Disallow dynamic calls to assert()?

php.internals

Tim Düsterhus

1 year ago
Hi I noticed that dynamic calls to the `assert()` function do not take the `zend.assertions` into account, since for static calls `zend.assertions` is checked inside the compiler to completely bypass the call to `assert()` including the evaluation of all arguments. I created a PR to fix that, making dynamic calls to assert always return true just like static calls: https://github.com/php/php-src/pull/18521 However these dynamic calls still evaluate their arguments, which makes for a behavioral difference that might be confusing. Niels rightfully pointed out that it is possible to forbid dynamic calls to a given function, this is already used for things like `compact()` or `func_get_args()`. Disallowing dynamic calls to `assert()` would completely bypass this problem. Does anyone have an opinion either way? Please comment on the GitHub issue if you do so: https://github.com/php/php-src/pull/18521#pullrequestreview-2825782965 Best regards Tim Düsterhus

Gina P. Banyard

1 year ago
On Friday, 9 May 2025 at 08:35, Tim Düsterhus <tim@bastelstu.be> wrote:
> Hi > > I noticed that dynamic calls to the `assert()` function do not take the > `zend.assertions` into account, since for static calls `zend.assertions` > is checked inside the compiler to completely bypass the call to > `assert()` including the evaluation of all arguments. I created a PR to > fix that, making dynamic calls to assert always return true just like > static calls: > > https://github.com/php/php-src/pull/18521 > > However these dynamic calls still evaluate their arguments, which makes > for a behavioral difference that might be confusing. Niels rightfully > pointed out that it is possible to forbid dynamic calls to a given > function, this is already used for things like `compact()` or > `func_get_args()`. Disallowing dynamic calls to `assert()` would > completely bypass this problem. > > Does anyone have an opinion either way? Please comment on the GitHub > issue if you do so: > https://github.com/php/php-src/pull/18521#pullrequestreview-2825782965 > > Best regards > Tim Düsterhus
This makes sense to me, I don't really see why one would ever need to call assert dynamically. Is it possible to prevent retrieving a closure by using the FCC syntax at compile time? Best regards, Gina P. Banyard

Tim Düsterhus

1 year ago
Hi Am 2025-05-11 15:35, schrieb Gina P. Banyard:
> This makes sense to me, I don't really see why one would ever need to > call assert dynamically. > Is it possible to prevent retrieving a closure by using the FCC syntax > at compile time?
There was some disagreement on the PR about whether or not dynamic calls should be disallowed, thus changing it would require an RFC, which I'm not planning to do (too much effort for something users are unlikely to run into in the first place). Thus also not investigating whether or not an implementation would need to look like. I'll merge the PR making dynamic `assert()` a noop as a bugfix, though: https://github.com/php/php-src/pull/18521#issuecomment-2869905393 Best regards Tim Düsterhus