src-strict)

[PurHur]

Category

language | stdlib

Problem

ReflectionClass::getMethods() on a child class must not include private methods declared on the parent (php-src filters by declaring-class visibility rules). This compiler lists them today, breaking PHPUnit filters, DI scanners, and serialization metadata that rely on Zend-accurate method sets.

Umbrella/filter flags: #4480. This issue is the inheritance private-leak repro only — implement here or as first slice of #4480.

php-src reference

• php/php-src ext/reflection/php_reflection.c — zim_ReflectionClass_getMethods, add_reflection_method_sub
• php/php-src ext/reflection/tests/ReflectionClass_getMethods_001.phpt

Repro (failure today — verified 2026-06-07)

<?php
declare(strict_types=1);

class A {
    public function pubA(): void {}
    protected function protA(): void {}
    private function privA(): void {}
    public static function statA(): void {}
}
class B extends A {
    public function pubB(): void {}
    private function privB(): void {}
}

$r = new ReflectionClass(B::class);
$names = array_map(fn ($m) => $m->getName(), $r->getMethods());
sort($names);
var_export($names);
echo "\n";

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php repro_reflection_getmethods_private.php > /tmp/zend.txt
php bin/vm.php repro_reflection_getmethods_private.php > /tmp/vm.txt
diff -u /tmp/zend.txt /tmp/vm.txt
'

Runtime	$names includes privA?
Zend PHP 8.x	no (parent private hidden on child)
bin/vm.php	yes — ['privA','privB','protA','pubA','pubB','statA'] observed

Scope (this repo)

Layer	Path
VM reflection	ext/standard/VmReflection.php — skip parent-private entries when $ce !== declaring class
Class tables	lib/VM/ClassEntry.php method metadata (declaring class + visibility)
Tests	test/compliance/cases/stdlib/reflection_class_getmethods_private.phpt

PHP-in-PHP: walk CE tables in PHP; no new C reflection shims (#5301).

Done when

• Repro var_export matches Zend exactly (no privA on ReflectionClass(B::class))
• Child-private privB still listed; protected/public inherited methods still listed
• ./script/ci-fast.sh --filter reflection_class_getmethods_private green
• Unblocks Stdlib: ReflectionClass::getMethods() — filter flags + inheritance/visibility parity (ext/reflection/php_reflection.c) #4480 filter-flag work

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter reflection_class_getmethods_private'

Links

• Stdlib: ReflectionClass::getMethods() — filter flags + inheritance/visibility parity (ext/reflection/php_reflection.c) #4480 filter flags · Stdlib: ReflectionClass inheritance API — isSubclassOf/implementsInterface/isInstance/getParentClass/… missing (ext/reflection/php_reflection.c) #6302 inheritance API · Epic: Self-host critical path — compiler compiles itself (M3→M5) #1492

[PurHur]

claim: worker-lane-a — starting this run

[PurHur]

Merged via #7196.

Fix: collectClassMethodsForReflection() in ext/standard/VmReflection.php now skips private methods whose declaring class is not the reflected class (php-src add_reflection_method_sub parity).

Verification:

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter reflection_class_getmethods_private'
# OK (1 test, 1 assertion)

Issue repro: ReflectionClass(B::class)->getMethods() no longer includes parent privA; child privB and inherited public/protected/static methods still listed. Zend vs VM diff matches exactly.