NestedArray::setValue() without $force can cause WSOD.

This is a tough issue, isn't it? At least for me PHP is a language where being strict is hard, as its not designed for that, on purpose.

What about providing something like "setValueForced" / "setForcedValue" or so, which enables you to use that parameter easier / in a nicer way?

I'm trying to come up with a simplified test case but using this process from #3160406: Exposed forms with checkboxes don't work correctly if the checkbox value is in the URL I did trigger this.

1. Create a node listing view that is a page.
2. Add a filter like "status". Make the filter exposed and grouped so it has some depth to the for structure.
3. Visit the page and append the filter identifier to the url as a query argument. Like /test-page?status

The form builder is populating from user input(which did honestly surprise me coming from the query) and the input structure doesn't match the form structure because of the nesting triggering a fatal error.

Because this is a fully fatal error, repeatable out of the box, and doesn't require any weird user interactions like POST manipulation I've bumped this to major. Still sort of an edge case but easily repeatable crash.

Additionally in case its helpful, my case the trace ended up looking like this:

The website encountered an unexpected error. Please try again later.
Error: Cannot create references to/from string offsets in Drupal\Component\Utility\NestedArray::setValue() (line 155 of core/lib/Drupal/Component/Utility/NestedArray.php).

Drupal\Component\Utility\NestedArray::setValue(Array, Array, NULL) (Line: 1249)
Drupal\Core\Form\FormBuilder->handleInputElement('views_exposed_form', Array, Object) (Line: 1000)
Drupal\Core\Form\FormBuilder->doBuildForm('views_exposed_form', Array, Object) (Line: 1070)
Drupal\Core\Form\FormBuilder->doBuildForm('views_exposed_form', Array, Object) (Line: 1070)
Drupal\Core\Form\FormBuilder->doBuildForm('views_exposed_form', Array, Object) (Line: 574)
Drupal\Core\Form\FormBuilder->processForm('views_exposed_form', Array, Object) (Line: 320)
Drupal\Core\Form\FormBuilder->buildForm('\Drupal\views\Form\ViewsExposedForm', Object) (Line: 135)
Drupal\views\Plugin\views\exposed_form\ExposedFormPluginBase->renderExposedForm() (Line: 1238)
Drupal\views\ViewExecutable->build() (Line: 395)
Drupal\views\Plugin\views\display\PathPluginBase->execute() (Line: 196)
Drupal\views\Plugin\views\display\Page->execute() (Line: 1630)
Drupal\views\ViewExecutable->executeDisplay('page_1', Array) (Line: 81)
Drupal\views\Element\View::preRenderViewElement(Array)
call_user_func_array(Array, Array) (Line: 101)
Drupal\Core\Render\Renderer->doTrustedCallback(Array, Array, 'Render #pre_render callbacks must be methods of a class that implements \Drupal\Core\Security\TrustedCallbackInterface or be an anonymous function. The callback was %s. See https://www.drupal.org/node/2966725', 'exception', 'Drupal\Core\Render\Element\RenderCallbackInterface') (Line: 772)
Drupal\Core\Render\Renderer->doCallback('#pre_render', Array, Array) (Line: 363)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 201)
Drupal\Core\Render\Renderer->render(Array, ) (Line: 241)
Drupal\Core\Render\MainContent\HtmlRenderer->Drupal\Core\Render\MainContent\{closure}() (Line: 564)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 242)
Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object) (Line: 132)
Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object) (Line: 90)
Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
call_user_func(Array, Object, 'kernel.view', Object) (Line: 142)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch(Object, 'kernel.view') (Line: 163)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 80)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 58)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 106)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 85)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 51)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 708)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

Turns out this is pretty easy to recreate inside out test suite. Just adding a query to one of the exposed filters tests for views triggers it right away.

Here's a patch with some tests that _mostly_ fixes the problem based on the solution in the d7 patch but throwing an exception instead of triggering an error. I figure the exception will allow forms to fail a bit more gracefully though I haven't started digging into the validation logic to confirm that. The case where the value is set will still WSOD a site so we should still have a failure on this patch.

A bit of a self review, open question. This preserves the BC with old version of PHP which treated the empty string as null. But had this been fixed earlier, that would have likely been removed with 9 when the requirements where raised. Additionally because it fails, this has never been supported with D9 so... is it really BC?

So either this patch needs to properly deprecate the behavior, remove it, or document why its needed. Leaning toward just removing it.

Woops...

Found a good test for the Form component of this problem on #2932604: Fatal error when providing a string value to a form field that expects an array value by Lendude. Added it here and merged the issues since they're the same problem.

Goodness, this bug/hole in NestedArray trickled out to a lot of things. The config tests are even asserting and working around the PHP 8 in the test... weird.

Pulling in the fix for config adjusted to use the exception.

I was getting error when passing filter value in the url for multiselect exposed filter.
I could solve this with small alteration in the url parameter,
posting this if you find helpful.
Drupal Version: 9.2.x
Problem:

URL- http://localhost.com/vews-page?field_tag_target_id=261
Error - Error: Cannot create references to/from string offsets in Drupal\Component\Utility\NestedArray::setValue() (line 155 of core\lib\Drupal\Component\Utility\NestedArray.php).

Solution:
Changed in url - http://localhost.com/vews-page?field_tag_target_id[261]=261

Thank you for this patch. My use case was a Views Exposed Filter was not being set due to a malformed link. I kept seeing this error in watchdog, but didn't see anything wrong with the filter itself. Since the Exposed Filter existed in the query string, but the value was blank, NestedArray blew up with an empty string. I was temporarily able to get it working by adding an empty check as an OR in the if $ref check, but this patch looks a lot more comprehensive.

Reroll to 10.2.x