Regression: AOT quotemeta() segfaults after build — VM/JIT match Zend (ext/standard/string.c)

[PurHur]

Category

bug · php-src-strict · AOT · pillar 4

Problem

quotemeta() matches Zend on VM and JIT (a\.b), but the AOT binary builds then segfaults before printing.

Repro	Zend / VM / JIT (2026-08-02, 712a1e64a)	AOT bin/compile.php
echo quotemeta("a.b")	a\.b	builds; run → phpc: fatal signal (segfault) after c:main_before_php (exit 139)

Prior routing work (#21589) closed; this is a fresh AOT runtime crash on master.

php-src reference

• php/php-src ext/standard/string.c — PHP_FUNCTION(quotemeta)
• php/php-src ext/standard/basic_functions.stub.php — quotemeta

PHP implementation target

• ext/standard string helpers + AOT/JIT call path in lib/JIT — PHP-in-PHP
• Fix the standalone/AOT value/string ABI; do not paper over with new C

Repro

./script/docker-exec.sh -- bash -lc '
cat > /tmp/aot_quotemeta.php <<'"'"'PHP'"'"'
<?php
echo quotemeta("a.b"), "\n";
PHP
echo -n "zend="; php /tmp/aot_quotemeta.php
echo -n "vm="; php bin/vm.php /tmp/aot_quotemeta.php 2>/dev/null
echo -n "jit="; php bin/jit.php /tmp/aot_quotemeta.php 2>/dev/null | grep -v Deprecated
php bin/compile.php -o /tmp/aot_quotemeta /tmp/aot_quotemeta.php && /tmp/aot_quotemeta
'

Done when

• AOT binary prints a\.b matching Zend/VM/JIT
• Prefer --repeat 10 on the built binary before claiming fixed (heap crashes are intermittent)
• Compliance or test/repro/ guard
• php-src-strict; no php-compiler-strict shortcut

[PurHur]

claim: PHP Runtime → PHP — starting this run

Pillar 1: user_release_ready=no on this host (north-star5-fast gen-0 4f-m) — #27860 claimed by trust-gate lane (container already green elsewhere); not stealing.

This run: #27011 AOT quotemeta segfault — peer #27007/#27862 strrev self-contained NestedJIT helper (QuotemetaJitHelper still calls VmString::quotemeta).

[PurHur]

Merged via #27867

Verification

• AOT test/repro/issue_27011_aot_quotemeta.php ×10 — match Zend (a\.b, \$x\+y, …)
• vendor/bin/phpunit --filter 'QuotemetaRuntimeShrinkTest|QuotemetaAot27011Test' — OK (4 tests, 44 assertions)

PHP-in-PHP / C shrink

• No new C; deleted VmString call from NestedJIT helper path
• QuotemetaJitHelper is StrRot13-shaped self-contained match escape; refreshed helper-runtime unit.o