Repository navigation
Regression: AOT DOMDocument::replaceChild() segfaults after build — VM/JIT match Zend (ext/dom/node.c) #27216
Description
Category
Regression · php-src-strict · AOT · pillar 4 (DOM live-node)
Problem
DOMDocument::replaceChild matches Zend on VM/JIT (1:b), but thin AOT builds then segfaults (exit 139) before useful stdout — live DOM mutation gap (2026-08-03, 6a5b2fc66).
| Repro | Zend / VM / JIT | AOT |
|---|---|---|
replace <a> with <b> under <root>; print childNodes->length:firstChild->nodeName |
1:b |
segfault (139) after c:main_before_php |
Peer open Dom AOT: #27108 (Dom\\Attr::rename / createFromString — WIP #27151 still segfaults on living nodes).
php-src reference
- php/php-src
ext/dom/node.c—dom_node_replace_child/DOMNode::replaceChild
PHP implementation target
- Living Dom node graph under thin AOT / NestedJIT —
replaceChildmust update child lists andfirstChildlike VM (ext/dom+lib/JITDom helpers) - No new
runtime/*.cDOM mutation logic; keep PHP-in-PHP
Repro
./script/docker-exec.sh -- bash -lc '
cat > /tmp/aot_dom_replace.php <<'"'"'PHP'"'"'
<?php
$d = new DOMDocument();
$r = $d->appendChild($d->createElement("root"));
$a = $r->appendChild($d->createElement("a"));
$b = $d->createElement("b");
$r->replaceChild($b, $a);
echo $r->childNodes->length, ":", $r->firstChild->nodeName, "\n";
PHP
php /tmp/aot_dom_replace.php
php bin/vm.php /tmp/aot_dom_replace.php
php bin/jit.php /tmp/aot_dom_replace.php
PHP_COMPILER_HELPER_RUNTIME_O=0 ./phpc build -o /tmp/aot_dom_replace /tmp/aot_dom_replace.php && /tmp/aot_dom_replace
'Done when
- AOT prints
1:bmatching Zend/VM/JIT - Prefer
--repeat 10(segfault / heap class) - Repro/compliance guard; php-src-strict only
Activity
PurHur commentedon Aug 3, 2026
Verified locally before filing (
6a5b2fc66): Zend/VM/JIT print1:b; thin AOT builds then exit 139 (fatal signal … after c:main_before_php). Gate context for the run (also on #27204 — #10533 comments locked):user_release_ready: no(helper-runtime prelink stale + north-star5-fast4f-m).PurHur commentedon Aug 3, 2026
claim: PHP Compiler Ext — DOM & XML — starting this run
Gate snapshot before claim:
php script/bootstrap-inventory.php --check→ OK 6883/6883release-readiness --jsonstill running; will paste when availablereplaceChild)Stdlib: AOT replaceChild after createElement without DomRegistry (#27216
PurHur commentedon Aug 3, 2026
Merged in #27247
Verification: Zend/VM/JIT/AOT print
1:b; AOT repeat 10/10; AotTestdom_node_replacechild*OK (2); #27044 live length still green.Cause: thin-AOT
createElementLLVM materialize has no DomRegistry; NestedJIT replaceChild bridge segfaulted. Fix syncs live child slots like append and seedschildNodeslength when unset.DOM: fix AOT insertBefore live childNodes/firstChild/parent (#27449) (#…