I release a new version of Xdebug on Sunday, which fixes a few bugs. One of them is titled emoji character become diamond question marks. This bug turned out to be the same as var_dump does not output some Russian characters, which was originally reported a few days earlier but hadn't come with a decent enough reproducible case.

At first I dismissed this, as it's not unlikely that people get their character sets wrong, or mixed up.

But when I tested it, the following script really did not show the right result:

Instead of the expected:

Standard input code:3:string
'hello ' (length=10)

It showed:

Standard input code:3:string
'hello ���' (length=10)

The four bytes that should have made up the had turned into three.

Xdebug uses a function, xdebug_xmlize, to escape XML and XHTML-special characters such as ", &, and < when it outputs strings of data.

Its algorithm first calculates how much memory the resulting string would use by looping over the source characters, and adding the lengths of the escaped characters together. It uses a 256-entry table for this.

The first row shows that byte 0's escaped length will be 4 (for �) and the LF character's escaped length will be 5 (for ).

The replacement strings are recorded in the table that follows. It only has place for 64 elements, as none of the bytes above byte-64 need to be escaped. You can see that because the xml_encode_count table only has entries containing 1 after the fourth 16-element row.

Then in a second iteration it loops over all the source characters again to construct the resulting output.

In this iteration, it checks if the destination length is 1, in which case it just copies the character over. If the destination length is not 1, then it adds the number of characters that correspond to the destination character's length.

The bug here was that the table for xml_encode_count, although it was defined as having 256 entries, only had 240 entries. I had missed to add the 16th line, so instead there were only 15 lines of 16 elements.

And in C, that means that these missing elements were all set to 0. This meant that if there was a character in the source string where the byte value was larger or equal to hexadecimal 0xF0 (decimal: 240), the algorithm thought the replacement length of these characters would be 0. This then resulted in these characters to just be ignored, and not copied over into the destination string.

For the character (hex: 0xF0 0x9F 0x91 0x8D) that meant that its first byte (0xF0) was not copied into the destination string. And that meant a broken UTF-8 character. Oops!

In Xdebug 3.4.2 this is now fixed, as I have added the 16th line to the table, with 16 more elements containing 1.

What I did find curious that it took nearly five years for something to report this issue, and with that, two in the same week!

In this monthly update I explain what happened with Xdebug development.

GitHub and Pro/Business supporters will get it earlier, around the first of each month.

In the last month, I spend around 18 hours on Xdebug, with 25 hours funded.

Xdebug 3.4

At the start of the month I released Xdebug 3.4.1, which fixes a few crash bugs when deciding whether to activate a specific feature.

During the rest of the month, I fixed an issue where PHP 8.4's new property hooks would not show their content in the debugger.

Foreach Woes

Besides the Xdebug 3.4 general bug fixes, I have also been looking at addressing a long-standing issue where using foreach produces some unexpected results when doing path and branch coverage. I wrote an article called Figuring Out Foreach to explain the problem.

The fix however is trickier, and I am inclined to roll that up into a big patch that refactors Code Coverage into an analysis pass, and a collection pass. The patch sits in a branch and addresses some other long outstanding inaccuracies.

I recently have rebranched this patch on Xdebug's master again, so it is fully functional (minus the foreach changes), but unfortunately it is a little slower than what currently is available in Xdebug. I might decide to release it with this slight performance degradation in Xdebug 3.5 or 3.6 regardless.

Xdebug Videos

I have created one new video in the last two months:

• Xdebug 3.4: Control Socket

All Xdebug videos can be watched on my channel.

If you have any suggestions, feel free to reach out to me on Mastodon or via email.

Business Supporter Scheme and Funding

On GitHub sponsors, I am currently 40% towards my $2,500 per month goal, which is set to allow continued of Xdebug.

If you are leading a team or company, then it is also possible to support Xdebug through a subscription.

In the last month, no new business supporters signed up.

Besides business support, I also maintain a Patreon page, a profile on GitHub sponsors, as well as an OpenCollective organisation.

If you want to contribute to specific projects, you can find those on the Projects page.

Xdebug Cloud

Xdebug Cloud is the Proxy As A Service platform to allow for debugging in more scenarios, where it is hard, or impossible, to have Xdebug make a connection to the IDE. It is continuing to operate as Beta release.

Packages start at £49/month, and I have recently introduced a package for larger companies. This has a larger initial set of tokens, and discounted extra tokens.

If you want to be kept up to date with Xdebug Cloud, please sign up to the mailinglist, which I will use to send out an update not more than once a month.