AOT: argument spread — silent wrong output into fixed params, and variadic $v is not a usable array

[PurHur]

Summary

Argument unpacking (f(...$args)) is broken in three distinct ways, one of which is silent wrong
output. VM is unaffected.

Note e08_spread in the corpus passes, so the sweep is currently green on this feature. The cases
below show that pass is shallow.

1. Fixed untyped params — silent wrong output

<?php function s3($a, $b, $c) { return $a+$b+$c; } $p=[1,2,3]; echo s3(...$p), "\n";

zend: 6
aot : 0

No error. The arguments arrive as zero.

2. Fixed typed params — compile failure

<?php function s3(int $a, int $b, int $c): int { return $a+$b+$c; } $p=[1,2,3]; echo s3(...$p), "\n";

zend: 6
aot : Unsupported cast for arg type int64 from __hashtable__*

The message is the tell for both #1 and #2: the hashtable itself is reaching the parameter slot
instead of its elements. Typed params catch it as a cast error; untyped params silently accept it
and produce 0.

3. Variadic — collected $v is not a usable array

<?php function sv(...$v) { echo array_sum($v), "\n"; } $p=[1,2,3]; sv(...$p);

zend: 6
aot : Object

array_sum($v) prints Object. So the variadic pack is not a PHP array.

Why e08_spread passes anyway

<?php function s(...$v){ echo implode(",", $v), "\n"; } $p=[1,2,3]; s(...$p); s(0, ...$p);

That case only ever feeds $v to implode(), which evidently tolerates whatever $v actually is.
Swap in array_sum() — same function, same call, same spread — and it breaks. The corpus case was
added with #23971 and is not wrong to exist; it just does not reach past implode.

Summary of shapes

shape	AOT
spread → fixed untyped params	0 — silent wrong output
spread → fixed typed params	compile failure, Unsupported cast … from __hashtable__*
spread → variadic, array_sum($v)	Object — pack is not an array
spread → variadic, implode(",", $v)	ok (this is e08_spread)

Deterministic — 0/3 runs matched on each failing shape.

Context

Environment: php-compiler:22.04-dev, PHP 8.2.32, LLVM 9, master 412a8cf79. Reproducers in
build/micro/x/.

[PurHur]

Correction: shape #1 does not reproduce — my measurement was contaminated

Spread into fixed untyped params is fine. I reported it as silent wrong output (0 instead of
6). Re-measured on the same master, alone:

y4_spread_untyped.php   ok   (10/10 runs)     # byte-identical program to the reported repro
k08_spread_fixed_params ok   (3/3 runs)       # same program, multi-line formatting

10/10 and 3/3. The original 0/3 came from a probe batch that was running concurrently with a
second sweep container against the same bind-mounted repo, so both were building through the same
helper-runtime cache in /app. That is my process error, not a compiler defect, and shape #1 should
be struck from this issue.

Worth recording beyond this issue: two sweep containers sharing one bind mount can produce a clean,
repeatable-looking wrong answer. Some past "flaky case" attributions may deserve a second look.

The other two shapes stand — both re-measured alone

Typed fixed params — compile failure (measured in an uncontended run):

<?php function s3(int $a, int $b, int $c): int { return $a+$b+$c; } $p=[1,2,3]; echo s3(...$p), "\n";

Unsupported cast for arg type int64 from __hashtable__*

Variadic pack is not a usable array (k09, uncontended, 0/3 matched):

<?php function sv(...$v) { echo array_sum($v), "\n"; } $p=[1,2,3]; sv(...$p);

zend: 6
aot : Object

e08_spread still passes because it only feeds the pack to implode().

Revised summary

shape	AOT
spread → fixed untyped params	ok — 10/10 (was wrongly reported as 0)
spread → fixed typed params	compile failure, Unsupported cast … from __hashtable__*
spread → variadic, array_sum($v)	Object — pack is not an array
spread → variadic, implode(",", $v)	ok (e08_spread)

Retitling would be reasonable: the remaining defects are the typed-param cast and the variadic pack
representation, not spread-into-fixed-params generally.

[PurHur]

claim: Lane C implementer — starting this run

TRY_FIRST (this workspace, 2026-07-28):

Gate	Status	Symptom
bootstrap-inventory --check	ok (via release-readiness)	OK 6609/6609
release-readiness --json	red	user_release_ready: no; spine-coverage missing RuntimeIndirectStaticMethodCall.php; north-star5-fast fail
vm-driver-probe	ok
Target	#24167	AOT argument spread / variadic

[PurHur]

Merged #24202.

Fix: variadic ARG_RECV now boxes the packed __hashtable__* into a TYPE_VALUE array local (HashTableHelper::boxedArrayFromHashtable) so array_sum($v) after sv(...$p) sees a normal array operand — implode() already tolerated raw HT via loadHashTable, which is why e08_spread passed while k09 printed Object.

Also: compile-time call unpack routes through VmNamedArgs::resolve; lone HT from compile-time unpack expands for fixed-arity Native (typed spread).

Verified (VM):

php bin/vm.php test/differential/cases/k09_spread_variadic_array.php  # 6
php bin/vm.php test/differential/cases/k10_spread_typed_fixed_params.php  # 6
php vendor/bin/phpunit test/unit/CallUnpackRuntimeShrinkTest.php  # OK

AOT compile exits 0; binary run blocked in harness (tier-1 AOT smoke exit 139 on master here). Re-run script/differential-sweep.sh --aot on a host with green tier-1 smoke.

[PurHur]

Still reproducing on master e9df7b25c after #24202

#24202 ("box variadic spread pack for array builtins") is merged, but the corpus case for this issue
is unchanged:

<?php function sv(...$v) { echo array_sum($v), "\n"; } $p = [1, 2, 3]; sv(...$p);

zend: 6
aot : Object

Measured directly on master with the fix in, not from a cached sweep — php then the compiled
binary, back to back:

$ php test/differential/cases/k09_spread_variadic_array.php     ->  6
$ ./k09.bin                                                     ->  Object

and k09_spread_variadic_array remains DIFF (0/3 runs matched) under --repeat 3 run alone.

The other two shapes from this issue do look addressed — I have not re-measured them individually
since the corpus only pins this one. Reopening for the variadic-pack shape specifically; if #24202
targeted a different call path, this may be worth splitting into its own issue rather than tracking
here.

Note the earlier retraction on this issue still stands: spread into fixed untyped params was
never broken, that measurement was contaminated.

[PurHur]

Cleanup bot — releasing stale claim

Prior Lane C claim: is stale after #24202: remaining silent-wrong-output / fixed-param spread cases still open (2026-07-28T08:22Z) with no open PR. Claim released.

[PurHur]

claim: Lane C implementer — starting this run

TRY_FIRST (this workspace, 2026-07-28):

Gate	Status	Symptom
docker info	ok
bootstrap-inventory --check	red/partial	docs drift (committed inventory stale vs tree; construct-flag diffs in JIT/VM)
release-readiness --json	running	awaiting
Target	#24167	AOT variadic spread pack still prints Object after #24202