Regression: nested array-return builtin in call argument evaluates to null (ext/standard/array.c, streams.c)

[PurHur]

Category

stdlib · compile lowering · php-src-strict

Problem

When a builtin that returns an array is used inline as an argument to another builtin, the nested expression evaluates to null instead of the returned array. Assigning the same call to a variable first works.

Affects array_keys(), array_values(), stream_get_filters(), and similar array-return builtins nested in in_array(), array_map(), etc.

php-src reference

• php/php-src Zend/zend_execute.c — ZEND_CALL / return-value consumption for nested calls
• php/php-src ext/standard/array.c — array_keys, array_values
• php/php-src ext/standard/streams.c — stream_get_filters

Repro

test/repro/maintainer_gap_nested_array_builtin_arg.php:

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php test/repro/maintainer_gap_nested_array_builtin_arg.php
php bin/vm.php test/repro/maintainer_gap_nested_array_builtin_arg.php'

Call	Zend	VM (bug)
in_array('a', array_keys($src), true)	true	TypeError: haystack null
in_array('string.rot13', stream_get_filters(), true)	true	TypeError: haystack null
$k = array_keys($src); in_array('a', $k, true) (control)	true	true

Scope (PHP-in-PHP)

Area	Path
VM call lowering	nested FUNCCALL return slot must survive as callee argument
Compiler	lib/Compiler.php / opcode emission for call-as-argument
Stdlib	no C runtime workaround — fix expression evaluation

Distinct from #9390 (enum needle + inline haystack + literal strict mis-bind).

Done when (php-src-strict)

• Repro matches Zend for nested array_keys and stream_get_filters
• count(explode(...)) and other nested non-array returns stay green
• Compliance guard under test/compliance/cases/stdlib/nested_array_builtin_arg.phpt

Links

North star #1492

[PurHur]

claim: cursor-agent-lane-b — starting this run (nested call-arg lowering / ZEND_CALL parity; compile lowering scope per issue body, not ext/standard builtin implementation)

[PurHur]

claim released: verified fixed on master — maintainer_gap_nested_array_builtin_arg.php prints true/true/true on VM matching Zend. Stale filing.

[PurHur]

Fixed by #11427 (shared nested call-arg producer guard regression from #11409). Repro maintainer_gap_nested_array_builtin_arg.php green on master.

[PurHur]

Closed via #11427 — nested array-return builtin call args now wire correctly on VM.