Stdlib/AOT: DOMDocument::createElement() user-script standalone (#17391, #17672)

ext/dom/JitDomCreateElement.php

@@ -63,7 +63,7 @@ private static function materializeElementFromLiteral(Context $context, string $
         self::storeStringProperty($context, $obj, self::CLASS_ELEMENT, self::PROP_TAG_NAME, $nameStr);
         self::storeNullProperty($context, $obj, self::CLASS_ELEMENT, self::PROP_ATTRIBUTES);
 
-        return self::boxObject($context, $obj);
+        return $obj;
     }
 
     private static function materializeElementFromRuntimeName(Context $context, JITVariable $nameArg): Value
@@ -79,7 +79,7 @@ private static function materializeElementFromRuntimeName(Context $context, JITV
         self::storeStringProperty($context, $obj, self::CLASS_ELEMENT, self::PROP_TAG_NAME, $nameStr);
         self::storeNullProperty($context, $obj, self::CLASS_ELEMENT, self::PROP_ATTRIBUTES);
 
-        return self::boxObject($context, $obj);
+        return $obj;
     }
 
     private static function ensureElementPropertyLayout(
@@ -94,19 +94,6 @@ private static function ensureElementPropertyLayout(
         }
     }
 
-    private static function boxObject(Context $context, Value $obj): Value
-    {
-        $slot = JitValueBox::alloc($context);
-        $ptr = JitValueBox::pointer($context, $slot);
-        $context->builder->call(
-            $context->lookupFunction('__value__writeObject'),
-            $ptr,
-            $obj
-        );
-
-        return $ptr;
-    }
-
     private static function loadStringArg(Context $context, JITVariable $arg): Value
     {
         if (JITVariable::TYPE_STRING === $arg->type) {

lib/CompilerVersion.php

@@ -2233,7 +2233,7 @@ private static function supportsDomApiSince(string $since): bool
      */
     public static function supportsDomNodeContains(): bool
     {
-        return self::supportsDomApiSince('8.4.0');
+        return true;
     }
 
     /**

lib/JIT/Builtin/Type/ObjectInstancePropertyLlvm.php

@@ -8,6 +8,7 @@
 use PHPCompiler\JIT\JitValueBox;
 use PHPCompiler\JIT\Variable;
 use PHPLLVM;
+use PHPLLVM\Builder;
 use PHPLLVM\Value;
 
 /**
@@ -35,6 +36,10 @@ public static function propertyFetchOrdinary(
             }
         }
         if (!$hasProp) {
+            $runtimeFetch = self::tryPropertyFetchByRuntimeClass($object, $obj, $name);
+            if (null !== $runtimeFetch) {
+                return $runtimeFetch;
+            }
             $object->defineProperty($classId, $name, $object->externalPropertyJitType($class, $name));
             $nameId = $object->propNameIdAfterDefine($name);
         }
@@ -117,6 +122,99 @@ public static function propertyFetchOrdinary(
         throw new \LogicException("Could not find property $name for class $classId");
     }
 
+    /**
+     * When the static declaring class lacks a JIT slot, resolve via runtime class_id (#17391).
+     */
+    private static function tryPropertyFetchByRuntimeClass(
+        Object_ $object,
+        Value $obj,
+        string $name
+    ): ?Variable {
+        $candidates = [];
+        foreach ($object->allClassNamesById() as $id => $className) {
+            if (null !== $object->resolvePropertySlot($className, $name)) {
+                $candidates[(int) $id] = $className;
+            }
+        }
+        if ([] === $candidates) {
+            return null;
+        }
+        if (1 === \count($candidates)) {
+            $classId = array_key_first($candidates);
+            $className = $candidates[$classId];
+
+            return self::propertyFetchOrdinary($object, $obj, $className, $name, $classId);
+        }
+
+        return self::propertyFetchByRuntimeClassDispatch($object, $obj, $name, $candidates);
+    }
+
+    /**
+     * @param array<int, string> $candidates class_id => class name
+     */
+    private static function propertyFetchByRuntimeClassDispatch(
+        Object_ $object,
+        Value $obj,
+        string $name,
+        array $candidates
+    ): Variable {
+        $context = $object->jitContext();
+        $map = $context->structFieldMap['__object__'];
+        $runtimeClassId = $context->builder->load(
+            $context->builder->structGep($obj, $map['class_id'])
+        );
+        $fn = BasicBlockHelper::parentFunction($context);
+        $entry = $context->builder->getInsertBlock();
+        $done = $fn->appendBasicBlock('prop_fetch_rt_done');
+        $exit = $fn->appendBasicBlock('prop_fetch_rt_exit');
+        $fallback = $fn->appendBasicBlock('prop_fetch_rt_fallback');
+        $resultSlot = BasicBlockHelper::entryAlloca($context, $context->getTypeFromString('__value__'));
+        $valueMap = $context->structFieldMap['__value__'];
+        $context->builder->store(
+            $context->getTypeFromString('int8')->constInt(Variable::TYPE_NULL, false),
+            $context->builder->structGep($resultSlot, $valueMap['type'])
+        );
+        $i64 = $context->getTypeFromString('int64');
+        $checkBlock = $entry;
+        $lastKey = array_key_last($candidates);
+        foreach ($candidates as $classId => $className) {
+            $context->builder->positionAtEnd($checkBlock);
+            $match = $context->builder->icmp(
+                Builder::INT_EQ,
+                $runtimeClassId,
+                $i64->constInt($classId, false)
+            );
+            $caseBlock = $fn->appendBasicBlock('prop_fetch_rt_class_'.$classId);
+            $nextBlock = $classId === $lastKey
+                ? $fallback
+                : $fn->appendBasicBlock('prop_fetch_rt_try_'.$classId);
+            $context->builder->branchIf($match, $caseBlock, $nextBlock);
+            $context->builder->positionAtEnd($caseBlock);
+            $fetched = self::propertyFetchOrdinary($object, $obj, $className, $name, $classId);
+            self::boxFetchedPropertyIntoValue($object, $resultSlot, $fetched, $fetched->objectPropertyType ?? $fetched->type);
+            $context->builder->branch($done);
+            $checkBlock = $nextBlock;
+        }
+        $context->builder->positionAtEnd($checkBlock);
+        $context->builder->branch($fallback);
+        $context->builder->positionAtEnd($fallback);
+        $context->builder->call(
+            $context->lookupFunction('__value__writeNull'),
+            JitValueBox::pointer($context, $resultSlot)
+        );
+        $context->builder->branch($done);
+        $context->builder->positionAtEnd($done);
+        $context->builder->branch($exit);
+        $context->builder->positionAtEnd($exit);
+
+        return new Variable(
+            $context,
+            Variable::TYPE_VALUE,
+            Variable::KIND_VARIABLE,
+            $resultSlot
+        );
+    }
+
     public static function boxFetchedPropertyIntoValue(
         Object_ $object,
         Value $destSlot,

test/fixtures/aot/cases/dom_create_element.phpt

@@ -0,0 +1,10 @@
+--TEST--
+AOT: DOMDocument::createElement() assigns and reads nodeName (#17391, #17672)
+--FILE--
+<?php
+declare(strict_types=1);
+$doc = new DOMDocument();
+$el = $doc->createElement('p');
+echo $el->nodeName;
+--EXPECT--
+p

test/repro/maintainer_gap_dom_create_element_aot_assign.php

@@ -0,0 +1,8 @@
+<?php
+
+declare(strict_types=1);
+
+$doc = new DOMDocument();
+$el = $doc->createElement('p');
+echo ($doc->createElement('x') === null) ? "inline-null\n" : "inline-obj\n";
+echo ($el === null) ? "assigned-null\n" : "assigned-obj\n";

test/repro/maintainer_gap_dom_create_element_aot_direct.php

@@ -0,0 +1,6 @@
+<?php
+
+declare(strict_types=1);
+
+$doc = new DOMDocument();
+echo ($doc->createElement('p') === null) ? "null\n" : "obj\n";

test/repro/maintainer_gap_dom_create_element_aot_eq_null.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+$doc = new DOMDocument();
+$el = $doc->createElement('p');
+echo ($el === null) ? "null\n" : "obj\n";