Make WordPress Core

Context Navigation

← Previous Change
Ticket History
Next Change →

Changes between Initial Version and Version 3 of Ticket #65919

Timestamp:: 08/20/2026 04:40:50 PM (2 months ago)
Author:: westonruter
Comment:

Legend:

: Unmodified
: Added
: Removed
: Modified

Ticket #65919
- Property Owner set to westonruter
- Property Status new → accepted

Ticket #65919 – Description

-              initial
+              v3
 }}}
+The function return value is a correct `string`. However, the value is then
+used as an array key in `WP_Hook::add_filter()`:
+The function return value is a correct `string`. However, the value is then used as an array key in `WP_Hook::add_filter()`:
 {{{#!php
 …
 }}}
+For a bare object, `$idx` is a canonical decimal string (`"5292"`), so PHP
+coerces it back to `int` on assignment. The `(string)` cast therefore does not
+achieve key-type consistency — it is nullified one layer down, at the point of
+storage.
+For a bare object, `$idx` is a canonical decimal string (`"5292"`), so PHP coerces it back to `int` on assignment. The `(string)` cast therefore does not achieve key-type consistency — it is nullified one layer down, at the point of storage.
+This affects bare-object callbacks only. `[ $obj, 'method' ]` yields
+`"5292method"`, and `Class::method` / function-name callbacks remain strings.
+This affects bare-object callbacks only. `[ $obj, 'method' ]` yields `"5292method"`, and `Class::method` / function-name callbacks remain strings.
 == Why the existing tests did not catch it ==
+The unit tests added in [62408] assert the **return type of the function**
+(string), object uniqueness, stability, and null for malformed input. They do
+not assert the **type of the resulting array key** in `WP_Hook::$callbacks`,
+which is where the coercion happens. A regression test should read back
+`array_keys( $wp_filter[ $hook ]->callbacks[ $priority ] )` and assert the key
+is a string.
+The unit tests added in [62408] assert the **return type of the function** (string), object uniqueness, stability, and null for malformed input. They do not assert the **type of the resulting array key** in `WP_Hook::$callbacks`, which is where the coercion happens. A regression test should read back `array_keys( $wp_filter[ $hook ]->callbacks[ $priority ] )` and assert the key is a string.
 == Steps to reproduce ==
 …
 }}}
+(`spl_object_id()` values are not deterministic across runs; the numbers above
+are illustrative.)
+(`spl_object_id()` values are not deterministic across runs; the numbers above are illustrative.)
 == Impact ==
+`WP_Hook::$callbacks` is a public property introspected by caching, profiling,
+and debugging plugins. Any consumer under `strict_types`, or passing the key to
+a `string`-typed parameter, now fatals. Confirmed in the wild: WP Rocket
+(`Cloudflare.php`, `substr()` on the key) broke immediately on 7.1.
+`WP_Hook::$callbacks` is a public property introspected by caching, profiling, and debugging plugins. Any consumer under `strict_types`, or passing the key to a `string`-typed parameter, now fatals. Confirmed in the wild: WP Rocket (`Cloudflare.php`, `substr()` on the key) broke immediately on 7.1.
 == Possible resolutions ==
+. Normalize the object branch to a non-numeric string (e.g. a short constant
+   prefix) so the key can never be coerced. This makes the existing `(string)`
+   cast actually effective. Trade-off: reintroduces a concat/allocation that
+   [62408] removed from the hot path.
+. Cast keys to string at the `WP_Hook` read/iteration boundaries.
+. Accept int keys as intended, document it on `@return` and on
+   `WP_Hook::$callbacks`, and treat consumers as responsible.
+In all cases, add a regression test asserting the **stored key type**, not just
+the function return type.
+Introduced in [62408]. Related: #64898.
+. Normalize the object