AOT: appendChild/insertBefore/replaceChild(foreign Element) skip Wrong Document — LiveSlots only guards Document (#22710/#30274) #33937

Category

bug · AOT / ext/dom · php-src-strict

Problem

Thin-AOT LiveSlots preflight assertTreeMutationChildBeforeLiveSlots only rejects Document-class children (#30274). Foreign Element (and other tree nodes) from another DOMDocument are accepted and linked — Zend throws DOMException code 4 (Wrong Document Error). VM matches Zend. createElement foreign append can SIGSEGV after the skipped guard.

Also: test/compliance/cases/dom/dom_node_insertbefore_wrong_document.phpt is green on VM and red on AOT.

php-src reference

• php/php-src ext/dom/node.c — dom_node_append_child / insert_before / replace_child → WRONG_DOCUMENT_ERR via same-document check before hierarchy rejection

PHP implementation target

• lib/JIT/Builtin/DomNodeLiveMutationRuntime.php — extend assertTreeMutationChildBeforeLiveSlots to compare owner documents for non-Document children (ownerDocument slot and/or parentNode walk to Document), matching VmDom::assertSameDocument (Regression: appendChild/insertBefore/replaceChild(foreign DOMDocument) — Hierarchy Request not Wrong Document (re-#22698, ext/dom/node.c) #30271)
• Call sites already share this helper: ParentNode::append LiveSlots, JitDomInsertBefore, JitDomReplaceChild

Repro

./script/docker-exec.sh -- bash -lc 'php -r "
\$d1=new DOMDocument(); \$d1->loadXML(\"<r><a/></r>\");
\$d2=new DOMDocument(); \$d2->loadXML(\"<r><b/></r>\");
try { \$d1->documentElement->appendChild(\$d2->documentElement->firstChild); echo \"NO_THROW\\n\"; }
catch (DOMException \$e) { echo \"code=\", \$e->getCode(), \" msg=\", \$e->getMessage(), \"\\n\"; }
"'
# Then same source via bin/compile.php + run binary — expect code=4

Done when

• AOT matches Zend/VM: foreign Element appendChild/insertBefore/replaceChild → DOMException code 4
• createElement foreign append throws (no SIGSEGV)
• Compliance dom_node_insertbefore_wrong_document / dom_node_replacechild_wrong_document green under AOT
• ./script/aot-smoke.sh stays 8/8