Regression: every phpc build fails module verification since #15866 — GC bridge miscasts + helper PHP bodies dragging broken lowerings into all builds (lib/JIT/Builtin/GcCollectCyclesRuntime.php)

[PurHur]

Category

regression · AOT build-breaking (all scripts)

Problem

Since d17f1732d (#15866, 2026-07-04 06:57) every phpc build — including examples/000-HelloWorld and an empty script — dies with Module verification failed in compileCommon. The fast gate cannot see it (no LLVM build step), so it survived several hours and ~40 merges.

Two distinct layers:

1. Four miscasts in the new GC bridges (diagnosed via PHP_COMPILER_DUMP_IR=1):

Site	Bug	Fix
llvmRegistryDestructInvoked	trunc i1→i8 (invalid: DestTy too big)	zext
llvmRegistryObjectPtr	pointerCast on i64 → addrspacecast i64→i8*	intToPtr
implementGcRegisterPhpBridge	pointerCast(ptr→i64)	ptrToInt
implementGcRegisterPhpBridge	raw i32 propCount into appendObject(i64,i64)	sext

2. Deeper: the helper PHP bodies land on every build path. With the four casts fixed, verification still fails inside the nested lowering of GcCollectCyclesRegistryJitHelper.php itself: phi i64/i32 clash in incdec_null_coerce, __value__writeHashtable(%__value__*, %__value__*) vs %__hashtable__* param, ret i64 vs declared i32. These are pre-existing #15642-class lowering bugs in ++/array-write shapes — #15866 put a helper exercising them into every module.

Action taken

d17f1732d reverted in the #15619 green-master sync PR (with spine/inventory resync for the deleted GcDestructAllowDelrefJitHelper.php). Re-land #15866 only when: the four casts above are applied AND the registry helper PHP avoids (or #15642 fixes) the incdec/array-write lowerings — and add an AOT hello-world build to the fast gate so build-breaking commits cannot survive again (single phpc build ≈ 3 s in Docker).

Repro (at d17f173..head before revert)

./script/docker-exec.sh -- bash -lc "./phpc build -o /tmp/h examples/000-HelloWorld/example.php"

Done when

• php-in-php: GcCollectCyclesRuntime phase 2 increment — universal PHP registry + destruct gate (#15852) #15866 re-landed with valid IR (all four casts + helper body lowering clean)
• Fast gate includes an AOT build smoke (catches this class in pre-merge)
• phpc build green for hello + gc scripts, VM parity

[PurHur]

Ready-made patch for the four bridge miscasts (verified: eliminates the trunc/addrspacecast/appendObject verify errors; the remaining failures are the layer-2 helper-body lowerings):

diff --git a/lib/JIT/Builtin/GcCollectCyclesRuntime.php b/lib/JIT/Builtin/GcCollectCyclesRuntime.php
index 6d75d8dab..7762c34e1 100644
--- a/lib/JIT/Builtin/GcCollectCyclesRuntime.php
+++ b/lib/JIT/Builtin/GcCollectCyclesRuntime.php
@@ -861,7 +861,9 @@ final class GcCollectCyclesRuntime
             $context->builder->sext($index, $i64)
         );
 
-        return $context->builder->pointerCast($ptrI64, $i8p);
+        // Helper returns the address as i64; pointerCast on an integer emits
+        // an invalid addrspacecast — this must be inttoptr (#15866 follow-up).
+        return $context->builder->intToPtr($ptrI64, $i8p);
     }
 
     private static function llvmRegistryPropCount(Context $context, Value $index): Value
@@ -887,7 +889,9 @@ final class GcCollectCyclesRuntime
             $context->builder->sext($index, $i64)
         );
 
-        return $context->builder->trunc($flag, $i8);
+        // Helper returns i1; widening into the i8 slot needs zext — trunc
+        // i1→i8 is invalid IR and broke every AOT build (#15866 follow-up).
+        return $context->builder->zext($flag, $i8);
     }
 
     private static function llvmRegistryMarkDestructInvoked(Context $context, Value $index): void
@@ -955,9 +959,11 @@ final class GcCollectCyclesRuntime
         }
         $entry = $fn->appendBasicBlock('gc_register_php_entry');
         $context->builder->positionAtEnd($entry);
-        $objI64 = $context->builder->pointerCast($fn->getParam(0), $i64);
-        $prop = $fn->getParam(1);
-        $context->builder->call(self::registryHelperFunction($context, self::REG_APPEND), $objI64, $prop);
+        // ptrtoint (not pointerCast) for the object address, and the i32 prop
+        // count must widen to the helper's i64 param (#15866 follow-up).
+        $objI64 = $context->builder->ptrToInt($fn->getParam(0), $i64);
+        $propI64 = $context->builder->sext($fn->getParam(1), $i64);
+        $context->builder->call(self::registryHelperFunction($context, self::REG_APPEND), $objI64, $propI64);
         self::syncRegistryCountGlobal($context);
         $context->builder->returnVoid();
         $context->builder->clearInsertionPosition();

[PurHur]

claim: PHP Runtime → PHP — starting this run

[PurHur]

Merged via #16020.

Root cause: #15866 removed usesPhpRegistry() so standalone AOT nested-compiled GcCollectCyclesRegistryJitHelper static arrays on every build → LLVM module verify failure.

Fix: Restore standalone LLVM phpc_gc_objects[] registry; embed JIT keeps PHP registry with corrected bridge casts; retain GcDestructAllowDelrefJitHelper PHP bridge.

Verification: ./phpc build -o /tmp/h examples/000-HelloWorld/example.php → Hello World; GC unit tests + VM gc_collect_cycles.phpt green; make bootstrap-selfhost-vm-driver-execute-probe OK.

Follow-up: add minimal AOT hello smoke to ci-fast.sh (issue done-when item 2).