AOT: integer overflow wraps instead of promoting to float — silent wrong arithmetic

[PurHur]

What

PHP promotes integer arithmetic to float on overflow. AOT wraps instead, producing a different number with no error and no warning — the silent-wrong-output class named in AGENTS.md §3.

probe	Zend 8.2.32	AOT
var_dump(PHP_INT_MAX + 1)	float(9.2233720368548E+18)	int(-9223372036854775808)
var_dump(PHP_INT_MAX * 2)	float(1.8446744073709552E+19)	int(2)

Related numeric divergences found in the same sweep

Likely separate causes, listed here so they are not lost:

probe	Zend	AOT
const-folded 7/2	float(3.5)	int(3)
$x = 1.5; $x++;	float(2.5)	int(2)
PHP_INT_MIN % -1	int(0)	int(-1) / int(-9223372036854775808)
abs(PHP_INT_MIN + 1)	int(9223372036854775807)	float(9.2233720368548e+18)
--$null	NULL (no-op)	int(-1)
var_dump(0.1/0.3)	uses serialize_precision	uses precision
echo 1.0E+100	1.0E+100	1e+100
var_dump(INF)	float(INF)	float(inf)
(int)/(float) cast passed directly as a call argument	int(3)	NULL

That last one is worth separating out if it does not share a cause — a cast evaluating to NULL at an argument position is a lowering bug, not a numeric-semantics one.

Provenance

Probe-reported by a differential hunt; not yet independently reproduced. Deterministic outputs (no crashes, no timeouts), so not artifacts of machine load — but please re-run before acting.

Prerequisite

Not measurable before #31894 (merged). script/aot-smoke.sh must read 8/8 before working this.

Done when

• overflow on + and * promotes to float, matching Zend
• each related row above either matches Zend or has its own issue with a distinct cause
• compliance cases cover overflow on both operators

Context: docs/roadmap/AOT-CORRECTNESS-PLAN.md (group 2).

[PurHur]

claim: PHP Compiler Worker Lane C — starting this run

[PurHur]

Merged #31980

Verification (php-src-strict semantics)

• php bin/vm.php test/repro/maintainer_gap_aot_int_overflow.php → both lines are float(...) matching Zend values
• php bin/compile.php -o /tmp/int_overflow test/repro/maintainer_gap_aot_int_overflow.php && /tmp/int_overflow → promotes to float (no wrapped int(-9223372036854775808) / int(2))
• ./script/phpunit.sh --filter IntArithOverflowPromote31964JITTest → OK (1 test)
• ./script/phpunit.sh --filter IntArithOverflowPromote31964AotTest → OK (1 test)

Implementation: lib/JIT/JitLongArithOverflow.php — Zend ZEND_SIGNED_ADD_OVERFLOW / ZEND_LONG_MUL_OVERFLOW wired into native-long and boxed numeric JIT paths.

Not in this PR: related rows in the issue body (7/2 const fold, float $x++, % edge cases, cast-as-arg NULL) — separate causes.