Language: By-reference parameters JIT/AOT lowering (phase 2 post-#140)

[PurHur]

Category

language

Problem

By-reference parameters and foreach ($a as &$v) compile on VM (TYPE_INDIRECT / ref slots) but remain JIT/AOT deferred per docs/capabilities-syntax.md:

By-reference parameters (function f(&$x)) | VM yes | JIT no | AOT no | #140

#140 closed VM v1; this issue tracks LLVM lowering so ref semantics are not VM-fallback-only.

php-src reference

• Zend/zend_compile.c — zend_compile_param() by_ref flag
• Zend/zend_execute.c — ZVAL_MAKE_REF, argument binding by reference
• Zend/zend_operators.c — foreach by-reference iterator

Repro (today)

<?php
function inc(int &$n): void { $n++; }
$x = 1;
inc($x);
echo $x;

# VM — passes
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php repro.php'
# JIT — fails or VM-fallback
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/jit.php repro.php'

Expected (Zend): prints 2 in all modes.
Actual: JIT path does not preserve alias through compiled call (see docs/capabilities-syntax.md row).

Foreach by-ref (also deferred):

<?php
$a = [1, 2];
foreach ($a as &$v) { $v *= 2; }
echo implode(',', $a);

Scope (this repo)

• lib/Compiler.php — propagate ref flags into call sites (already on VM)
• lib/JIT.php, lib/JIT/Call/Native.php — pass pointer/TYPE_INDIRECT slots for by-ref formals
• lib/JIT/Builtin/Type/Object_.php — ref property writes where applicable
• AOT: same IR as JIT via shared lowering
• Compliance: extend test/compliance/cases/ref_param.phpt, foreach_by_ref.phpt for JIT/AOT sections

Done when

• Repro scripts match Zend under bin/jit.php and AOT-linked binary
• ./script/ci-local.sh --filter 'ref_param|foreach_by_ref' green for VM + JIT
• php script/capability-syntax.php updates JIT/AOT columns for by-ref row

Dependencies

• Language: Reference assignment and by-ref parameters #140 ✅ VM ref params / foreach-by-ref
• Language: foreach by-reference ($k => &$v) #1222 ✅ foreach by-reference VM

Links

• Wave 2 tracker: #1238
• North star: #1492

[PurHur]

claim: cursor-agent-lane-c — starting this run

[PurHur]

PR #3169: JIT by-ref param lowering (value* alias at call + callee, load/assign through valueBoxAliasPtr). VM compliance green; MCJIT execute on this harness still hits pre-existing segfault on bin/jit.php — compile path fixed (no Unsupported cast / valuePtrFromVariable on ref calls).