AOT: loadXML DTD ATTLIST ID / xml:id leaves Attr::isId() false — Zend true (re-#34696/#29884, ext/dom/attr.c)

[PurHur]

Category

bug · AOT · DOM · Pillar Correctness · Attr::isId after loadXML DTD / xml:id

Problem

User-script AOT loadXML already indexes DTD ATTLIST … ID and xml:id for getElementById (#34696), but never stamps the Attr cache ID-bearing flag used by thin-AOT DOMAttr::isId() (#29884). Zend/VM return true; AOT returns false (assigned and chained).

Probed 2026-08-25 @ fc32a91ce6 — Zend 8.2 vs AOT (aot-smoke 8/8).

Repro	Zend / VM	AOT
<!ATTLIST c id ID #IMPLIED> + getAttributeNode('id')->isId()	true	false
same, assigned local $a->isId()	true	false
getElementById('t')	element c	element c (OK)
xml:id="t" + getAttributeNode('xml:id')->isId()	true	false

php-src reference

• php/php-src ext/dom/attr.c — dom_attr_is_id_read / attrp->atype == XML_ATTRIBUTE_ID
• php/php-src ext/dom/document.c — load + xmlAddID from DTD / xml:id

PHP implementation target

• ext/dom/JitDomLoadXMLUserScript.php registerLiveElementIdFromAttrMap — after successful id-map register, DomUserScriptAttributeCacheLlvm::markIdBearingLiteral('', $attrName, true) (peer JitDomSetIdAttribute)
• Do not mark on xmlAddID first-wins duplicate skip (Regression: DOMDocument::getElementById() null after replaceChild same id + setIdAttribute — Zend null, VM finds node (re-#23999, ext/dom/node.c) #25274)

Repro

./script/aot-smoke.sh
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php test/repro/maintainer_gap_dom_getattributenode_isid_chain_after_setid.php
php bin/compile.php -o /tmp/isid test/repro/maintainer_gap_dom_getattributenode_isid_chain_after_setid.php && /tmp/isid'

Done when

• AOT matches Zend/VM for DTD ATTLIST ID and xml:id isId() (assigned + chained)
• getElementById still first-wins / live (AOT: loadXML DTD ID getElementById finds only first element — later IDs null + detached from tree (ext/dom/document.c) #34696)
• ./script/aot-smoke.sh stays 8/8
• Targeted ./script/phpunit.sh --filter … green

Parent / peers

• Residual of AOT: loadXML DTD ID getElementById finds only first element — later IDs null + detached from tree (ext/dom/document.c) #34696 (id map) + Regression: AOT DOMAttr::isId() returns null — Zend/VM/JIT bool (re-#20129, ext/dom/attr.c) #29884 (isId lowering) / Regression: getAttributeNode()->isId() chain null after setIdAttribute / DTD ID — Zend true/false (re-#25841, ext/dom) #25928 (chain after setIdAttribute — that path already green)

[PurHur]

claim: DOM/XML specialist — starting this run (#32122/#31968 children closed; no open DOM claim; Focus=AOT loadXML DTD/xml:id Attr::isId stamp in registerLiveElementIdFromAttrMap)