Fix 'using null as an array offset is deprecated' on PHP 8.5 - #13
Merged
Conversation
In Line::concat() the two guards test the array before testing the index:
if ((isset($mSources[$fi])) && ($fi !== null)) {
`isset($mSources[$fi])` evaluates the offset first, so `$fi !== null` is
never reached with $fi null and the null check is unreachable. $fi and $ni
are null whenever a position has no source file or no name, which is
routine, and PHP 8.5 reports each occurrence.
Swapping the operands cannot change behaviour, since isset() on a null
offset is already false. Verified on 8.5: concat() output is byte-identical
before and after, and the test suite passes on 8.1 through 8.5.
imorland
force-pushed
the
fix-null-array-offset-php85
branch
from
August 5, 2026 11:45
049caf0 to
43054d1
Compare
imorland
added a commit
to flarum/framework
that referenced
this pull request
Aug 5, 2026
…on fix (#4904) `axy/sourcemap` 1.1.1 reorders the two guards in `Line::concat()` that read an array before checking the index is not null, which PHP 8.5 reports once per mapped position — hundreds of lines per request while compiling assets on a debug install (#4894, fixed upstream in axypro/sourcemap#13). `^1.1` already resolved to it, so this changes nothing for a fresh install. It is here to say so: the version we need is 1.1.1, not merely whatever 1.x resolves to today. Verified on PHP 8.5 that `JsCompiler`'s concat path no longer emits the notice, with byte-identical sourcemap output.
imorland
added a commit
to flarum/flarum-core
that referenced
this pull request
Aug 5, 2026
…on fix (#4904) `axy/sourcemap` 1.1.1 reorders the two guards in `Line::concat()` that read an array before checking the index is not null, which PHP 8.5 reports once per mapped position — hundreds of lines per request while compiling assets on a debug install (#4894, fixed upstream in axypro/sourcemap#13). `^1.1` already resolved to it, so this changes nothing for a fresh install. It is here to say so: the version we need is 1.1.1, not merely whatever 1.x resolves to today. Verified on PHP 8.5 that `JsCompiler`'s concat path no longer emits the notice, with byte-identical sourcemap output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Line::concat()tests the array before it tests the index:isset($mSources[$fi])evaluates the offset first, so with$finull the$fi !== nullcheck is never reached — it can't do anything.$fiand$niare null whenever a position has no source file or no name, which is routine, and PHP 8.5 reports every occurrence:Swapping the operands can't change behaviour, since
isset()on a null offset is already false.I found this in Flarum, where we concatenate a sourcemap per asset when building the frontend bundle. On a debug install with
display_errorson it's hundreds of lines per request — flarum/framework#4894 has the detail.Checks
concat()output is byte-identical before and after, same input.srcon 8.5. The 7 that remain are all inaxy/errorsandaxy/codecs-base64vlq, which I've mentioned in the issue.phpcsclean.Closes #12