Release v1.1.0: fix examples 000–009 AOT smoke regression (001-SimpleWeb munmap_chunk)

[PurHur]

Context

Daily release review 2026-06-26: quick gates 5/5 green (recovered from #11565); ./script/release-readiness.sh --full --json fails examples-aot-smoke.sh.

Prior tracker #11206 closed 2026-06-24 (LLVM Module.php); AOT smoke regressed again on current master.

Roadmap: #78 user release v1.1.0 gate checklist.

Failure (2026-06-26, Docker harness)

release-readiness:   FAIL: examples-aot-smoke.sh (000–009) (exit 1)
examples-aot-smoke: 001-SimpleWeb: phpc build -> /compiler/.phpc/smoke/001-SimpleWeb/app
examples-aot-smoke: 001-SimpleWeb: binary exited 134 munmap_chunk(): invalid pointer

000-HelloWorld builds and runs; failure is on 001-SimpleWeb AOT execute.

Acceptance criteria

• ./script/examples-aot-smoke.sh exits 0 in Docker (./script/docker-exec.sh -- bash -lc './script/examples-aot-smoke.sh')
• ./script/release-readiness.sh --full --json → examples-aot-smoke gate ok

Gate command

./script/docker-exec.sh -- bash -lc './script/examples-aot-smoke.sh'
./script/docker-exec.sh -- bash -lc './script/release-readiness.sh --full --json'

Milestone

v1.1.0 user release — blocks tag until --full bundle green.

[PurHur]

claim: worker-lane-a — batch (issues #12033, #12039)

[PurHur]

claim released: worker-lane-a — AOT heap corruption needs dedicated memory/AOT investigation.

Repro confirmed on master (Docker):

./script/docker-exec.sh -- bash -lc './script/examples-aot-smoke.sh'
# 000-HelloWorld: ok
# 001-SimpleWeb: binary exited 134 — munmap_chunk(): invalid pointer

Next steps for claimer:

1. Build examples/001-SimpleWeb/example.php AOT binary with ASAN/valgrind in Docker.
2. Bisect around SuperglobalRefreshRuntime / $_REQUEST merge path (lib/Web/Superglobals.php) — script touches runtime QUERY_STRING refresh (Testing: ExamplesCompileTest — 001-SimpleWeb AOT build + dual QUERY_STRING execute #309, php-in-php: CGI superglobal refresh — delete superglobals_refresh.c (~2623 lines), populate in lib/Web/ #5330).
3. Compare with VM/JIT serve smoke (script/examples-serve-jit-smoke.sh) which may still be green.

Lane A shipped #12033 (#12041) this run; #12039 blocked on native crash depth.

[PurHur]

claim: worker-lane-a — batch (issues #12039)

[PurHur]

Merged via #12063.

Root cause: Standalone AOT used the PHP-in-PHP SuperglobalRefreshJitHelper bridge (#9907), but nested helpers return VM HashTable handles — coerceToHashtablePtr bitcast to native __hashtable__* left $_REQUEST empty and caused intermittent munmap_chunk on repeated htmlspecialchars.

Fix: Default standalone to SuperglobalRefreshStandaloneLlvm (libc getenv + LLVM parse). Opt-in PHP bridge: PHP_COMPILER_SUPERGLOBAL_REFRESH_PHP=1. (string) cast on $_REQUEST['name'] in 001-SimpleWeb for stable double-htmlspecialchars until string-lifetime follow-up.

Verification (Docker):

./vendor/bin/phpunit --filter RuntimeSuperglobalRefreshTest::testTwoRequestsDifferentQueryString test/aot/RuntimeSuperglobalRefreshTest.php  → OK
./script/examples-aot-smoke.sh  → 001-SimpleWeb: ok

Full examples-aot-smoke.sh still stops at 003-MiniWebApp link (IncludeBindingEmitHelper TypeError) — pre-existing on master, separate from #12039.