ArrayObject - undocumented AllowDynamicProperties?

[ondrejmirtes]

Description

The following code:

<?php

$obj = new \ArrayObject([
  'abc' => true,
], \ArrayObject::ARRAY_AS_PROPS);

var_dump($obj->abc);

Resulted in this output:

bool(true)

But I expected this output instead:

Warning: Undefined property: ArrayObject::$abc

The PHP RFC "Deprecate dynamic properties" says that only stdClass, classes with magic __get/__set methods, and classes marked as #[AllowDynamicProperties] are allowed to have dynamic properties.

But ArrayObject is none of those:

• https://www.php.net/manual/en/class.arrayobject.php
• https://github.com/php/php-src/blob/5820528c9c25012ad763576c7120414eb12a05f0/ext/spl/spl_array.stub.php#L5

So what are the rules about dynamic properties? Are there any other cases where they are allowed that I'm unaware of?

Please understand I'm asking from the point of a static analyser developer, to be able to describe these cases. I get it it's useful to have ArrayObject to allow them, but I need the rules to describe this behaviour.

Thank you.

PHP Version

PHP 8.2

Operating System

No response

[damianwadley]

ArrayObject implements an internal equivalent to the __get/set/etc. methods. In other words, property access doesn't go through the normal paths that are affected by this RFC.

This will also apply to other classes that override property access behaviors, such as SimpleXMLElement.

Not sure if there's anything that needs to be added to the docs about this: it's not really a userland concern exactly how ArrayObject or SimpleXMLElement work as long as the ->property syntax works...

Regarding phrasing in the RFC: it was aimed more towards userland classes than literally all classes within PHP. It would be more accurate to say that the default property handlers were updated to disallow dynamic properties, and thus that classes using those handlers are the ones that will be affected by the new rules.

edit: For PHPStan, short of a whitelist of classes that support dynamic properties (if not otherwise known) it could be difficult to support rules on built-in classes without some number of false positives. But applying rules to userland classes, at least, should be safe.

[iluuu1994]

These are the relevant handlers that are overwritten:

https://github.com/php/php-src/blob/6a2d04151a0e6416db3b7d877110cca03c7ac81e/ext/spl/spl_array.c#L1902-L1906

You could search for these in the PHP source code to understand what classes have special behavior. You might also want to search for zend_object_handlers .* = \{ as sometimes designated initializers with positional members are used.