Fix var_export(array pointer) string-concat mis-bind (#13829)

lib/Compiler.php

@@ -17498,10 +17498,15 @@ private function slotForVarExportNestedInlineCallArg(
             return null;
         }
         $callArg = $cfgCallOp->args[$argIndex] ?? null;
-        if (
-            null === $callArg
-            || !$this->inlineCallArgProducerFeedsCallArgOp($candidate, $cfgCallOp, $callArg)
-        ) {
+        if (null === $callArg) {
+            return null;
+        }
+        $feedsCallArg = $this->inlineCallArgProducerFeedsCallArgOp($candidate, $cfgCallOp, $callArg)
+            || (
+                $this->callArgIsDeadInlineTemporary($callArg)
+                && ($candidate instanceof Op\Expr\FuncCall || $candidate instanceof Op\Expr\NsFuncCall)
+            );
+        if (!$feedsCallArg) {
             return null;
         }
         if (null === $block->slotForOperand($candidate->result)) {
@@ -21966,12 +21971,32 @@ protected function compileCallArgSends(
                         }
                     }
                 }
+                if (null !== $cfgCallOp && 0 === (int) $argIndex) {
+                    $varExportOps = [];
+                    $varExportSlot = $this->slotForVarExportNestedInlineCallArg(
+                        $block,
+                        $cfgCallOp,
+                        (int) $argIndex,
+                        $varExportOps
+                    );
+                    if (null !== $varExportSlot) {
+                        if ([] !== $varExportOps) {
+                            $sends = array_merge($sends, $varExportOps);
+                        }
+                        $valueSlot = (string) $varExportSlot;
+                    }
+                }
                 if (
                     $this->callArgIsDeadInlineTemporary($arg)
                     && !$comparisonFeedsCallArg
                     && !$this->callArgOperandExpectsArrayProducer(
                         $cfgCallOp->args[(int) $argIndex] ?? $arg
                     )
+                    && !(
+                        null !== $cfgCallOp
+                        && 'var_export' === $this->resolveCfgFuncCallName($cfgCallOp)
+                        && 0 === (int) $argIndex
+                    )
                 ) {
                 $callArgProbe = $cfgCallOp->args[(int) $argIndex] ?? $arg;
                 foreach ($trailingProducers as $producer) {
@@ -22022,21 +22047,6 @@ protected function compileCallArgSends(
                     $valueSlot = $mergeTrailingSlot;
                 }
             }
-            if (null !== $cfgCallOp && 0 === (int) $argIndex) {
-                $varExportOps = [];
-                $varExportSlot = $this->slotForVarExportNestedInlineCallArg(
-                    $block,
-                    $cfgCallOp,
-                    (int) $argIndex,
-                    $varExportOps
-                );
-                if (null !== $varExportSlot) {
-                    if ([] !== $varExportOps) {
-                        $sends = array_merge($sends, $varExportOps);
-                    }
-                    $valueSlot = (string) $varExportSlot;
-                }
-            }
             if (
                 null !== $cfgCallOp
                 && null !== $block->orig
@@ -23075,12 +23085,51 @@ private function cfgCallImmediatelyFeedsAdjacentConsumer(?Op $cfgCallOp, Block $
             return false;
         }
 
-        return $this->isAdjacentNestedFuncCallProducer(
+        if ($this->isAdjacentNestedFuncCallProducer(
             $cfgCallOp,
             $consumer,
             $producerIndex,
             $consumerIndex
-        );
+        )) {
+            return true;
+        }
+
+        return $this->siblingFuncCallFeedsVarExportConsumer($cfgCallOp, $block, $producerIndex);
+    }
+
+    /**
+     * php-cfg `var_export(key($a), true)` hoists key() sibling; ConstFetch `true` may sit between (#13829).
+     */
+    private function siblingFuncCallFeedsVarExportConsumer(Op $cfgCallOp, Block $block, int $producerIndex): bool
+    {
+        if (!$this->isSiblingInlineCallProducerExpr($cfgCallOp)) {
+            return false;
+        }
+        $cfgChildren = $block->orig->children;
+        for ($i = $producerIndex + 1, $n = \count($cfgChildren); $i < $n; ++$i) {
+            $child = $cfgChildren[$i];
+            if (
+                $child instanceof Op\Expr\ConstFetch
+                || $child instanceof Op\Expr\ClassConstFetch
+                || $child instanceof Op\Expr\Array_
+            ) {
+                continue;
+            }
+            if (
+                !$child instanceof Op\Expr\FuncCall
+                && !$child instanceof Op\Expr\NsFuncCall
+            ) {
+                return false;
+            }
+            if ('var_export' !== $this->resolveCfgFuncCallName($child)) {
+                return false;
+            }
+            $callArg = $child->args[0] ?? null;
+
+            return null !== $callArg && $this->callArgIsDeadInlineTemporary($callArg);
+        }
+
+        return false;
     }
 
     /**

test/compliance/cases/stdlib/array_pointer_var_export_concat.phpt

@@ -0,0 +1,13 @@
+--TEST--
+stdlib array pointer builtins in var_export concat (#13829, ext/standard/array.c)
+--FILE--
+<?php
+$a = [1, 2, 3];
+next($a);
+echo 'key=' . var_export(key($a), true), "\n";
+echo 'current=' . var_export(current($a), true), "\n";
+echo 'end=' . var_export(end($a), true), "\n";
+--EXPECT--
+key=1
+current=2
+end=3

test/repro/maintainer_gap_key_concat_operand.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+$a = [1, 2, 3];
+next($a);
+
+$concat = 'key=' . var_export(key($a), true);
+
+if ('key=1' !== $concat) {
+    fwrite(STDERR, "concat key: expected key=1, got {$concat}\n");
+    exit(1);
+}
+
+echo "ok\n";

test/unit/InlineCallArgProducerSlotTest.php

@@ -2251,6 +2251,25 @@ public function testVarExportNestedBuiltinDualTrueLiteralUsesFuncCallProducerSlo
         self::assertSame('true', $out);
     }
 
+    /** Issue #13829 — var_export(key($a), true) in concat wires hoisted key() sibling, not ConstFetch true. */
+    public function testVarExportNestedArrayPointerBuiltinUsesFuncCallProducerSlot(): void
+    {
+        $code = <<<'PHP'
+<?php
+$a = [1, 2, 3];
+next($a);
+$concat = 'key=' . var_export(key($a), true);
+echo $concat, "\n";
+PHP;
+        $runtime = new Runtime();
+        $block = $runtime->parseAndCompile($code, 'var_export_nested_array_pointer.php');
+
+        ob_start();
+        $runtime->run($block);
+        $out = ob_get_clean();
+        self::assertSame("key=1\n", $out);
+    }
+
     /** Issue #11400 — print_r(in_array(..., true), true) wires nested FuncCall + dual ConstFetch true slots. */
     public function testPrintRNestedBuiltinDualTrueLiteralUsesFuncCallProducerSlot(): void
     {