php-in-php: JIT StringPasswordCryptoJit — route password_hash/verify through VmPassword PHP not ~917-line LLVM (#1492)

[PurHur]

Category

php-in-php · stdlib · php-src-strict

Problem

password_hash() / password_verify() / password_get_info() VM semantics live in PHP (ext/standard/VmPassword.php, VmPasswordNative.php libcrypt FFI), but JIT/AOT still emit a ~917-line LLVM module via lib/JIT/Builtin/StringPasswordCryptoJit.php (lib/JIT/Builtin/StringPasswordCrypto.php).

This duplicates bcrypt/argon2 option parsing, salt generation, and verify loops in LLVM — blocks self-host M5 (#1492) and risks VM/JIT drift on PASSWORD_* constants, invalid algo ValueError, and enum-case operands (#6267).

php-src reference

• php/php-src ext/standard/password.c — php_password_hash, php_password_verify, php_password_get_info
• php/php-src ext/standard/crypt.c — crypt() when routed through password layer

Repro

<?php
$hash = password_hash('secret', PASSWORD_BCRYPT, ['cost' => 4]);
var_export(password_verify('secret', $hash));
echo "\n";
var_export(password_get_info($hash)['algoName'] ?? null);
echo "\n";

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php test/repro-maintainer/password_hash_smoke.php 2>&1 || php bin/vm.php -r "
\$h = password_hash(\"secret\", PASSWORD_BCRYPT, [\"cost\" => 4]);
var_export(password_verify(\"secret\", \$h)); echo PHP_EOL;
"
php bin/jit.php -r "
\$h = password_hash(\"secret\", PASSWORD_BCRYPT, [\"cost\" => 4]);
var_export(password_verify(\"secret\", \$h)); echo PHP_EOL;
" 2>&1 | head -5
'

Check	VM (VmPassword)	JIT (StringPasswordCryptoJit)
password_verify true	expected	must match after migration
Invalid algo	ValueError	same message (not LogicException)

Scope (PHP-in-PHP first)

Layer	Path
PHP SSOT	ext/standard/VmPassword.php, PasswordJitHelper.php (extend)
LLVM to shrink	lib/JIT/Builtin/StringPasswordCryptoJit.php, StringPasswordCrypto.php
Thin ABI	Keep libcrypt FFI in VmPasswordNative.php only — no new runtime/*.c
Tests	test/compliance/cases/stdlib/password_hash*.phpt

Done when

• JIT/AOT password_hash / password_verify / password_get_info call compiled PHP helpers (same as VM)
• StringPasswordCryptoJit.php LLVM removed or reduced to trampoline; PR cites lines deleted
• Enum-case / array algo operands TypeError under php-src-strict on VM and JIT
• ./script/ci-fast.sh --filter password_hash green

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && ./script/ci-fast.sh --filter password_hash'

Related

• php-in-php: password_crypto.c JIT/AOT — VmPassword path must link without C bcrypt shim (~362 lines) #6906, php-in-php: password_get_info()/password_needs_rehash() — VmPassword must not call host PHP (pairs #4794) #6503, Bootstrap: password_hash()/password_verify()/crypt() — no host password extension (ext/standard/password.c) #4794 — VM password work · Epic: Self-host critical path — compiler compiles itself (M3→M5) #1492

[PurHur]

claim: PHP Runtime → PHP — batch (issue #9908: StringPasswordCryptoJit LLVM → PasswordJitHelper / PasswordCryptoRuntime PHP)

[PurHur]

Merged via #11495.

Verification: PasswordCryptoRuntimeShrinkTest + StringPasswordCryptoRuntimeStandaloneTest @aot-lint green; VM/JIT repro password_verify('secret', $h) → true; make bootstrap-selfhost-vm-driver-execute-probe OK.

LLVM shrink: Default JIT embed no longer links StringPasswordCryptoJit (~917 lines); routes through PasswordJitHelper → VmPassword. AOT standalone keeps StringPasswordCryptoStandaloneLlvm quarantine until nested standalone compiles helper (Phi/HashTable blocker).