AOT: mb_substr()/mb_strcut() SIGSEGV when start/from is a runtime int (leftover of #27028)

[PurHur]

Category

bug · AOT crash · leftover of #27028 / peer #34243 NestedJIT

Problem

mb_substr() / mb_strcut() AOT binaries SIGSEGV (exit 139) when the start/from offset is a runtime integer. Literal offsets fold at compile time and work. VM and Zend match.

Probed 2026-08-23 @ master vs Zend 8.2 (aot-smoke 8/8 first).

Repro	Zend	AOT
mb_substr("über", 1, 2)	string(2) "be"	string(2) "be"
$i=1; mb_substr("über", $i, 2)	string(2) "be"	SIGSEGV
$s="über"; mb_substr($s, 1, 2)	string(2) "be"	string(2) "be"
$s="über"; $i=1; mb_strcut($s, $i, 2)	string(2) "ü"	SIGSEGV

Root shape matches #34243 / #34146: NestedJIT helper call without JitNestedHelperCoerce::callHelper — runtime int ABI mismatch. Helpers also call VmMbstring::{substr,strcut} which NestedJIT misbehaves on (peer MbChrOrdJitHelper).

php-src reference

• php/php-src ext/mbstring/mbstring.c — PHP_FUNCTION(mb_substr), PHP_FUNCTION(mb_strcut)

PHP implementation target

• ext/mbstring/mb_substr.php (JitMbSubstr) + ext/mbstring/JitMbStrcut.php — route through JitNestedHelperCoerce::callHelper
• ext/mbstring/MbStrcutJitHelper.php — NestedJIT-safe UTF-8 peel (no VmMbstring::*)

Repro

./script/docker-exec.sh -- bash -lc 'printf "%s\n" "<?php \$i=1; var_dump(mb_substr(\"über\", \$i, 2));" > /tmp/r.php && php bin/compile.php -o /tmp/r.bin /tmp/r.php && /tmp/r.bin'

Done when

• AOT runtime-int mb_substr / mb_strcut match Zend (no SIGSEGV)
• ./script/aot-smoke.sh stays 8/8
• targeted phpunit / unit guard

[PurHur]

claim: implementer-worker-lane-c — starting this run (AOT SIGSEGV on mb_substr/mb_strcut runtime int offset; leftover of #27028; aot-smoke 8/8 verified)

[PurHur]

claim: implementer-worker-lane-c — continuing this run (WIP callHelper + NestedJIT-safe peel; verifying aot-smoke then repro)

[PurHur]

Verified on master after merge of #34265 (@ 8e5c894536):

• ./script/aot-smoke.sh → 8/8
• ./script/phpunit.sh --filter 'MbSubstrRuntimeShrinkTest|MbStrcutRuntimeShrinkTest' → OK (6 tests, 31 assertions)
• AOT $i=1; mb_substr("über", $i, 2) → string(2) "be"
• AOT $i=1; mb_strcut("über", $i, 2) → string(2) "ü"

Lane C implementer run complete (claim continued through merge).