Skip to content

Language: object array key via new in try throws Illegal offset type (#29532) - #29539

Merged
PurHur merged 1 commit into
masterfrom
agent/issue-29532-illegal-offset-object-key
Aug 9, 2026
Merged

PurHur merged 1 commit into
masterfrom
agent/issue-29532-illegal-offset-object-key

Conversation

@PurHur

@PurHur PurHur commented Aug 9, 2026

Copy link
Copy Markdown
Owner

Summary

  • Inside try, $a[new T()] = … was writing key "" (null coerce) instead of throwing TypeError: Illegal offset type when the dim temp collided with a merge-echo phi slot.
  • Root cause: freshLiteralConstantSlot() on non-literals called forceFreshVarSlot() on the live new Temporary after TYPE_NEW had already stored the object — remapping left an empty dim slot.
  • Fix: literals still rematerialize; non-literal dims copy into a fresh temp (same pattern as MethodCall receivers / Language: throw from finally chains pending exception — regression vs closed #5486 (zend_exceptions.c) #5506).

Closes #29532

Test plan

  • Issue repro — Zend / VM / JIT identical:
    TypeError: Illegal offset type
    TypeError: Illegal offset type
    var TypeError: Illegal offset type
    done
    
    (test/repro/illegal_offset_object_key_new_in_try_29532.php; no TOSTRING / AFTER_*)
  • php vendor/bin/phpunit --filter IllegalOffsetObjectKeyNewInTryTest → OK (1 test, 4 assertions)
  • Compliance .phpt added: illegal_offset_object_key_new_in_try.phpt
  • Not run: full ci-local / compliance suite / --strict north-star

Trust gates before claim

./script/release-readiness.sh --json → user_release_ready: yes, north-star5-fast: ok

Made with Cursor

…29532)

Merge-echo phi collision remapped the live `new` temp after TYPE_NEW, so
the dim key became null→"" instead of TypeError. Copy non-literal dims
into a fresh slot like MethodCall receivers.

Co-authored-by: Cursor <cursoragent@cursor.com>
@PurHur
PurHur merged commit 23a0810 into master Aug 9, 2026
1 check failed
@PurHur
PurHur deleted the agent/issue-29532-illegal-offset-object-key branch August 9, 2026 20:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Language: object used as array key accepted — Zend TypeError Illegal offset type (zend_execute.c / zend_hash.c)

1 participant