AOT: asymmetric private(set) property reads garbage and write guard never fires (#3165 regression)

[PurHur]

Summary

On current master (4c4c300), AOT binaries mis-compile classes using PHP 8.4 asymmetric property visibility. A public private(set) int property read returns garbage (uninitialized slot) and the set-visibility guard never raises, so program output diverges from VM/JIT. script/capability-syntax.php regeneration in the pinned container now honestly flips the row to AOT=no (synced in the capability doc-sync PR).

Repro

<?php
class C { public private(set) int $x = 1; public function bump(): void { $this->x++; } }
$c = new C(); $c->bump(); echo $c->x, "\n";
try { $c->x = 5; } catch (Error $e) { echo "caught: ", $e->getMessage(), "\n"; }

Driver	Output	rc
bin/vm.php	2 + caught: Cannot modify public private(set) property C::$x from global scope	0
./phpc build + run (AOT)	446409552 (garbage int, no caught line)	0

Environment: php-compiler:22.04-dev (PHP 8.2.31, LLVM 9), PHP_COMPILER_LLVM_PATH=/opt/llvm9.

php-src reference

Zend/zend_compile.c ZEND_ACC_*_SET + zend_object_handlers.c write guard — Zend raises Error: Cannot modify ... and the read path is unaffected.

Notes

• docs/capabilities-syntax.md previously recorded AOT=yes via AsymmetricVisibilityGuard (Language: PHP 8.4 asymmetric property visibility (public/private(set), etc.) #3165, Language: asymmetric visibility JIT/AOT — write-mask enforcement (phase 2 of #3165) #4020); this regressed recently — the flip was caught by the capability-syntax probe during doc resync.
• Likely related to recent property/guard LLVM lowering churn; needs bisect from the last known-good capability sync.

Done when

• AOT output matches VM for the repro (value 2, guard Error caught)
• php script/capability-syntax.php --check green with the row back at AOT=yes
• Compliance phpt covering private(set) read+guard under AOT

🤖 Generated with Claude Code

[PurHur]

claim: cursor-agent-lane-b — starting this run

[PurHur]

Merged via #16361.

Root cause: AOT native typed property reads returned heap pointer addresses (loadValue never loaded int64* slots), and property-write temporaries were promoted to boxed stack slots without objectPropertySlot, bypassing AsymmetricVisibilityGuard.

Verification (Docker, PHP_COMPILER_PROFILE=8.4):

• VM repro: php bin/vm.php test/repro/issue_16354_aot_asymmetric_private_set.php → 2 + caught Error message
• AOT repro: ./phpc build -o /tmp/t test/repro/issue_16354_aot_asymmetric_private_set.php && /tmp/t → 2 + caught (write guard fires; exit 0)
• vendor/bin/phpunit --filter 'AotTest::testCases.*asymmetric_visibility_public_private_set_int' — OK
• vendor/bin/phpunit --filter 'AotTest::testCases.*clone_object' — OK (collateral native-int fix)
• php script/capability-syntax.php --check — asymmetric visibility AOT=yes

Follow-up: $e->getMessage() on caught Error in AOT still segfaults when concatenated (pre-existing try/catch gap); catch without getMessage is green.