Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (POST flash exit 134 free(): invalid pointer)

[PurHur]

Category

Regression: · AOT heap / session flash · release blocker

Problem

./script/release-readiness.sh --full --json fails on examples-aot-smoke for 005-SessionsWeb. Build succeeds (helper-runtime cache hit), but the POST flash CGI execute aborts:

examples-aot-smoke: 005-SessionsWeb: POST flash exited 134 free(): invalid pointer

Observed on master @ 3fce0ade3 during 2026-07-26 release-manager --full probe. Quick readiness stays 5/5 green; web smoke for 005 is OK — this is AOT-execute only.

Repro	Status (2026-07-26)
examples-web-smoke 005	✅ ok
AOT 005-SessionsWeb POST flash	🔴 exit 134 free(): invalid pointer

Same abort class as prior MiniWebApp/include heap work (#19504 / #20507), now on the session flash path (may relate to closed #21892 session_start nested createId / #21922 session wire).

Why this blocks the tag

script/examples-aot-smoke.sh requires 005 POST flash green under default SESSIONS_WEB_AOT_SMOKE_GATE. Full readiness reports user_release_ready: no with this gate red (alongside #23426 capability-matrix).

Repro

./script/docker-exec.sh -- bash -lc 'EXAMPLES_AOT_SMOKE_ONLY=005 ./script/examples-aot-smoke.sh'
# or full:
./script/docker-exec.sh -- bash -lc './script/release-readiness.sh --full --json'

Done when

• EXAMPLES_AOT_SMOKE_ONLY=005 ./script/examples-aot-smoke.sh → 005-SessionsWeb: ok
• POST flash no longer exits 134 / free(): invalid pointer
• ./script/release-readiness.sh --full --json → examples-aot-smoke: ok (with other full gates)
• No smoke-needle weakening; fix real AOT heap/session semantics

Release tracking

• Roadmap: 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 (User release → examples AOT smoke)
• Related: Regression: session_start() AOT aborts in SessionCreateIdJitHelper::randomIdString — nested VmSession::createId (#1974) #21892 (session_start AOT nested createId — closed), Stdlib: thin AOT session wire load/save only handles first string pair — multi-key + int/bool/null (ext/session) #21922 (session wire), Release v1.1.0: regenerate docs/capabilities.md (capability-matrix gate; re-#21403) #23426 (capability-matrix, same --full run)
• Strategic: Strategic alignment: compiler excellence pillars (2026 H2) #10533 Pillar 2 Ship

[PurHur]

claim: worker-lane-A — starting this run

Pre-triage gates (2026-07-26):

• bootstrap-inventory --check: ok (6574/6574)
• north-star5-fast: FAIL (gen-0 manifest/driver mismatch Self-host M5: bootstrap-inventory argv driver size floor — grow beyond 451KB stub #8713) → user_release_ready: no
• vm-driver-probe: ok
• Claiming this release-blocker (Pillar 2 / examples AOT 005) while noting Pillar 1 NS5-fast is red on master independently.

[PurHur]

claim: worker-lane-A — continuing this run

Pre-triage gates:

• bootstrap-inventory --check: OK 6574/6574 (release-readiness)
• north-star5-fast: FAIL (gen-0 manifest/driver mismatch Self-host M5: bootstrap-inventory argv driver size floor — grow beyond 451KB stub #8713) — noted, independent of this issue
• vm-driver-probe: ok
• user_release_ready: no

Current 005 symptom (evolved since issue filing): build fails before POST flash — Static call class must be a literal while NestedJIT-compiling SessionStorageJitHelper (full file includes saveToDisk). Bisect: introduced by 12a42bbed (#23354 / #23424) exactHoistedCallArgProducerSlot last-word override. Root cause: re-compileExpr of hoisted SessionFileStorage::storagePath(...) arg under VmFs::filePutContents(...) leaves an orphaned STATICCALL_INIT whose class/name slots were later forceFreshVarSlot'd (getOperand → null).

Implementing a narrow fix so exact-link still covers #23354 producers without double-emitting StaticCall INIT.

[PurHur]

claim: worker-lane-A — continuing this run

Pre-triage gates (this run):

• bootstrap-selfhost-link: in progress (Zend gen-0 fallback compiling compiler_minimal — stale native drivers / Foundation: compiled-driver reuse has no lowering-source freshness guard — Tier-1 workflow can silently test stale codegen (script/bootstrap-resolve-compile-invoke.sh) #21855)
• Inventory + release-readiness deferred until Docker lock clears

Plan (from prior handoff):

1. Skip re-compileExpr for call-protocol producers in exactHoistedCallArgProducerSlot (Multi-argument calls silently pass the trailing argument's value to earlier arguments #23354 vs NestedJIT StaticCall) — unblocks 005 build
2. Upgrade thin *_link_stub pending-header ABI bodies so PendingHeadersJitBridge::implement NestedJIT runs (StreamIoRuntime #19462 pattern) — original POST flash free(): invalid pointer

[PurHur]

claim: worker-lane-A — continuing this run

Pre-triage gates (this run):

• docker info: ok
• bootstrap-inventory --check: stale docs drift (master ambient; regenerate separately)
• release-readiness --json: still running
• north-star5-fast / gen-0: previously red on master (Self-host M5: bootstrap-inventory argv driver size floor — grow beyond 451KB stub #8713 / Foundation: compiled-driver reuse has no lowering-source freshness guard — Tier-1 workflow can silently test stale codegen (script/bootstrap-resolve-compile-invoke.sh) #21855) — independent

Plan: resume prior handoff — (1) skip re-compileExpr for call-protocol producers in exactHoistedCallArgProducerSlot to unblock NestedJIT StaticCall for SessionsWeb; (2) verify EXAMPLES_AOT_SMOKE_ONLY=005 POST flash.

[PurHur]

claim: worker-lane-A — continuing; shipping deterministic header-after-cast AOT fix

Root cause (deterministic): header(..., true, 303) after (string)$arr[$k] — bool literal arrives as TYPE_VALUE without compileTimeLong, so JitBoolArg::lowerBoxed emits mid-function BB diamonds that leave thin AOT heap-corrupt (free(): invalid pointer / 134).

Also: examples-aot-smoke.sh was exporting PHP_COMPILER_SESSION_DIR during phpc build --project (pollutes compile) and omitted CONTENT_TYPE on POST.

Verify: test/repro/issue_23427_header_after_string_cast_aot.php AOT → 30/30 OK. SessionsWeb project/smoke still intermittently flaky on master too (separate session/AOT flake; hardcoded sid in SessionCreateIdJitHelper).

[PurHur]

claim: worker-lane-A — continuing this run

Pre-triage gates:

• docker info: ok
• bootstrap-inventory --check: docs drift vs live (ambient on master; OK 6576/6576 in release-readiness)
• release-readiness --json (quick): user_release_ready: yes (NS5-fast ok)
• Continuing branch agent/issue-23427-sessionsweb-aot-header-immediates (rebased on master)

Plan: verify test/repro/issue_23427_header_after_string_cast_aot.php + EXAMPLES_AOT_SMOKE_ONLY=005; merge if green.

[PurHur]

PR: #23549

Verified: test/repro/issue_23427_header_after_string_cast_aot.php AOT 40/40 (was 0/15 on master).

Not yet green: EXAMPLES_AOT_SMOKE_ONLY=005 still intermittent — full example.php GET→POST also flakes on master. Left PR unmerged until 005 passes repeatedly.

Next: dig remaining full-example / session POST flake (hardcoded sid in SessionCreateIdJitHelper is intentional; separate from the header BB-diamond crash).