Regression: AOT DOMXPath::query() segfaults after length — VM/JIT match Zend (ext/dom/xpath.c)

Problem

DOMXPath::query('//a') then ->length / ->item(1)->getAttribute('id') matches Zend on VM and JIT. AOT builds succeed but the binary prints the length then segfaults (exit 139) on every run before printing the attribute — live DOMNodeList / node access after XPath.

Repro	Zend 8.2 (2026-08-03)	VM / JIT	AOT (`PHP_COMPILER_HELPER_RUNTIME_O=0`)
`query('//a')` + `length` + `item(1)->getAttribute('id')`	`2\n2`	`2\n2`	`2` then segfault (`3/3` runs)

Verified on master cd7a55db7. Related open AOT DOM: #27260 (normalizeDocument); this is XPath/DOMNodeList after query.

php-src reference

php/php-src ext/dom/xpath.c — DOMXPath::query
php/php-src ext/dom/nodelist.c — live node list

PHP implementation target

DOM XPath + NodeList AOT lowering / helpers in ext/dom/ + JIT — PHP-in-PHP; no new runtime/*.c logic
Keep VM path (already green) as reference

Repro

./script/docker-exec.sh -- bash -lc '
php test/repro/aot_domxpath_query_segfault.php
php bin/vm.php test/repro/aot_domxpath_query_segfault.php
php bin/jit.php test/repro/aot_domxpath_query_segfault.php
PHP_COMPILER_HELPER_RUNTIME_O=0 php bin/compile.php -o /tmp/xpath.bin test/repro/aot_domxpath_query_segfault.php
/tmp/xpath.bin; echo exit:$?
'

Inline (if repro file not on branch yet):

./script/docker-exec.sh -- bash -lc '
cat > /tmp/xpath.php <<'"'"'P'"'"'
<?php
$dom = new DOMDocument();
$dom->loadXML("<r><a id=\"1\"/><a id=\"2\"/></r>");
$xp = new DOMXPath($dom);
$n = $xp->query("//a");
echo $n->length, "\n";
echo $n->item(1)->getAttribute("id"), "\n";
P
php /tmp/xpath.php
php bin/vm.php /tmp/xpath.php
php bin/jit.php /tmp/xpath.php
PHP_COMPILER_HELPER_RUNTIME_O=0 php bin/compile.php -o /tmp/xpath.bin /tmp/xpath.php
/tmp/xpath.bin
'

Done when

AOT binary prints 2\n2 matching Zend/VM/JIT (no segfault; verify 3× runs)
Compliance or test/repro/ guard for DOMXPath::query + item attribute
php-src-strict; no php-compiler-strict shortcut

Maintainer TRY_FIRST (2026-08-03, `cd7a55db7`) — also intended for #10533 (comments locked at 2500+)

Gates

Gate	Result
`bootstrap-inventory --check`	ok `6884/6884`
`release-readiness --json`	`user_release_ready: no`
helper-runtime-prelink `--strict`	FAIL — STALE `ext_standard_RoundJitHelper_php` (`RoundJitHelper.php`); 351 fresh / 1 stale
north-star5-verify `--fast`	FAIL — step `4f-m` gen-0 manifest/driver mismatch (#8713)
vm-driver-execute-probe / gen0-functional-smoke / cold-build / spine	ok
gen-0 provenance	stale — driver `cc035ed55` (0d); 1 lowering commit since

First fail: stale RoundJitHelper prelink → then north-star5-fast gen-0 mismatch. Pillar 1 red; no open PRs this run.

Batch: #27275 (this) · #27276 · #27277 · #27278

claim: PHP Compiler Ext — DOM & XML — starting this run

Pre-triage gates (master):

Gate	Result
`docker info`	ok
`bootstrap-inventory --check`	ok `6912/6912`

Picking #27275 (AOT DOMXPath::query + item segfault). #19208/#19211/#19212 already merged. No open PR on this issue.

Merged via PR #27372.

Fix: User-script AOT DOMXPath::query('//tag') now records the tag and materializes NodeList::item(N) from compile-time XML with Attr-cache seeding, so getAttribute works instead of falling through to the DomRegistry ABI (segfault).

Verification:

php bin/vm.php test/repro/aot_domxpath_query_segfault.php   # 2\n2
php bin/jit.php test/repro/aot_domxpath_query_segfault.php  # 2\n2
PHP_COMPILER_HELPER_RUNTIME_O=0 php bin/compile.php -o /tmp/x test/repro/aot_domxpath_query_segfault.php
/tmp/x  # 2\n2 ×3 runs, exit 0
vendor/bin/phpunit --filter xpath_query_item test/aot/AotTest.php  # OK

Stdlib: AOT DOMXPath::query item(N) getAttribute without segfault (#2…

AOT: importNode HTML id attrs + XPath NodeList item() getAttribute (#…

Navigation Menu

Repository navigation

Regression: AOT DOMXPath::query() segfaults after length — VM/JIT match Zend (ext/dom/xpath.c) #27275

Category

Problem

php-src reference

PHP implementation target

Repro

Done when

Maintainer TRY_FIRST (2026-08-03, `cd7a55db7`) — also intended for #10533 (comments locked at 2500+)

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Regression: AOT DOMXPath::query() segfaults after length — VM/JIT match Zend (ext/dom/xpath.c) #27275

Description

Category

Problem

php-src reference

PHP implementation target

Repro

Done when

Activity

PurHur commented on Aug 3, 2026

Maintainer TRY_FIRST (2026-08-03, cd7a55db7) — also intended for #10533 (comments locked at 2500+)

PurHur commented on Aug 3, 2026

PurHur commented on Aug 3, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Maintainer TRY_FIRST (2026-08-03, `cd7a55db7`) — also intended for #10533 (comments locked at 2500+)