Tracking: AOT correctness inventory — 44 mismatches in 85 probes across two language areas

[PurHur]

Tracking issue for the AOT correctness work. Full inventory and suggested order live in docs/roadmap/AOT-CORRECTNESS-PLAN.md (PR #31962); background in docs/AGENT-HANDOVER-2026-08-17.md.

How this was measured

A 10-agent differential hunt: each agent takes one language area, writes 15–25 deterministic probe programs (no time, randomness, PIDs or hash-ordering), runs each under Zend 8.2.32 and as an AOT binary, and compares stdout+stderr byte-for-byte.

area	probes run	mismatches
statics	41	21
numerics	44	23
total	85	44

Eight further areas (inheritance, closures, exceptions, arrays, strings, generators, references, enums/traits) were still running when this was filed and are not included. The real total is higher.

Roughly one probe in two mismatches, on ordinary PHP.

Children

issue	group
#31963	float→string conversion — five crashes, incl. one that segfaults the compiler itself
#31964	integer overflow wraps instead of promoting to float — silent wrong arithmetic
#31965	static property read through a closure returns uninitialised memory (unstable)
#31966	invalid IR — module verification failures
#31967	unimplemented lowering — honest errors, lower priority
#31895	inherited property defaults never initialised (verified)

Two things to carry forward

1. None of this was measurable until #31894. Every AOT binary failed to link (aot-smoke: 0 passed, 8 failed, undefined reference to memset.1). Two defects previously reported as separate AOT bugs — var_dump aborting rc=134 and Exception::getMessage() segfaulting — were that same link failure and now match Zend exactly. Run script/aot-smoke.sh before diagnosing anything; if it is not 8/8 you are measuring the toolchain.

2. Provenance is marked deliberately. Only #31895 was re-run by hand. The rest are probe-reported and each issue says so. Please reproduce before fixing — and if a finding does not reproduce, say so on the issue rather than quietly dropping it.

Confound, stated

The hunt ran while the box was at load 129–228 on 16 cores, mostly from unrelated long-running jobs. A wall-clock timeout under that load would be a contention artifact — but the findings carry deterministic signatures (exit 2/255 with specific compiler errors, SIGSEGV, SIGABRT), and no hang findings were reported. That makes the haul plausible, not proven.

Related

• Fix corrupt hunk header that has been aborting the master gate for 19+ runs #31909 — the master gate had failed 19 of its last 20 pushes in apply-patches.sh, never reaching aot-smoke.sh, which is why the link break went unnoticed. Partially fixed; the patch chain needs a pass with a clean vendor.
• docs/roadmap/RELEASE-PLAN.md is stale and still claims CI on lib//ext/ is "green on master".

[PurHur]

Verification attempt: did not converge — and why that is itself informative

I tried to independently reproduce the top findings before anyone acts on them. It did not complete, so every issue in this tracker remains probe-reported, exactly as marked. Recording the attempt so the next person does not repeat it the same way.

What happened

Three runs, none producing a usable verdict:

1. 8 probes, 2400s cap — killed at the cap (exit 143). All output was lost because the command piped through tail, which buffers until completion. Lesson: write verification results incrementally to a file; never pipe a long run through tail.
2. 4 probes, isolated helper-cache dir — var_dump(PHP_INT_MAX + 1) hit the 900s compile timeout. My own fault: giving the run a fresh PHP_COMPILER_HELPER_RUNTIME_CACHE_DIR forces a cold build of the helper units, which is the documented cold-vs-warm cliff (~9 min vs ~5 s). The isolation was unnecessary — nothing else was compiling.
3. Same 4 probes, default warm cache, 600s cap — var_dump(PHP_INT_MAX + 1) timed out again.

The observation worth following up

A one-line program, <?php var_dump(PHP_INT_MAX + 1);, exceeded a 600s compile budget on a warm cache. For comparison, script/aot-smoke.sh compiles eight comparable programs well inside its budget on the same box.

That suggests a possible compile-time hang in integer-overflow constant folding — the expression is constant, so it is folded at compile time, and that is the obvious suspect.

I am not asserting it. The box was at load ~30 (16 cores, mostly unrelated long-running jobs), I did not isolate the compile, and the differential-hunt agent that originally reported this probe evidently did compile it — it reported a concrete AOT output of int(-9223372036854775808). Those two facts are in tension and I have not resolved them.

If someone picks this up: compile <?php var_dump(PHP_INT_MAX + 1); on an idle box with a warm cache and time it. If it hangs, that is a separate and fairly serious issue (the compiler hanging on constant folding); if it compiles in seconds, my runs were contention and #31964 should be verified normally.

[PurHur]

claim: implementer-worker-lane-B — starting this run (lane overflow: #32122 and listed #31968 children are closed; remaining unfiled AOT inventory mismatches from docs/roadmap/AOT-CORRECTNESS-PLAN.md groups 2–3)

[PurHur]

All children are merged with real compiler fixes:

• AOT: inherited property defaults are not initialised — every subclass loses its parent's defaults #31895 inherited property defaults — Language: copy parent instance property defaults onto subclass slots (#31895) #31899
• AOT: float→string conversion crashes — printf/number_format/json_encode/serialize/strval all segfault on floats #31963 float→string crashes — AOT: fix float→string crashes — printf/number_format/json/serialize/strval (#31963) #31990
• AOT: integer overflow wraps instead of promoting to float — silent wrong arithmetic #31964 int overflow wrap vs float promote — AOT: integer overflow promotes to float on + and * (#31964) #31980
• AOT: static property read through a closure returns uninitialised memory (unstable between runs) #31965 static property read through a closure — Regression guards: AOT static property write/read via closure (#31965) #31985 / AOT: static property assign from closure must use module globals (#31965) #31986
• AOT: invalid IR — module verification fails for pow, base_convert, property_exists, function-static string write #31966 invalid IR / module verification — AOT: restore module verify for pow, base_convert, property_exists, function-static (#31966) #32005
• AOT: unimplemented lowering — numeric-string arithmetic, NAN spaceship, enum-as-const, variable static call, self:: interface const #31967 unimplemented lowering — AOT: fix boxed-NAN <=> native double + numeric-string arith guards (#31967) #31981 / AOT: enum-as-const, variable static call, interface self::, static array prop (#31967) #32011

Handover + inventory docs landed in #31962. Further AOT vs Zend mismatches should be new issues with Zend-vs-AOT tables, not kept on this tracker.