AOT: range() module verification fails — RangeIntRuntime BasicBlockHelper appends to user fn (re-#26956/#27211, ext/standard/array.c) #33896

Category

bug · AOT · module verification · php-src-strict · re-#26956 / #27211

Problem

Thin AOT phpc build of range(1, 5) (and char/float peers) fails LLVM module verification. RangeIntRuntime positions the builder in __range_*__copy but BasicBlockHelper::append prefers Context::$loweringLlvmFunction (the in-flight user/main void fn) when it differs from the insert parent — so range_head / returns land in the wrong function.

Peer bridges already set loweringLlvmFunction to the ABI fn (HashTableUnionRuntime, PowIntRuntime, BasicBlockHelper::scopeLoweringToFunction #27211).

php-src reference

• php/php-src ext/standard/array.c — PHP_FUNCTION(range) / php_range

PHP implementation target

• lib/JIT/Builtin/RangeIntRuntime.php — set activeFunction + loweringLlvmFunction to the bridge fn while emitting int/char/float bodies (HashTableUnionRuntime shape); restore in finally
• Unit/compliance guard for range(1,5) AOT compile+run
• No new runtime/*.c

Repro

./script/aot-smoke.sh   # must stay 8/8
./script/docker-exec.sh -- bash -lc 'php bin/compile.php -o /tmp/r.bin test/repro/aot_range_int.php && /tmp/r.bin'

Done when

• AOT range(1,5) / char / float peels print Zend-identical output
• ./script/aot-smoke.sh stays 8/8
• unit or AOT fixture guard