Performance: v2.0 targets and the codegen roadmap to reach them — typed code ≥ 3x Zend, untyped ≤ 1.5x slower, web request ≥ php-fpm: inline caches for property/method access, escape analysis for arrays/strings, guarded speculation, per-function O1 by default (lib/JIT.php, lib/JIT/Builtin/Type/Object_.php, lib/JIT/Analyzer.php)

[PurHur]

Category

Foundation: · performance program, codegen half · child of #36379

Targets (measured by #7, in the pinned image, geometric mean unless stated)

workload	today (2026-09-01 audit)	v2.0 target
typed recursion / arithmetic (fibo, nbody)	1.1x Zend (regressed from 9x)	≥ 3x faster
untyped calls / loops (simple, closures)	2.5x slower	≤ 1.5x slower
strings / arrays / objects (str-builder, assoc-heavy, object-graph)	10–500x slower or OOM	≤ 1.5x slower
web request (phpc fcgi vs php-fpm)	unmeasured	≥ 1x req/s, ≤ 0.5x memory
startup (hello)	2x faster	keep

Roadmap (each item its own PR series, each gated by #7 and the differential sweeps)

1. Land and verify wave 1's codegen items on the v2 suite: native-long hot path (Perf: typed int arithmetic boxes every result since overflow promotion — fibo(30) 8x slower than the 2026-07-28 build (lib/JIT/JitLongArithOverflow.php) #36189), __value__copy outline (Codegen: every boxed assignment open-codes a 15-block type switch with duplicated error blocks — 111k-line IR module and 51 KB helper functions for a 4-line script (lib/JIT/JitValueBox.php) #36193), light pass pipeline (Codegen: no LLVM pass ever runs at the default level — 40 alwaysinline runtime accessors stay real calls, MCJIT never optimises, and the per-function pass manager is mis-wired to a non-existent symbol (lib/JIT/Context.php runModuleOptimizationPasses, vendor/ircmaxell/php-llvm) #36213 — currently crashes every build on old trees, CI: master is unbuildable both from a clean checkout and on already-patched trees — the #36250 guard demands exactly one replaceVariablesByCfgWalk (a correctly patched file has two) and the pass-manager patch no longer lands on old trees, so every AOT build dies in the new light-opt step (script/apply-patches.sh, patches/php-cfg-simplifier-use-chain.patch, patches/php-llvm-module-createfunctionpassmanager.patch) (re-#36250, re-#36213, re-#36229) #36377), 16-byte __value__ (Runtime: __value__ is 9 bytes / align 1 so every i64/double payload access is an over-aligned (UB) load, and packed arrays allocate 16 B/slot but stride 9 (lib/JIT/Builtin/Type/Value.php, lib/JIT/Builtin/Type/HashTable.php) #36214), string addref (Runtime: every string copy is an eager memcpy — __string__separate ignores the refcount, no copy-on-write (lib/JIT/Builtin/Type/String_.php, lib/JIT/JitValueBox.php) #36192), {main} ownership (AOT: every array or string mutation in {main} scope is O(n²) in time and memory — refcounts never decrement in main, so separateContainerForWrite copies the whole table on every store (16k appends: 6.1 s in main vs 0.011 s inside a function) (lib/JIT/Builtin/Refcount.php phpc_destruct_delref_allowed, lib/JIT/HashTableWriteLlvm.php:1694) #36252).
2. Inline caches for property and method access: __object__ slots are compile-time indexed for the declaring class; for polymorphic receivers emit a per-site (class-id → slot/function) cache with a generic fallback (the shape V8/Zend use). Target: object-graph within 1.5x.
3. Escape analysis for locals: arrays/strings that never escape a function (no return, no store into a container/property/global, no by-ref, no closure capture) become stack allocations with no refcount traffic; Analyzer::canEscape exists for fixed-size int arrays — generalise.
4. Guarded speculation (Perf: untyped loop counters and untyped user calls run boxed through __value__ with per-op type dispatch — add guarded speculation (unboxed i64 loop phis, unboxed call arguments) with the generic path as bail-out (lib/JIT.php, lib/JIT/JitValueNumeric.php, lib/JIT/Call/Native.php) (re-#23483) #36217 landed tag caching only): unboxed i64/double loop phis with a bail-out arm; specialised clones for hot untyped functions when all call sites agree on argument kinds.
5. Per-function O1 by default with the function pass manager (Codegen: no LLVM pass ever runs at the default level — 40 alwaysinline runtime accessors stay real calls, MCJIT never optimises, and the per-function pass manager is mis-wired to a non-existent symbol (lib/JIT/Context.php runModuleOptimizationPasses, vendor/ircmaxell/php-llvm) #36213 step 3), whole-module O2 only for release builds; measure build-time cost on Stdlib: binary/octal radix conversion and PHPT specs #9's gate.
6. String builder shape: .= in a loop with a refcount-1 destination appends in place (Runtime: .= is O(n²) — every append reallocates and memcpys both sides; no capacity field, no runtime interning (lib/JIT/Builtin/Type/String_.pre concat, lib/JIT/Builtin/Type/String_.php:928) #36216 partial landed geometric growth), implode/sprintf/json_encode write into a sized buffer.
7. Calling convention: typed params/returns already native; add native ABI for ?int/?string/int|float (tag + payload in two registers) so nullable-typed code stops boxing.

Done when

• Each roadmap item has its own child issue with a before/after row from Stdlib: empty construct, fmod, and float min/max #7 in the PR
• v2.0 targets met on the v2 suite for 3 consecutive nightlies; docs/pages/bench.html shows the history
• No item ships without script/differential-sweep.sh --aot --repeat 3 unchanged and compliance name-sets unchanged

[PurHur]

claim: implementer-worker-lane-c — starting this run (lane C tie-break #36386 % 3 == 2; lane overflow: #36143–#36148 / #36245 closed; PR #36431 merged scope_exit). Picking a concrete codegen slice that moves typed/untyped ratios toward v2.0 targets.

[PurHur]

Run note (lane C)

Continued open PR #36431 for #36245; peer merged it as c623989d55 while diagnosing. Verified on master after merge:

repro	Zend	AOT
scope_exit / pairs_n	2	2
loop_unset	4	4
live_orphan	orphan=2	orphan=2
single_unset / debug	2	2

Next slice for #36386: benchmarks/simple.php AOT ~5× slower than Zend. IR shows strlen('hallo') already elided, but for-loop $i stays TYPE_VALUE (php-types inferred:unknown) so ++$i expands to the full __value__ inc megapath (~1200 LLVM lines per simplecall). Promote int for-loop counters / $i = 0 named locals in user functions to TYPE_NATIVE_LONG (peer #36018 / #36411).

[PurHur]

Landed slice (PR #36434)

Bug: discardedCallElisionVoidNatives only registered when $callbackType === 'void', but typed-param voids are rewritten to void(*)(__string__*) first — so benchmarks/simple.php hallo(string) / hallo2 never elided.

Fix: capture $isVoidReturn before appending formals (lib/JIT.php).

Verify:

• DiscardedPureCallElisionTest 7/7
• aot-smoke 9/9
• IR call @hallo/@hallo2: 2 → 0

Not this PR: untyped for-loop counters (inferred:unknown → __value__ ++ megapath) still dominate simple.php (~4–5× Zend). Next slice: native-long / guarded speculation for int-only loop CVs (roadmap item 4 on this issue).

[PurHur]

claim: implementer-worker-lane-c — starting this run (lane C tie-break #36386 % 3 == 2; north-star #36143–#36148 closed; continuing #36386 next slice: native-long / guarded speculation for int-only loop CVs)

[PurHur]

Landed slice (PR #36442)

Bug: for ($i = 0; $i < N; ++$i) CVs stay inferred:unknown → AOT __value__ + cast/inc megapath (~1200 LLVM lines / iteration on simplecall).

Fix: Analyzer::canStayNativeLong (SSA + Op\Phi web) + Variable::fromOp → TYPE_NATIVE_LONG for assign-int / ++/-- / compare-only locals.

Verify:

• NativeLongLoopCvAotTest|DiscardedPureCallElisionTest 9/9
• aot-smoke 9/9
• IR @simplecall: int_cast_value_null / incdec_vbox / __value__writeLong → 0; load i64 + add i64 + icmp slt
• differential-sweep --aot --repeat 3: 119 ok; DIFF name-set = master (e08_spread, i31991, i36050, i36354)
• north-star5-verify-fast OK

Not this PR: simple.php still ~2.8× Zend wall (literal strlen ARG_SEND / __string__separate still in loop body after elision of the call itself). Next: elide dead string materialization for discarded calls, or IC/escape slices on the #36386 roadmap.

[PurHur]

claim: implementer-worker-lane-c — starting this run (lane C tie-break #36386 % 3 == 2; north-star #36143–#36148 closed; continuing #36386 next codegen slice after #36442 native-long for-CV)

[PurHur]

Landed slice (PR #36448)

Bug: Variable::fromLiteral for strings emitted __string__separate (unconditional alloc+memcpy) in the caller's CFG arm, so discarded strlen('hallo') in a loop paid a heap copy every iteration even after DiscardedPureCallElision.

Fix: hoist load+separate+store to function entry via BasicBlockHelper::emitAtFunctionEntry (peer of storeAtFunctionEntry #22845). Keep KIND_VARIABLE heap ownership — returning immortal KIND_VALUE without separate caused realloc(): invalid pointer in str_pad/substr/str_replace.

Verification: ImmortalStringLiteralAotTest 4/4; make dev-verify-fast OK; aot-smoke 9/9; c11/e10/e15/e23/c04 AOT match Zend; e08_spread segfaults on master too (#24226).

Part of #36386 — next slice still open (ICs / escape analysis / guarded speculation / nullable ABI).