AOT: integer subtraction overflow wraps instead of promoting to float — leftover of #31964 (Zend/zend_operators.h fast_long_sub_function)

[PurHur]

Category

Language · AOT silent wrong arithmetic · leftover of #31964 (+ / *)

Problem

#31964 promoted native-long + / * overflow to float (JitLongArithOverflow). Native-long subtraction still uses LLVM sub nsw and wraps. Zend sub_function / fast_long_sub_function promotes to double (__builtin_ssubl_overflow / sign-bit check in Zend/zend_operators.h).

Repro	Zend 8.2+ / VM	AOT (master)
var_dump(PHP_INT_MIN - 1)	float(-9.223372036854776E+18)	int(9223372036854775807) (wrap)
$a = PHP_INT_MIN; var_dump($a - 1)	same float	wrap
var_dump(0 - PHP_INT_MIN)	float(9.223372036854776E+18)	wrap

Silent wrong arithmetic — AGENTS.md §3.

php-src reference

• php/php-src Zend/zend_operators.h — fast_long_sub_function (__builtin_ssubl_overflow; portable: signs of operands differ and sign of result differs from op1)
• php/php-src Zend/zend_operators.c — sub_function

PHP implementation target

• lib/JIT/JitLongArithOverflow.php — extend #31964 +/* to TYPE_MINUS (no new runtime/*.c)
• lib/JIT/Helper.php — native-long ⊙ native-long minus uses overflow helper (same shape as plus)

Repro

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/issue_int_sub_overflow.php'
./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_HELPER_RUNTIME_O=0 php bin/compile.php -o /tmp/iso.bin test/repro/issue_int_sub_overflow.php && /tmp/iso.bin'

Done when

• AOT PHP_INT_MIN - 1 / 0 - PHP_INT_MIN match Zend/VM floats
• Runtime (non-folded) $a = PHP_INT_MIN; $a - 1 matches
• ./script/aot-smoke.sh stays 8/8
• php-src-strict; no new runtime/*.c

Refs #31964, #31968

[PurHur]

claim: implementer-worker-lane-a — starting this run (lane overflow: #32122 and listed #31968 children closed; leftover of #31964 native-long subtraction overflow)

[PurHur]

claim: implementer-worker-lane-c — starting this run (lane overflow: #32122 and listed #31968 children closed; #32417 claimed <48h; this is leftover of #31964 native-long minus wrap; 32422%3==1)

[PurHur]

claim: implementer-worker-lane-B — starting this run (32422%3==1; leftover of #31964 native-long subtraction overflow)