Image editor: fatal error when attachment metadata has no sizes array

[josephscott]

https://core.trac.wordpress.org/ticket/65748

AI assistance: Yes
Tool(s): Claude
Model(s): Opus 5
Used for: Writing the tests

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @nazmulasif.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

Core Committers: Use this line as a base for the props when committing in SVN:

Props josephscott, westonruter, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

Fixes a fatal error path in the image editor when an attachment’s metadata lacks a usable sizes array, ensuring wp_save_image() / wp_restore_image() can proceed without type errors and adding regression coverage in the Ajax image editor test suite.

Changes:

• Normalize $meta['sizes'] to an array in wp_save_image() before it’s passed to array_merge().
• Normalize $meta and $meta['sizes'] in wp_restore_image() to avoid “Cannot use a scalar value as an array” fatals.
• Add PHPUnit data-driven tests covering missing / scalar / null sizes metadata during save and restore flows.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/phpunit/tests/ajax/wpAjaxImageEditor.php	Adds regression tests (data provider + two test methods) to ensure saving/restoring doesn’t fatal when sizes metadata is missing or invalid.
src/wp-admin/includes/image-edit.php	Hardens wp_save_image() and wp_restore_image() against missing/non-array sizes metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[nazmulasif]

Test Report

Patch tested: #12744

Environment

• WordPress: 7.1-beta3-20260728.201755
• Subdirectory: No
• PHP: 7.4.33
• Server: PHP.wasm
• Database: WP_SQLite_Driver (Server: 8.0.38 / Client: 3.51.0)
• Browser: Chrome 150.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Five 1.5
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.3.0

Steps taken

1. Launched the WordPress Playground instance built from PR Image editor: fatal error when attachment metadata has no sizes array #12744.
2. Navigated to Media → Library and uploaded a test image.
3. Clicked Edit Image to open the core image editor interface.
4. Performed Crop and Scale operations, then saved the modifications.
5. Clicked Restore Original Image to revert the image back to its original state.
6. Verified that no PHP fatal errors or warnings occurred during the process.
7. ✅ Patch is solving the problem

Expected result

• Image saving, cropping, scaling, and restoring operations should execute successfully without throwing PHP type errors or fatal errors when processing attachment metadata.

Additional Notes

• Tested via WordPress Playground instance. Crop, scale, and restore functionalities work as expected without any errors.

Screenshots/Screencast with results

• Screenshot/Screencast before: N/A
• Screenshot/Screencast after: N/A

Support Content

• PR URL: Image editor: fatal error when attachment metadata has no sizes array #12744
• Trac Ticket: https://core.trac.wordpress.org/ticket/65748

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

src/wp-admin/includes/image-edit.php:835

• wp_restore_image() now normalizes $meta['sizes'] to an array, but it can still fatal later if sizes is an array containing non-array entries (e.g. array( 'thumbnail' => 'not-an-array' )), because the function accesses $meta['sizes'][ $default_size ]['file'] without verifying the per-size value is an array. Consider filtering sizes to arrays only so corrupted entries don’t trigger a TypeError during restore.

	if ( ! isset( $meta['sizes'] ) || ! is_array( $meta['sizes'] ) ) {
		$meta['sizes'] = array();
	}

src/wp-admin/includes/image-edit.php:997

• wp_save_image() now ensures $meta['sizes'] is an array, but if sizes is an array with non-array entries (e.g. array( 'thumbnail' => 'not-an-array' )), the function later accesses $meta['sizes'][ $size ]['file'] and can still fatal. Filtering $meta['sizes'] to array entries here would prevent TypeErrors when metadata has been corrupted by plugins/filters.

	if ( ! isset( $meta['sizes'] ) || ! is_array( $meta['sizes'] ) ) {
		$meta['sizes'] = array();
	}

tests/phpunit/tests/ajax/wpAjaxImageEditor.php:322

• The data provider covers missing/scalar sizes, but not the case where sizes is an array containing invalid (non-array) per-size entries (which can still lead to fatals when code accesses $meta['sizes'][ $size ]['file']). Adding a case like array( 'sizes' => array( 'thumbnail' => 'not-an-array' ) ) would protect against regressions for that failure mode.

			'string sizes'  => array( array( 'sizes' => 'not-an-array' ) ),
			'boolean sizes' => array( array( 'sizes' => false ) ),

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[irozum]

This fixes the reported fatal correctly: wp_save_image() no longer passes a non-array $meta['sizes'] into array_merge(), and the PR also closes the analogous gap in wp_restore_image() where the same malformed metadata would hit $meta['sizes'][ $default_size ] = $data and raise "Cannot use a scalar value as an array" (or the PHP 8.1+ deprecation/PHP 9 error for false). Good catch extending the fix there rather than stopping at the one line from the report.

Ran the full Tests_Ajax_wpAjaxImageEditor class (--group ajax) and the 65748 ticket group — 190 tests, all green, plus PHPCS lint:errors and PHPStan clean. Traced every remaining use of $meta['sizes'] after both new guards (the array_merge call and the foreach ( $default_sizes ...) loop in wp_restore_image) and confirmed they're all safe once the guard runs. No backward-compat concern here since the prior behavior was a fatal error — nothing could have been relying on it.

One thing I couldn't fully verify from the diff alone: the data provider only exercises sizes being absent, null, '', a non-array string, and false — it doesn't cover sizes being an array containing non-array entries (e.g. array( 'thumbnail' => 'not-an-array' )), which line 880's $meta['sizes'][ $default_size ]['file'] would presumably also choke on. Probably out of scope for this ticket's fatal (the report was specifically about $meta['sizes'] itself, not its members), but worth a quick gut-check on whether that's a live path.