Regression: hash/hash_hmac(null $data) still coerce under PROFILE=8.4 — Zend TypeError (ext/hash/hash.stub.php)

[PurHur]

Category

Regression · php-src-strict · PHP 8.4 null→TypeError

Problem

hash() / hash_hmac() still accept null for $data under PHP_COMPILER_PROFILE=8.4 (DEP + hash of empty string) instead of TypeError as Zend 8.4+. Not covered by open string-null batches (#28885/#28875/…).

Verified 2026-08-08 with PHP_COMPILER_PROFILE=8.4 php bin/vm.php.

Repro	Zend 8.4+	VM PROFILE=8.4 (2026-08-08)
hash('sha1', null)	TypeError	DEP + da39a3ee5e6b4b0d3255bfef95601890afd80709
hash_hmac('sha1', null, 'k')	TypeError	DEP + hmac of ""

php-src reference

• php/php-src ext/hash/hash.stub.php — hash/hash_hmac string $data
• php/php-src ext/hash/hash.c

PHP implementation target

• PROFILE≥8.4 null reject on hash $data via shared string-arg guards in ext/hash / ext/standard PHP + JIT lowering; no new C runtime logic

Repro

PHP_COMPILER_PROFILE=8.4 ./script/docker-exec.sh -- bash -lc \
  'php bin/vm.php test/repro/maintainer_gap_hash_null_typeerror_84.php'

Done when

• hash('sha1', null) and hash_hmac('sha1', null, 'k') throw TypeError under PROFILE=8.4/8.5
• Compliance / repro guard
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

Gate probe + Zend cross-check (before claim)

Pillar 1 (this host, 2026-08-08): release-readiness --json → user_release_ready: yes; north-star5-fast ok; inventory via readiness OK 7238/7238.

Zend 8.4-cli (docker run --rm php:8.4-cli):

Deprecated: hash(): Passing null to parameter #2 ($data) of type string is deprecated
'da39a3ee5e6b4b0d3255bfef95601890afd80709'

Same soft-null + E_DEPRECATED as VM under PHP_COMPILER_PROFILE=8.4. Null→TypeError for non-nullable internal string args is PHP 9.0, not 8.4 (see php/php-src#6475).

Current ext/standard/hash_.php / hash_hmac.php already document this (#21181 / #21209; mistaken forward-profile TypeError was reverted). Not claiming — closing as invalid / not-a-bug would match php-src-strict. Leaving open for maintainer disposition.

[PurHur]

release claim / triage: invalid filing vs php-src-strict.

Zend ≤8.4 still soft-nulls non-nullable scalar internal args (E_DEPRECATED + coerce). TypeError is PHP 9.0 per RFC deprecate_null_to_scalar_internal_arg — same close rationale as #28885 / #28289 / #28252.

Evidence (this host, docker-exec, PHP 8.2.32 + PROFILE=8.4): matching builtins still DEP+coerce on both Zend and VM — forcing TypeError under PROFILE≥8.4 would regress php-src-strict.

Closing; do not re-file PROFILE=8.4 null→TypeError for soft-null internals.

[PurHur]

Closed: Done-when asks for TypeError that would regress php-src-strict (PHP 9). See #28885.