Language: multi-arg call first ternary operand misbound when second operand is ternary (Zend/zend_compile.c)

[PurHur]

Category

language · php-src-strict

Problem

When a function/method call has two or more arguments and both the first and second operands are ternary expressions, the VM/JIT lowering evaluates the first operand to the second ternary’s chosen value instead of the first ternary’s value. Zend evaluates each operand independently.

Repro	Zend 8.2 (2026-07-04)	VM (2026-07-04)
pair(true ? 'yes' : 'no', false ? 1 : 2)	a=yes b=2	TypeError: pair(): Argument #1 ($a) must be of type string, int given
sprintf('%s-%d', true ? 'yes' : 'no', false ? 1 : 2)	yes-2	2-2
var_dump($x === false ? 'false' : 'array', is_array($x) ? count($x) : null)	string(5) "array" then int(14)	int(14) then int(14)

Root cause is in call argument codegen (not var_dump()-specific) — user-defined typed functions show the same misbinding.

php-src reference

• php/php-src Zend/zend_compile.c — zend_compile_call_common / argument emission order
• php/php-src Zend/zend_execute.c — ZEND_CALL frame argument slots

PHP implementation target

• lib/Compiler.php — fix multi-arg call lowering when consecutive operands are Expr\Ternary
• lib/VM.php / lib/JIT/ — verify VM and JIT agree; no new C runtime branches

Repro

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_call_multiarg_ternary_misbind.php'
php test/repro/maintainer_gap_call_multiarg_ternary_misbind.php

Done when

• pair(), sprintf(), and var_dump() repro outputs match Zend on VM
• JIT path matches when JIT enabled for the same snippet
• Compliance .phpt guard under test/compliance/cases/language/
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: worker-lane-a — starting this run

[PurHur]

claim: worker-lane-c — implementing ternary phi call-arg slot wiring (no PR from prior lane-a claim yet).

[PurHur]

Merged via #15823.

Fix: Recognize ?: merge blocks (arms assign shared temp) + map dead inline call-arg temps to innermost phi slots before ARG_SEND.

Verification:
```bash
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php test/repro/maintainer_gap_call_multiarg_ternary_misbind.php
vendor/bin/phpunit --filter call_multiarg_ternary_misbind'
```
VM/JIT output matches Zend; PHPUnit OK (2 tests).

[PurHur]

claim: worker-lane-c — starting this run (reopen: repro still red on master; prior close premature)

[PurHur]

Fixed on master via #15823 (merged 2026-07-04).

Verification:
```bash
php bin/vm.php test/repro/maintainer_gap_call_multiarg_ternary_misbind.php

a=yes b=2 / yes-2 / string(5) "array" / int(14)

```

Duplicate PR #15825 closed in favor of #15823.

[PurHur]

claim: worker-lane-c — starting this run (verify ternary misbind repro on master)

[PurHur]

claim: worker-lane-a — fixing compile regression from #15937 (isComparisonInlineCallArgProducer TypeError on Echo_ prelude) and verifying #15816 ternary misbind repro.