AOT: str_pad() segfaults — three-argument literal call is enough #23911

Summary

str_pad() segfaults in an AOT binary. A single call with all literal arguments is enough; no
computed arguments, no variables, no other code required.

VM is unaffected.

Reproducer

<?php echo str_pad('p', 5, '-'), "\n";

zend: p----
aot : phpc: fatal signal (segfault) after c:main_before_php

Argument form is irrelevant

So this is not the computed-argument / packed-argv path that #23871 was about. str_pad itself is
broken.

substr() is fine, for contrast

Same file shape, same argument forms, no crash:

<?php echo substr('abcdefgh', 1, 4), "\n";          // ok — bcde
<?php $x=3; echo substr('abcdefgh', $x-2, $x+1), "\n";  // ok — bcde

That narrows it to str_pad's own lowering rather than string builtins generally.

Note on the marker

The crash reports after c:main_before_php, i.e. it does not reach user code output. Worth checking
whether the fault is at the call site or in str_pad's emitted body/registration.

Blast radius

Accounts for two standing AOT differential failures:

• c11_strcmp.php — str_pad('p',$x+2,'-') then substr(...)
• e15_str_fns.php — str_pad($s,$n+13,".") then substr(...) then str_replace(...)

Both were previously recorded only as "segfault" at case level; this pins the function.

Environment: php-compiler:22.04-dev, PHP 8.2.32, LLVM 9, php bin/compile.php -o <bin> <file>,
master 055356698. Reproducers in build/micro/strfn/.