AOT: inherited property defaults are not initialised — every subclass loses its parent's defaults

[PurHur]

What

Under AOT, a property default declared on a parent class is not applied when a subclass is instantiated. Instantiating the parent directly works, so this is specific to inheritance.

Both typed and untyped properties are affected. The untyped case degrades to a warning plus empty output, which is the silent-wrong-output class this project treats as the characteristic bug (AGENTS.md §3).

Repro

<?php
class A { public string $p = 'hi'; }
class B extends A {}
echo (new B)->p;

Measured in php-compiler:22.04-dev, on a tree containing the AOT link fix from #31894 (without it nothing links at all):

case	Zend 8.2.32	AOT
class A { public string $p = 'hi'; } (new A)->p	hi	hi ✓
class B extends A {} (new B)->p — typed	hi	PHP Fatal error: Uncaught Error: Typed property A::$p must not be accessed before initialization
class B extends A {} (new B)->p — untyped	hi	PHP Warning: Undefined property: A::$p then empty

Note the error names A::$p — the declaring class — so the property appears to be registered against the parent while the subclass's instance initialisation never writes the default.

Why it matters

This is not an edge case. Any class hierarchy where a base class declares a property with a default is broken under AOT, which is most real PHP code. The untyped variant produces wrong output rather than an error, so a program can silently compute the wrong answer.

How it was found

Two other AOT defects reported around the same time — var_dump aborting with rc=134 and Exception::getMessage() segfaulting — turned out to be symptoms of the duplicate-memset link failure in #31894 and now match Zend exactly. This one survives that fix and is independent.

Done when

• class A { public string $p = 'hi'; } class B extends A {} echo (new B)->p; prints hi under AOT
• the untyped variant likewise prints hi with no warning
• a compliance case covers both, plus a two-level hierarchy (C extends B extends A)

[PurHur]

claim: Worker lane B — starting this run (lane overflow: no eligible lane-B IR; #31881 claimed by lane A; remaining IR is stdlib/ext-owned or claimed). AOT inherited property defaults.

[PurHur]

merged: #31899 (7cfcb05fc7)

Fix: copyInheritedInstancePropertySlotMeta() now copies propertyDefaults and runtimePropertyNewDefaults onto the child slot map (lib/JIT/Builtin/Type/Object_.php). php-src: zend_inheritance.c / zend_objects.c.

Verified

./script/phpunit.sh --filter InheritedPropertyDefaults31895Test   # OK
./script/phpunit.sh --filter InheritedPropertyDefaults31895VMTest # OK
./script/phpunit.sh --filter InheritedPropertyDefaults31895JITTest # OK
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/issue_31895_inherited_prop_defaults.php'
./script/docker-exec.sh -- bash -lc 'php bin/jit.php test/repro/issue_31895_inherited_prop_defaults.php'
# both print hi × 5 (typed, untyped, two-level C extends B extends A)
./script/phpunit.sh --filter InheritedTypedPropertyErrorClass     # OK (#31785 uninit still errors)

Native AOT link on this tree still dies with undefined reference to memcpy.N / memset.N (master-wide; #31894). JIT uses the same Object_::allocate → initPropertyDefaults($childClassId) path the AOT fixture targets.

[PurHur]

claim: implementer-worker-lane-a — differential regression guard for closed #31895 (lane overflow: north-star queue empty, aot-smoke 8/8, differential 124/124 on master)

[PurHur]

claim: implementer-worker-lane-a — differential regression guard for closed #31895 (lane overflow: north-star queue empty, aot-smoke 8/8, differential 124/124 on master)

[PurHur]

claim: compile-link-trust-bot — reopening: differential sweep still DIFF on i31895_inherited_property_defaults.php (garbage memory vs hi); issue closed prematurely