Self-host M3: PHPTypes/CFG static init in emit-TU LLVM global ctor (link segfault)

[PurHur]

Milestone

M3 — HelloWorld / compile-smoke native emit execute (downstream of parse spine; parent #1492)

Problem

May 2026 update: emit-helper link is green on master for runtime, compile-smoke, and HelloWorld TUs. The first failure is now parseAndCompile returned null at execute (#2566, #2568, #2559–#2567).

This issue tracks the next failure class once parse spine returns a non-null Block: LLVM 9 global ctor / type reconstructor crash during emit-helper execute (historically also seen at link time).

Probe prints NEXT_LOWER: M3 emit TU runtime init (global ctor / type reconstructor; #1937) on partial runs.

Scope

Area	Path	Notes
Emit TU compile	lib/JIT.php — compileM3EmitTuMainNative()	Global init / ctor emission for bundled vendor types
Runtime init	lib/JIT/RuntimeInitVmContext.php	May share ctor ordering with emit TU
PHPTypes	vendor/ircmaxell/php-types/lib/PHPTypes/TypeReconstructor.php	Dynamic property warnings during compile
php-cfg	vendor/ircmaxell/php-cfg/...	Switch_::$cond dynamic property during spine compile
Deny list	lib/JIT.php — m3CompileDriverSpineDenyNames()	Ensure ctor helpers not stubbed when real lowering on

Repro (after #2566 green — may segfault at execute)

./script/docker-exec.sh -- bash -lc '
  source script/php-env.sh
  BOOTSTRAP_M3_LINK_COMPILE_DRIVER=1 \
  BOOTSTRAP_M3_COMPILE_DRIVER_REAL_LOWERING=1 \
  BOOTSTRAP_M3_RUNTIME_COMPILE=1 \
  ./script/bootstrap-m3-emit-tu-execute.sh
'

Prerequisite bisect (fails today at parseAndCompile):

BOOTSTRAP_M3_RUNTIME_COMPILE=1 \
BOOTSTRAP_M3_LINK_COMPILE_DRIVER=1 \
make bootstrap-selfhost-runtime-compile-smoke

Done when

• Self-host M3: runtime_m3_emit execute — parseAndCompile returned null (smallest emit TU) #2559 / Self-host M3: Runtime::parseAndCompile native spine returns null in emit-TU bridge #2566 green (parseAndCompile non-null)
• Emit-helper execute completes without segfault for all three emit TUs
• ./script/bootstrap-selfhost-helloworld-probe.sh (M3 native emit env) reports emit_path=native

Labels

suggested: self-host, bootstrap, IMPORTANT

Epic #1492 · Prerequisite #2566 · #2568 · Execute gate #2552

[PurHur]

Link-time emit-helper Runtime alloc fixed in #2547 (allocateEmitTuShell). Remaining: initVmContext runtime segfault + initParsePipeline PHP CFG link segfault before emit_path=native.