AOT: fix heap corruption in multi-variable interpolated echo (#23842)

lib/JIT.php

@@ -8387,21 +8387,28 @@ private function compileBlockInternal(
                     // prologue may already have allocated the scope slot, but in-place CONCAT into
                     // a slot that aliases the left operand corrupts the local (#23798).
                     if ($destIsDeadOperand) {
-                        $left = $this->context->getVariableFromOp($block->getOperand($op->arg2));
-                        $right = $this->context->getVariableFromOp($block->getOperand($op->arg3));
+                        $leftOp = $block->getOperand($op->arg2);
+                        $rightOp = $block->getOperand($op->arg3);
+                        $left = $this->context->getVariableFromOp($leftOp);
+                        $right = $this->context->getVariableFromOp($rightOp);
                         if (JIT\StringOffsetHelper::isWritableCharOffsetLvalue($left, $this->context)) {
                             JIT\StringOffsetHelper::emitAssignOpError($this->context);
                             break;
                         }
-                        $this->assignEphemeralConcatOperand(
-                            $block,
-                            $destOp,
-                            $left,
-                            $right,
-                            $func,
-                            $block->getOperand($op->arg2),
-                            $block->getOperand($op->arg3)
-                        );
+                        if ($this->concatDeadOperandNeedsEntryAlloca($block, $destOp, $leftOp)) {
+                            $this->assignEphemeralConcatOperand(
+                                $block,
+                                $destOp,
+                                $left,
+                                $right,
+                                $func,
+                                $leftOp,
+                                $rightOp
+                            );
+                        } else {
+                            $newVal = $this->compileConcatIntoNewString($left, $right, $leftOp, $rightOp);
+                            $this->assignOperand($destOp, $newVal, true);
+                        }
                         $this->maybeRefreshIncludeBindingsBeforeUse();
                         break;
                     }
@@ -15802,6 +15809,31 @@ function () use ($dest, $newVal): void {
         );
     }
 
+    /**
+     * Entry-alloca ephemeral concat only when the left operand is a named local (#23798).
+     *
+     * Chained dead-temp concats (`$t = $a.' '; $t .= $b`) must keep KIND_VALUE temps — entry
+     * allocas on every link corrupt the heap under AOT (#23842).
+     */
+    private function concatDeadOperandNeedsEntryAlloca(Block $block, Operand $destOp, ?Operand $leftOp): bool
+    {
+        if (!$leftOp instanceof Operand\Variable) {
+            return false;
+        }
+        if ($leftOp === $destOp) {
+            return false;
+        }
+        $name = JIT\OperandName::resolve($leftOp);
+        if (null === $name || '' === $name) {
+            return false;
+        }
+        if (\PHPCompiler\Web\Superglobals::isSuperglobalName($name)) {
+            return false;
+        }
+
+        return $block->hasLocallyWrittenVariableName($name);
+    }
+
     /**
      * Store concat into a php-cfg dead Temporary (echo/call arg) with entry alloca lifetime (#23798).
      *
@@ -15829,6 +15861,7 @@ private function assignEphemeralConcatOperand(
             Variable::KIND_VARIABLE,
             $destSlot
         );
+        $promoted->ephemeralConcatTemp = true;
         JIT\BasicBlockHelper::storeAtFunctionEntry(
             $this->context,
             $func,

lib/JIT/Variable.php

@@ -126,6 +126,9 @@ final class Variable {
     /** Borrowed {@see __value__} entry from foreach by-ref; skip valueDelref (#4364). */
     public bool $borrowedValueEntry = false;
 
+    /** Dead php-cfg Concat temp in echo/call args; lifetime ends after echo (#23798, #23842). */
+    public bool $ephemeralConcatTemp = false;
+
     /** void** property slot on {@see __object__} when this variable is a property lvalue (#58). */
     public ?\PHPLLVM\Value $objectPropertySlot = null;
 
@@ -818,6 +821,9 @@ public function free(): void {
             if (null !== $this->objectPropertySlot) {
                 return;
             }
+            if ($this->ephemeralConcatTemp) {
+                return;
+            }
             $ptr = self::KIND_VALUE === $this->kind
                 ? $this->value
                 : $this->context->helper->loadValue($this);

test/fixtures/aot/cases/toplevel_interp_two_vars.phpt

@@ -0,0 +1,10 @@
+--TEST--
+AOT: interpolated echo with two script globals in one string (#23842, re-#23798)
+--FILE--
+<?php
+$a = 5;
+$b = 9;
+echo "$a $b\n";
+?>
+--EXPECT--
+5 9

test/fixtures/aot/cases/toplevel_interp_two_vars_incdec.phpt

@@ -0,0 +1,12 @@
+--TEST--
+AOT: interpolated echo with two script globals after inc/dec (#23842)
+--FILE--
+<?php
+$a = 5;
+$a--;
+$b = 9;
+$b--;
+echo "$a $b\n";
+?>
+--EXPECT--
+4 8