[PurHur]

Summary

• $o->n ??= $x = 7 stored garbage/0 on the property under AOT because named-storage TYPE_ASSIGN wrote $x but skipped the Assign.result temp that the ??= store reads.
• Extend the existing Regression: AOT UnhandledMatchError/DivisionByZeroError get_class empty — instanceof works (re-#27625, zend_exceptions.c) #29747 resultConsumedLater path into the needsNamedStorageAssign branch so Assign.result is bound when a later op consumes it.

Root cause

php-cfg lowers $o->n ??= $x = 7 as ASSIGN($x, 7) → result temp then property ??= store from result temp. Named-storage assign only wrote $x.

php-src reference

• Zend/zend_execute.c — ZEND_COALESCE / ZEND_ASSIGN / zend_assign_to_variable

Verification

./script/aot-smoke.sh
→ aot-smoke: 8 passed, 0 failed

./script/phpunit.sh --filter 'AotPropCoalesceAssignExprTest|InstancePropCoalesceAssign33748Test|AotPropByrefCoalesceTest'
→ OK (8 tests, 24 assertions)

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/aot_prop_coalesce_assign_expr.php'
→ int(7) int(7) …

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_HELPER_RUNTIME_O=0 php bin/compile.php -o /tmp/coal.bin test/repro/aot_prop_coalesce_assign_expr.php && /tmp/coal.bin'
→ int(7) int(7) … (matches VM)

Not run: differential sweep, compliance suite, north-star5-verify-fast.

Closes #35998

Made with Cursor