Stdlib: substr_replace string/replace/offset/length named params (#23183)

ext/standard/JitSubstrReplace.php

@@ -110,16 +110,19 @@ public static function replace(
 
         $context->builder->positionAtEnd($prefixBlock);
         $prefixSlice = string_trim::jitCopySlice($context, $string, $strPtr, $zero64, $normOff, 'pre');
+        // jitCopySlice ends in a fresh continue block — use that as the PHI predecessor.
+        $prefixEndBlock = $context->builder->getInsertBlock();
         $context->builder->branch($afterPrefixBlock);
 
         $context->builder->positionAtEnd($skipPrefixBlock);
         $emptyPrefix = $context->builder->call($context->lookupFunction('__string__alloc'), $zero64);
+        $skipPrefixEndBlock = $context->builder->getInsertBlock();
         $context->builder->branch($afterPrefixBlock);
 
         $context->builder->positionAtEnd($afterPrefixBlock);
         $prefixPhi = $context->builder->phi($context->getTypeFromString('__string__*'));
-        $prefixPhi->addIncoming($prefixSlice, $prefixBlock);
-        $prefixPhi->addIncoming($emptyPrefix, $skipPrefixBlock);
+        $prefixPhi->addIncoming($prefixSlice, $prefixEndBlock);
+        $prefixPhi->addIncoming($emptyPrefix, $skipPrefixEndBlock);
 
         $withReplace = JitStringConcat::concat($context, $prefixPhi, $replace);
 
@@ -132,15 +135,17 @@ public static function replace(
         $context->builder->positionAtEnd($tailBlock);
         $tailSlice = string_trim::jitCopySlice($context, $string, $strPtr, $tailStart, $tailLen, 'tail');
         $result = JitStringConcat::concat($context, $withReplace, $tailSlice);
+        $tailEndBlock = $context->builder->getInsertBlock();
         $context->builder->branch($doneBlock);
 
         $context->builder->positionAtEnd($skipTailBlock);
+        $skipTailEndBlock = $context->builder->getInsertBlock();
         $context->builder->branch($doneBlock);
 
         $context->builder->positionAtEnd($doneBlock);
         $resultPhi = $context->builder->phi($context->getTypeFromString('__string__*'));
-        $resultPhi->addIncoming($result, $tailBlock);
-        $resultPhi->addIncoming($withReplace, $skipTailBlock);
+        $resultPhi->addIncoming($result, $tailEndBlock);
+        $resultPhi->addIncoming($withReplace, $skipTailEndBlock);
 
         return $resultPhi;
     }

lib/BuiltinParamNames.php

@@ -557,6 +557,9 @@ public static function forFunction(string $name): ?array
                 return ['pattern', 'flags'];
             case 'substr_compare':
                 return ['haystack', 'needle', 'offset', 'length', 'case_insensitive'];
+            // php-src ext/standard/string.stub.php — InternalArgInfo still says str/repl/start (#23183)
+            case 'substr_replace':
+                return ['string', 'replace', 'offset', 'length'];
             case 'file_exists':
             case 'filesize':
             case 'filemtime':

test/compliance/cases/stdlib/named_args_substr_replace.phpt

@@ -0,0 +1,19 @@
+--TEST--
+substr_replace named string/replace/offset/length arguments (VM, issue #23183)
+--FILE--
+<?php
+var_export(substr_replace(string: 'abcdef', replace: 'X', offset: 2, length: 1));
+echo PHP_EOL;
+var_export(substr_replace(string: 'abcdef', replace: 'X', offset: 2));
+echo PHP_EOL;
+$rf = new ReflectionFunction('substr_replace');
+foreach ($rf->getParameters() as $p) {
+    echo $p->getName(), PHP_EOL;
+}
+--EXPECT--
+'abXdef'
+'abX'
+string
+replace
+offset
+length

test/compliance/cases/stdlib/named_args_substr_replace_jit.phpt

@@ -0,0 +1,11 @@
+--TEST--
+substr_replace named string/replace/offset/length arguments (JIT, issue #23183)
+--FILE--
+<?php
+var_export(substr_replace(string: 'abcdef', replace: 'X', offset: 2, length: 1));
+echo PHP_EOL;
+var_export(substr_replace(string: 'abcdef', replace: 'X', offset: 2));
+echo PHP_EOL;
+--EXPECT--
+'abXdef'
+'abX'

test/fixtures/aot/cases/substr_replace_named_params.phpt

@@ -0,0 +1,9 @@
+--TEST--
+AOT: substr_replace() named string:/replace:/offset:/length: arguments (#23183)
+--FILE--
+<?php
+echo substr_replace(string: 'abcdef', replace: 'X', offset: 2, length: 1), "\n";
+echo substr_replace(string: 'abcdef', replace: 'X', offset: 2), "\n";
+--EXPECT--
+abXdef
+abX

test/repro/issue_23183_substr_replace_named.php

@@ -0,0 +1,13 @@
+<?php
+// Repro #23183 — substr_replace string:/replace:/offset:/length: named parameters (Zend stub names)
+$rf = new ReflectionFunction('substr_replace');
+$names = [];
+foreach ($rf->getParameters() as $p) {
+    $names[] = $p->getName();
+}
+$named = substr_replace(string: 'abcdef', replace: 'X', offset: 2, length: 1);
+$positional = substr_replace('abcdef', 'X', 2, 1);
+$ok = ['string', 'replace', 'offset', 'length'] === $names
+    && 'abXdef' === $named
+    && $named === $positional;
+echo $ok ? "ok\n" : "fail\n";

test/unit/BuiltinParamNamesAliasTest.php

@@ -799,4 +799,19 @@ public function testStrtotimeZendStubNamedParams(): void
         self::assertFalse(BuiltinParamNames::lookupNamedParamIndex($names, 'time', 'strtotime'));
         self::assertFalse(BuiltinParamNames::lookupNamedParamIndex($names, 'now', 'strtotime'));
     }
+
+    /** @covers issue #23183 */
+    public function testSubstrReplaceZendStubNamedParams(): void
+    {
+        $names = BuiltinParamNames::forFunction('substr_replace');
+        self::assertSame(['string', 'replace', 'offset', 'length'], $names);
+        self::assertSame(0, BuiltinParamNames::lookupNamedParamIndex($names, 'string', 'substr_replace'));
+        self::assertSame(1, BuiltinParamNames::lookupNamedParamIndex($names, 'replace', 'substr_replace'));
+        self::assertSame(2, BuiltinParamNames::lookupNamedParamIndex($names, 'offset', 'substr_replace'));
+        self::assertSame(3, BuiltinParamNames::lookupNamedParamIndex($names, 'length', 'substr_replace'));
+        // Legacy InternalArgInfo names must not resolve (Zend rejects $str / $repl / $start)
+        self::assertFalse(BuiltinParamNames::lookupNamedParamIndex($names, 'str', 'substr_replace'));
+        self::assertFalse(BuiltinParamNames::lookupNamedParamIndex($names, 'repl', 'substr_replace'));
+        self::assertFalse(BuiltinParamNames::lookupNamedParamIndex($names, 'start', 'substr_replace'));
+    }
 }