AOT: ++/-- on a live resource silently succeeds instead of raising TypeError (#6396 guard never fires at top-level scope)

[PurHur]

Category

bug · php-src-strict · AOT / JIT operand guards · silent wrong output

Problem

++$fh / --$fh where $fh is an open resource silently succeeds in an AOT binary. Zend raises TypeError: Cannot increment resource. This is the silent-wrong-output class from AGENTS.md §3.

The guard for this exists — JIT::guardIncDecResourceOperand(), added for #6396 — but it never fires for top-level script code.

Repro	Zend 8.2	AOT (master)
++$fh on fopen('php://memory','r+')	TypeError: Cannot increment resource (rc 255)	prints no error (rc 0)

Measured on master at 544d1dca9, php-compiler:22.04-dev, LLVM 9.

Cause

guardIncDecResourceOperand() only emits the check when the read operand is TYPE_NATIVE_LONG, or TYPE_VALUE with KIND_VARIABLE / functionStaticGlobal. A top-level $fh from fopen() lands in neither bucket, so the guard is skipped with no diagnostic. Worth checking whether the same hole applies to the other #6396-era operand guards.

php-src reference

• php/php-src Zend/zend_operators.c — increment/decrement on non-numeric types → TypeError
• Related prior: Language: increment/decrement on resource — TypeError parity (zend_operators.c) #6396

PHP implementation target

• lib/JIT.php — guardIncDecResourceOperand() (and sibling operand guards) must cover top-level resource locals, not only NATIVE_LONG / KIND_VARIABLE shapes
• Prefer PHP-side guard emission; no new C runtime logic
• Regression guard in test/differential/cases/ (or AOT compliance) once fixed

Repro

./script/docker-exec.sh -- bash -lc '
cat > /tmp/repro_inc_res.php <<'"'"'PHP'"'"'
<?php
$fh = fopen("php://memory", "r+");
++$fh;
echo "no error\n";
PHP
./phpc build -o /tmp/repro_inc_res /tmp/repro_inc_res.php && /tmp/repro_inc_res; echo rc=$?
'

Done when

• AOT (and JIT when in scope) raises TypeError: Cannot increment/decrement resource matching Zend
• Top-level script locals and function locals both covered
• Differential / compliance guard checked in
• php-src-strict; no php-compiler-strict shortcut

Note

Found while working #23483; pre-existing on master with lib/JIT.php stashed — filed separately so the perf change is not credited with fixing it.

[PurHur]

claim: worker-lane-C — starting this run

Lane C (23777 % 3 == 2). Will fix AOT top-level ++/-- on live resources so Zend-matching TypeError fires (guardIncDecResourceOperand hole).

[PurHur]

claim: worker-lane-C — continuing this run (prior claim had no PR/branch; sole eligible Lane C implementation-ready outside stdlib/ext ownership)

Gates snapshot before implement:

• docker info: ok
• bootstrap-inventory --check: file-list drift (not 4311/4311 clean — regenerate needed separately)
• release-readiness: still running

[PurHur]

Merged #23794

Verification (host, LLVM 9, PHP_COMPILER_HELPER_RUNTIME_O=0):

./phpc build -o /tmp/repro_inc_res /tmp/repro_inc_res.php && /tmp/repro_inc_res; echo rc=$?
# stderr: PHP Fatal error:  Uncaught TypeError: Cannot increment resource
# rc=255

Also: VM differential g07_inc_resource.php matches Zend; StreamIo/Lifecycle standalone unit tests OK.