REGRESSION: AOT ++/-- no longer applies — $n-- is a no-op, for-loop counters produce wrong results, one case hangs

[PurHur]

Severity

On master 1608e74f9, ++ and -- do not take effect in AOT binaries. This affects the most
basic loop in PHP and produces silent wrong output. One case spins forever.

VM is unaffected. This is a regression: build/micro/m_loop.php
(for ($i = 0; $i < 1000000; ++$i) { ++$a; }) printed 1000000 correctly earlier today.

Reproducers

All built with php bin/compile.php -o <bin> <file> in php-compiler:22.04-dev, LLVM 9. No
resources open in most of them — this is not resource-related.

program	Zend	AOT
$n = 0; $n--; echo $n;	-1	0
$n = 5; $n--; echo $n;	4	5
$n = 0; --$n; echo $n;	-1	0
$n = 0; $n--; $n--; echo $n;	-2	0
$n = 1; $n--; $n--; echo $n;	-1	1
$acc=0; for ($i=0;$i<5;++$i) { ++$acc; } echo $acc;	5	0

The decrement is a complete no-op — the variable keeps its initial value. The loop case
produces 0, so either the body never executes or ++$acc does not apply.

One case hangs

test/differential/cases/g07_incdec_resource_provenance.php compiled and then spun at 99% CPU
for 27 minutes before I killed it. It terminated normally in runs earlier today, producing wrong
but finite output. Anything running the AOT sweep should be aware that a case can now hang rather
than fail — my sweep script had timeout on the compile but not on the run, which is how this went
unnoticed for half an hour.

Attribution

Bisect in progress; I am not attributing this to any commit yet. Candidate range is
544d1dca9..1608e74f9, which includes:

• 371ada701 — Perf: skip the ++/-- resource guard when the value cannot be a resource (#23483) #23781, my own change (skips the ++/-- resource guard when the value provably
  cannot be a resource). It is a prime suspect precisely because it touches this path, and I am
  testing it first with lib/ reverted.
• 5ec8a4453 — AOT: TypeError on ++/-- of live fopen resources (#23777) #23794 (AOT: ++/-- on a live resource silently succeeds instead of raising TypeError (#6396 guard never fires at top-level scope) #23777), TypeError on ++/-- of live resources; also touches ++/--.
• a16c8f1d8 — AOT: fix concat ephemeral temp lifetime for dead echo/call operands (#23798) #23827 (AOT: string concat result is freed too early — empty when passed to a function, free(): invalid pointer on reuse #23798), concat ephemeral temp lifetime / entry alloca for dead operands.

I will post the bisect result and, if it is mine, revert it immediately.

Suggested guard once fixed

There is currently no differential case covering plain --. g07 covers ++/-- but is
marked @differential-skip-aot pending #23811, so it does not gate the AOT path. A trivial
$n = 5; $n--; case would have caught this.

[PurHur]

claim: compile-link-runtime agent — starting this run (lane B empty; Pillar 1 green)

[PurHur]

Attributed: this is my regression, from #23781

Isolated it by forcing IncDecResourceProvenance::cannotBeResource() to return false on current
master — that restores exactly the pre-#23781 behaviour (guard always emitted) with every other
commit in place, avoiding the lib/-only revert which no longer compiles against master's ext/.

	$n = 5; $n--;	for ($i=0;$i<5;++$i){++$acc;}
provenance on (master)	5 — wrong	0 — wrong
provenance off (pre-#23781)	4 — correct	5 — correct

Unambiguous. Sorry — #23781 is mine and this is the fallout.

Why it only shows at top level

build/micro/m_loop.php has its loop inside a function and still prints 1000000 correctly.
Every failing case here is top-level code. That is the tell: #23794 (#23777) added a third
guardIncDecResourceOperand() call site as the fall-through for shapes that miss the typed
buckets — top-level fopen() handles among them — and top-level ++/-- goes through it.

My provenance bail-out sat at the top of that function, so it skipped

$longVal = $this->context->helper->loadValue($read);          // TYPE_NATIVE_LONG
$readPtr = JIT\JitValueBox::valuePtrFromVariable($context, $read);   // TYPE_VALUE

Those calls materialise the operand's storage. Without them the subsequent
assignOperand($writeOp, ...) resolved to a different slot, so the new value was stored somewhere
the following read never looked at — hence "the decrement is a complete no-op". It was never about
resources at all, which is why cases with no fopen() fail identically.

Fix

Move the bail-out to after the load rather than before it. The load is cheap; the expensive
part is nativeLongIsResource(), which calls into StreamLifecycleJitHelper and walks four handle
registries. Skipping only that preserves the entire #23483 speedup while keeping the
materialisation side effect.

Testing now: all 8 reproducers here, plus m_loop for the perf number that motivated #23781
(must stay ~8ms, not regress to 135ms), plus Ack(3,9), then the full VM and AOT differential
sweeps. PR to follow — I am not proposing this until those pass.

How this got through

#23781's gates were VM 53/53 and an AOT failing-name diff — both clean, and both blind here:

• Every ++/-- differential case is inside a function, so nothing exercised the top-level path.
• g07, the one case with top-level ++/--, was not actually run by the sweep I cited (see
  my correction on Perf: skip the ++/-- resource guard when the value cannot be a resource (#23483) #23781), and is now @differential-skip-aot pending AOT: string conversion of an int renders "Resource id #N" when the value collides with a live handle #23811.

So the coverage gap and the false gate claim compounded. Adding a top-level $n = 5; $n--; case as
part of the fix.

[PurHur]

Merged via #23844.

Root cause: #23781 (371ada701) — cannotBeResource() early-return inside guardIncDecResourceOperand() broke post-decrement for TYPE_VALUE KIND_VALUE locals that fell through to generic binaryOp lowering (silent no-op).

Fix: isIncDecValueBoxLvalue() routes scoped boxed locals through __value__writeLong inc/dec; removed the in-guard cannotBeResource early return.

Verified: $n=5; $n--; AOT prints 4; script/differential-sweep.sh --aot g08 1/1; vendor/bin/phpunit --filter incdec_post_dec_local OK.

[PurHur]

Cleanup hygiene (2026-07-27): deleted leftover remote fix/23840-toplevel-incdec (closed unmerged PR #23843). The fix already landed via merged #23844; tip was not an ancestor of master only because of squash/alternate PR, not recoverable unique work.