Native parameter attributes may not be used on promoted properties

[TimWolla]

Description

The following code:

<?php

class Foo {
    public function __construct(
        #[SensitiveParameter]
        public string $password
    )
    {
        throw new \Exception('foo');
    }
}

new Foo('bar');

Resulted in this output:

Fatal error: Attribute "SensitiveParameter" cannot target property (allowed targets: parameter) in php-src/test.php on line 4

But I expected this output instead:

Fatal error: Uncaught Exception: foo in php-src/test.php:9
Stack trace:
#0 php-src/test.php(13): Foo->__construct(Object(SensitiveParameterValue))
#1 {main}
  thrown in /tmp/php-src/test.php on line 9

PHP Version

Current git master

Operating System

No response

[TimWolla]

This appears to be an oversight in the implementation of constructor promotion: 064b464#diff-85701127596aca0e597bd7961b5d59cdde4f6bb3e2a109a22be859ab7568b4d2R5948-R5951.

The implemented logic requires the attributes on promoted properties to be compatible with both PROPERTY and PARAMETER targets, whereas it likely should simply ignore the attribute if it can be applies to at least one of the two, but not the one that is currently checked.

The SensitiveParameter attribute is the first native PARAMETER / PROPERTY attribute, so that's likely why this is only noticed now.

[TimWolla]

@adoy @saundefined @ramsey I think this issue should be fixed for PHP 8.2 and ideally sooner rather than later, because it partly breaks one of the new PHP 8.2 features.

Looking at the code, it looks the fix is a little above my "pay grade", though (it's a non-obvious change). So bringing this to your attention as the RMs.

[ramsey]

I ran into this the other day, myself, but I somehow got around it, so I thought it was a non-issue.

I think this a bug in the implementation, and it should be fixed.

[pchapl]

Looks like the fix can be as easy as #9457