Regression: phpc build fails module verification for every user script — 4 lowering defects, 266/266 helper units degraded (lib/JIT/Builtin/StringOffsetRuntime.php)

[PurHur]

Category

Regression: · AOT/JIT lowering · release blocker

Problem

On pristine master (e1850c9) in php-compiler:22.04-dev, ./phpc build fails module verification for any user script — including the 5-line tier-1 fixture that check-aot-build-smoke.sh (#16010) uses. ./script/ci-fast.sh is therefore red at its first gate.

The same four defects also break the split-compilation helper-object cache: 266 of 266 helper units fail to emit, every one silently degraded to the "nested-lowering fallback (#15642)". Because every JIT context builds the htmlspecialchars helper, and that helper indexes a string, one bad zext poisoned every module in the tree.

Repro	Zend 8.2	AOT on master (2026-07-23)
$w = "AOT"; echo $w, "\n", strlen($w), "\n";	AOT / 3	RuntimeException: Module verification failed
php script/emit-helper-runtime-object.php	—	0 emitted, 266 failed

Four independent defects, all reported by one Module->verify():

1. ZExt only operates on integer — lib/JIT/Builtin/StringOffsetRuntime.php::normalizeOffset blind-zexts its operands. A box-backed offset arrives as a %__value__ struct, so it emits zext %__value__ ... to i64. 221 of 266 unit failures.
2. Call parameter type does not match function signature! — lib/JIT/JitNestedHelperCoerce.php::coerceArgForHelper always returns a pointer when boxing, but isValueBoxType() also matches a by-value __value__ parameter, so call ...(%__value__* %slot) hits a by-value param.
3. Incorrect number of arguments passed to called function! — JIT::instanceMethodUsesThis() falls back to context->scope->className (Epic: architecture rearrangement — TU-based pipeline, differential gates, generated maintenance (docs/architecture-review-2026-07.md) #16075). For a file whose class is compiled before its top level, {main} inherits the leftover class name and is given an %__object__* parameter; standalone main then emits call void @internal_N() with no arguments.
4. Both operands to ICmp instruction are not of the same type! — strcmp is declared i32 in lib/JIT/LibcExtern.php, but four sites compare its result against an i64 zero (ReflectionFunctionVariadicLookupRuntime.php, ParamSensitiveLookupRuntime.php ×3).

Why it went unobserved

Three layers of false green stacked up:

• script/emit-helper-runtime-object.php sent every child's stderr to /dev/null, so 266 failures produced no diagnostics.
• script/check-helper-runtime-prelink.php iterates glob(units/*/manifest.json) — with zero manifests the glob is empty and it reports clean, exit 0. It detects stale units, never zero units.
• Emission failure is tolerated as "nested-lowering fallback (Regression: user-script AOT builds broken for core string builtins — preg_match capture assign, explode CRLF, str_contains, substr negative length (bin/compile.php) #15642)", so the degraded path is the silent default.

Repro

./script/docker-exec.sh -- bash -lc 'printf "<?php\n\$w = \"AOT\";\necho \$w, \"\\n\", strlen(\$w), \"\\n\";\n" > /tmp/t1.php && ./phpc build -o /tmp/t1 /tmp/t1.php'
./script/docker-exec.sh -- bash -lc 'php script/emit-helper-runtime-object.php'

Fast single-unit repro (~10 s), with the operand asserts that locate each defect in one shot:

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_LLVM_ASSERT=1 php script/emit-helper-runtime-object.php --unit=/lib/VM/CompareJitHelperScalars.php'

Done when

• ./phpc build + execute green on the tier-1 fixture; output matches VM
• ./script/ci-fast.sh green at the AOT build smoke gate
• php script/emit-helper-runtime-object.php emits the large majority of units instead of 0
• Child stderr is captured, so a unit failure names its cause
• A gate fails when zero units emit (the blind spot above)
• PHP_COMPILER_LLVM_ASSERT=1 also validates iCmp operand types

[PurHur]

claim: worker-lane-A — starting this run

Trust probe (before claim):

• php script/bootstrap-inventory.php --check: red (docs drift on CompilerVersion/VM method counts)
• docker-exec bootstrap-selfhost-link: blocked briefly by CI lock (cleared)
• Will re-run release-readiness / AOT smoke after fix

Lane A (22638 % 3 == 0). No open PR, no prior claim.

[PurHur]

claim: implementer Lane A — starting this run

Gate probe (pre-claim):

• bootstrap-selfhost-link: OK
• bootstrap-inventory --check: RED (docs/bootstrap-inventory.md construct-flag drift on CompilerVersion/VM — regenerating after fix if needed)
• release-readiness: still running

Claiming this Regression (Pillar 1 — phpc build module verify / helper units). Branch: agent/issue-22638-aot-module-verify

[PurHur]

yield: implementer Lane A — earlier claim at 11:00:49 (worker-lane-A) owns this; WIP already in tree. Not competing — picking another Lane A ticket.

[PurHur]

continue: implementer Lane A — WIP for all 4 defects + helper-gate/icmp assert is already on branch agent/issue-22638-aot-module-verify in this workspace (same automation user as 11:00 claim). Continuing verify → PR → merge; not abandoning half-done work.

[PurHur]

Release manager triage (2026-07-23)

Promoted to release-blocker for v1.1.0.

Verified on master @3c1c3042c (Docker):

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_LLVM_ASSERT=1 php script/emit-helper-runtime-object.php --unit=/lib/VM/CompareJitHelperScalars.php'

→ Module verification failed with the four defects named in the issue body (zext %__value__, call signature mismatch, internal_N argc, icmp i32/i64).

Release impact

• ./script/release-readiness.sh --json quick gates are 5/5 / user_release_ready: yes (bootstrap trust path).
• --full cannot ship: examples-aot-smoke hangs/fails while warming helper-runtime (266 units degraded) and user phpc build is broken for every script.
• Roadmap: #78 · pillars: #10533

No tag until this closes and --full reports user_release_ready: yes.

[PurHur]

continue: PHP Runtime / Lane A — rebasing #22640 onto current master (conflicted on generated docs only; skipped docs-only commit, will regenerate if needed).

Gate probe (this run):

• bootstrap-inventory --check: OK 6454/6454 (via release-readiness)
• spine-coverage: OK
• vm-driver-probe: OK
• north-star5-fast: FAIL step 4f-m gen-0 manifest/driver mismatch — tracked as Gen-1+ #1492: committed gen-0 seed cannot be rebuilt — refresh OOMs at 48 GiB, 44 restamps since the blob last changed (script/bootstrap-refresh-gen0-sidecar.sh) #22642 (not this PR)
• user_release_ready: no
• bootstrap-selfhost-link: in progress (stale native driver → Zend gen-0 fallback for compiler_minimal)

Rebased commits on fix/22638-aot-module-verification: AOT verify fixes + parallel helper emit. Next: re-verify ./phpc build smoke → merge.