Repository navigation
Regression: AOT negative bit shift returns huge int — Zend/VM ArithmeticError (zend_operators.c) #29751
Description
Category
Regression · php-src-strict · AOT bit-shift guards
Problem
$a << -1 (and likely >>) under AOT yields a large integer instead of throwing ArithmeticError: Bit shift by negative number. Zend 8.4 and VM throw.
Probed 2026-08-10 — AOT via bin/compile.php vs PROFILE=8.4 VM / php:8.4-cli.
| Repro | Zend 8.4 / VM | AOT |
|---|---|---|
$a=1; $a << -1 |
ArithmeticError: Bit shift by negative number |
281474976710656 (no throw) |
Related (closed, different): #21912 (VM try/catch bypass) — this is AOT missing the Error entirely.
php-src reference
- php/php-src
Zend/zend_operators.c— shift helpers / negative-countArithmeticError - Prior: Language: negative bit shift ArithmeticError bypasses try/catch (Zend/zend_operators.c) #21912
PHP implementation target
lib/AOT//lib/JIT/shift lowering — guard negative count; throw Zend-shapedArithmeticError- PHP-in-PHP; no new C in
runtime/
Repro
./script/docker-exec.sh -- bash -lc 'cat > /tmp/aot_shift.php <<'"'"'PHP'"'"'
<?php
try {
$a = 1;
var_export($a << -1);
echo "\n";
} catch (Throwable $e) {
echo get_class($e), ": ", $e->getMessage(), "\n";
}
PHP
PHP_COMPILER_PROFILE=8.4 php bin/compile.php -o /tmp/aot_shift /tmp/aot_shift.php && /tmp/aot_shift'
# expect: ArithmeticError: Bit shift by negative number
# actual: 281474976710656Done when
- AOT
<</>>with negative count throw Zend-shapedArithmeticError - Compliance
.phptguard - php-src-strict; VM remains green
Activity
PurHur commentedon Aug 10, 2026
claim: Worker lane A — starting this run
Gate snapshot (before claim):
Focus: AOT negative bit shift → ArithmeticError (Zend/VM parity).
Language: AOT negative << / >> throw catchable ArithmeticError (#29751)…
PurHur commentedon Aug 10, 2026
Merged #29793
Verification
ArithmeticError: Bit shift by negative numbervendor/bin/phpunit --filter negative_bit_shift test/aot/AotTest.php→ OKFix: re-bind try-body
Block::$constants(folded-1from UnaryMinus) over empty TYPE_TRY parent-hoist placeholders inmakeVariableFromOp/getVariableFromOp.