AOT differential sweep: 27 of 53 cases fail on master (half the least-covered path is untested-broken)

[PurHur]

Summary

script/differential-sweep.sh --aot fails 27 of 53 cases on master at 544d1dca9. The VM
backend passes 53/53 on the same cases. AGENTS.md §3 calls AOT "the least-covered path"; this
quantifies it.

Measured in php-compiler:22.04-dev, LLVM 9. Nobody appears to have run the full AOT sweep
recently — it was found while baselining an unrelated change, and every one of the 27 reproduces on
an untouched master checkout.

Breakdown

19 wrong-output (DIFF) — these run to completion and print the wrong thing, the exact class
AGENTS.md §3 warns the compliance suite cannot catch:

c04_concat  c10_builtin  c11_strcmp  d04_concat_dim  e01_var_export  e02_in_array
e03_array_merge  e05_sprintf  e06_byref  e09_nested_calls  e13_isset  e15_str_fns
e17_array_pad  e24_compare  e29_var_dump_indent  g01_var_dump  g02_print_r
g03_exception_caught  g05_float_render

8 compile failures (COMPILE):

c07_method  e04_usort  e07_named  e08_spread  e16_array_slice  e20_closure
e23_implode  g04_exception_state

Samples

c04_concat.php — concatenated arguments vanish entirely:

<?php
function f($a,$b){ echo "$a $b\n"; }
$s='s'; f($s.'1',$s.'2');

zend: s1 s2
aot :

Another case returns a float where Zend returns a string:

zend: zw!~string(2) "zw"
aot : ~float(0)

Why this matters

g01, g02, g03, g05 are the regression guards added in #23754 for the AOT fixes
(#23540, #23641, #23471/#23472/#23482). They pass under VM and fail under AOT, so the defects
those issues closed are still reproducible on the AOT path. Worth re-checking whether those
issues should be reopened, or whether the guards need AOT-specific expectations.

The concat/string cluster (c04, c11, d04, e15, e23) looks like it could share one root
cause, so this may be far fewer than 27 distinct bugs.

Repro

script/differential-sweep.sh --aot --dir test/differential/cases
# AOT_SWEEP_EXIT=27  (exit status = mismatch count)

[PurHur]

claim: worker-lane-B — starting this run

Lane B (23779 % 3 == 1). Pillar 1 green (user_release_ready: yes, north-star5-fast ok, bootstrap-selfhost-link ok via Zend gen-0 fallback). Will reproduce AOT differential failures and fix a shared root-cause cluster (likely concat/string / compile failures), php-src-strict.

[PurHur]

Correction to the breakdown above

I classified all 19 DIFF cases as the silent-wrong-output class. That is wrong, and it overstates
the problem. Having read each case's actual output, the 19 split three ways:

7 genuinely silent wrong output — run to completion, print the wrong thing, no diagnostic:

case	zend	aot
c04_concat	s1 s2	(both args empty)
c10_builtin	zw! + string(2) "zw"	float(0)
d04_concat_dim	(expected text)	|K (garbage)
e05_sprintf	formatted	%d-%d / %s/%s (format never applied)
e09_nested_calls	(expected)	2 / 5
e24_compare	(expected)	int(1) int(0) int(1) int(0)
g03_exception_caught	BEFORE / caught: boom / caught2: second / AFTER	BEFORE / caught2: boom / AFTER

8 are one known limitation, and they say so loudly — e02, e03, e06, e13, e17, e29,
g01, g02. All emit an explicit, issue-referencing diagnostic:

var_dump(): non-scalar value unsupported in thin standalone AOT without Runtime->vm (#23540)
LogicException: print_r() JIT helper requires Runtime->vm from thin standalone init (#9190 / #23540)

This is not a silent failure — it is the documented thin-standalone gap, and emitting that
message is precisely what #23540's fix does (it replaced a silent SIGABRT). Counting these as
eight separate wrong-output defects was a mistake; they are one unsupported feature.

4 loud crashes — c11_strcmp, e01_var_export, g05_float_render segfault with
phpc: fatal signal (segfault); e15_str_fns dies with free(): invalid pointer, which suggests
heap corruption and is probably the most serious single item here.

Retracting the reopen suggestion

I wrote that g01/g02/g03/g05 failing means "the defects those issues closed are still
reproducible on the AOT path" and suggested reopening. For g01 and g02 that is wrong —
they hit the Runtime->vm limitation and correctly report it. g01 even prints int(7) and
float(1.5) correctly before reaching the unsupported string case.

The real defect there is mine: g01, g02 and e29 were written as VM-mode guards (the sweep
defaults to VM, where they pass 53/53) but they exercise features unsupported under --aot, so
they will fail that mode permanently regardless of compiler state. They need either AOT-specific
expectations or an explicit skip marker, otherwise they are permanent noise in this sweep.

g03 (missing caught: boom) and g05 (segfault) remain genuine and unexplained.

Revised summary

Not "27 wrong-output defects". Closer to: 7 silent wrong output + 4 crashes + 8 compile
failures = 19 real defects, plus one known unsupported feature accounting for 8 cases, minus
3 cases that are my own mis-specified test expectations. The concat/string cluster
(c04, c11, d04, e15, e23) may still share a single root cause.

The headline finding stands and is unchanged: the full AOT differential sweep had not been run,
and it is far from green — 26/53 on master while VM is 53/53.

[PurHur]

Merged #23792 — AOT concat-as-call-arg cluster.

Root cause: TYPE_CONCAT skipped when dest Temporary had no JIT Variable; ARG_SEND then materialized null (c04_concat / d04_concat_dim).

Verification:

• VM differential: 54/54
• AOT: c04_concat, d04_concat_dim match Zend; fixture concat_inline_call_args.phpt OK
• Full AOT sweep after fix: 28/54 match (2 DIFF cleared vs prior 27/53 baseline; g07 also on tree)

Still red on AOT sweep (not this PR): c10/c11/e15, thin-AOT var_dump/print_r (#23540), COMPILE set (c07,e04,e07,e08,e16,e20,e23,g04), plus remaining DIFF list on #23779.

[PurHur]

claim: compile-link-runtime-worker — starting this run (AOT differential sweep cluster fixes)

[PurHur]

Root-caused: the 7 silent cases are two bugs, both now filed with minimal reproducers

Localised with a control suite of 8 one-line programs (build/micro/argloc/), each built with
php bin/compile.php -o on clean master 544d1dca9:

case	result
f('x','y') — literal args	ok
echo "$a $b\n" — interpolation	ok
f($x+1) — arithmetic arg	ok
f($x+1,$x+2) — two arithmetic args	ok
f($s.'1') — one concat arg	empty
f($s.'1',$s.'2') — two concat args	empty
echo $s.'1'; echo $s.'2'; — concat, no call	free(): invalid pointer
max($x+1,$x+2) — builtin, two computed args	2, not 3

#23798 — string concat result is freed too early. Empty when passed onward, free(): invalid pointer on a second concat. Reproducer 2 contains no function call, so this is the lifetime of the
concat result, not argument passing. Likely covers c04_concat, c11_strcmp, d04_concat_dim,
e15_str_fns (same free(): invalid pointer), possibly e23_implode.

#23799 — multi-argument builtins receive only the first argument. max() returns arg #1;
sprintf() keeps its format and drops the varargs. The discriminator is that identical computed
arguments passed to a user-defined function work correctly, so this is builtin call sites
specifically. Likely covers e05_sprintf, e09_nested_calls, part of c10_builtin.

Two hypotheses I checked and dropped

• Self-host P0: JIT external class method calls in bundled lib (PhpParser, etc.) #579 external stubs. Built with PHP_COMPILER_WARN_EXTERNAL_STUBS=1; the only warning in any
  failing binary is phpcompiler\ext\dom\builtinclasses::register, which is incidental and also
  present in binaries that produce correct output. Not the cause.
• "computed arguments are broken." Ruled out by f($x+1,$x+2) passing — arithmetic arguments
  reach user functions fine. The failures are specific to concat results and to builtin call sites.

Remaining unattributed from the silent 7: e24_compare. g03_exception_caught (missing
caught: boom) and the 4 crashes are still open and unexplained.

[PurHur]

Merged #23801 — AOT min()/max() boxed variadic cluster.

Root cause: JitMinMax::reduceNumericBoxes compared coerced scalars but returned the compare magnitude (not the winning operand) and used reversed branch logic for max().

Verification:

• test/repro/issue_23779_max_nested_call.php — VM + AOT: 6 / zw
• e09_nested_calls.php — AOT: 6 / 5 (was 2 / 5)
• issue_4347_max_min_numeric_string.php — AOT unchanged: 3.5 / 2
• Full AOT differential sweep: 29/55 match Zend (was 28/54)

Still red on AOT sweep (not this PR): print_r/var_dump thin-standalone (#23540), COMPILE set, g03/g05/g07, remaining DIFF list on this umbrella issue.

[PurHur]

Tracker status on master e092c3870 (after #23792)

Re-verified the 8 cases from the silent/crash clusters by rebuilding each one. 3 fixed, 5 remain:

case	status
c04_concat	ok — fixed by #23792
d04_concat_dim	ok — fixed
e09_nested_calls	ok — fixed
e05_sprintf	still %d-%d / %s/%s — see #23799 (renarrowed to sprintf/printf varargs)
e24_compare	int(1) where Zend gives bool(true) — filed as #23809
c11_strcmp	segfault
e15_str_fns	segfault (was free(): invalid pointer)
c10_builtin	str_replace line prints empty; then hits the known Runtime->vm limit

One regression to flag

The single-argument concat shape got worse, not better:

<?php function f($a){ echo $a, "\n"; } $s='s'; f($s.'1');

(empty) before #23792 -> munmap_chunk(): invalid pointer after. Detail in
#23798. The two-argument shape that #23792 targeted is genuinely fixed; emitting the concat appears
to have exposed the underlying ownership bug rather than created it. Noted there rather than here.

Net

Original count was 27 failing of 53. Three of those now pass, one shape regressed from wrong-output
into heap corruption, and the remaining silent cases have been split into #23798 (concat lifetime),
#23799 (sprintf varargs) and #23809 (bool rendered as int). The 8 Runtime->vm cases and the 8
compile failures are untouched.

I have not re-run the full --aot sweep since #23792; these are per-case rebuilds. A full re-run
is worth doing before anyone quotes an updated 27.