bootstrap-aot-link: VALUE-box concat + ordered float compare lowering

[PurHur]

Summary

Continues #8555 (bootstrap-aot-link): fixes AOT segfault on ?string ternary returns when the non-null value is assigned on the if-entry CFG arm.

This commit (cbf095b61):

• Detect if-entry non-null ?: return merges (jumpIfTargetsReturnMerge)
• For pure string-typed assign sources: emit RETURN from the assign operand on the if arm (skip phi VALUE-box read that was use-after-free under merge-block dead operands)
• For nullable/union if-arms: emit RETURN from each arm tail via shared phi slot (else-string merge path unchanged)

Verification

./script/docker-exec.sh -- bash -lc 'php vendor/bin/phpunit --filter TernaryReturnMergeSlotTest'
# OK (2 tests)

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/t test/repro/ns_nullable_ternary_return.php && /tmp/t'
# /compiler/test/repro/ns_nullable_ternary_return.php (exit 0; was segfault 139)

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/b test/repro/aot_ternary_bool.php && /tmp/b'
# prints path (exit 0)

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/g test/repro/getenv_identical_false.php && /tmp/g'
# yes (exit 0)

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/vbs test/bootstrap-aot/value_bitwise_shift.php && /tmp/vbs'
# 65556

./script/docker-exec.sh -- bash -lc 'make bootstrap-aot-link 2>&1 | grep -c test/bootstrap-aot'
# 16 failures (unchanged vs branch base; gate not green)

Blockers (next)

• test/repro/aot_ternary_ne_null.php — ?string param on if-entry still segfaults (phi return)
• test/bootstrap-aot/ns_func.php — nested ternary / concat candidate path
• Full make bootstrap-aot-link still red

Closes #8555

[PurHur]

claim: worker-lane-b-automation — starting this run

[PurHur]

Update (lane C)

Added commit defda1834: boxed ?string ?: if-entry CFG rewrite (swap arms + invert branch) to match working null === $x ? null : $x codegen shape.

Still not merge-ready — make bootstrap-aot-link remains at 16 failures.

Key blockers documented on #8555:

• aot_ternary_ne_null.php AOT segfault (JIT/VM pass)
• ns_func.php — return inside if after string dim-fetch condition

[PurHur]

Lane B update (WIP — not merging)

Continued #8555/#8563 bootstrap-aot-link work on branch agent/issue-8555-bootstrap-aot-link-lane-c (commit c74f923dc).

Root cause isolated

test/repro/aot_ternary_ne_null.php AOT segfault is not the ?: merge optimization alone:

Pattern	AOT
return null !== $name ? 'fixed' : null	OK
return null === $name ? null : $name (else-entry $name)	OK
return null !== $name ? $name : null (if-entry $name)	segfault
if (null !== $name) { return $name; } return null;	segfault
$r = … ? … : …; return $r;	OK

JIT (bin/jit.php) passes for all shapes; failure is AOT native link/runtime when a ?string param is returned from the if-entry CFG arm.

Changes this run

• Restrict pure-string ?: arm-tail RETURN fast-path; add nullable if-entry branch-target swap hooks
• VM unit test: testNullableStringTernaryIfArmValue
• docs/bootstrap-inventory.md sync (2669 files, bootstrap-inventory-check green)

Verification

./script/docker-exec.sh -- bash -lc './vendor/bin/phpunit test/unit/TernaryReturnMergeSlotTest.php'
# OK (3 tests)

./script/docker-exec.sh -- bash -lc 'php script/bootstrap-inventory.php --check'
# OK 2669/2669

# Still blocked
./script/docker-exec.sh -- bash -lc 'export PHP_COMPILER_BOOTSTRAP_AOT_LINK=1; php bin/compile.php -o /tmp/t test/repro/aot_ternary_ne_null.php && /tmp/t'
# segfault 139

# No regression
./script/docker-exec.sh -- bash -lc 'export PHP_COMPILER_BOOTSTRAP_AOT_LINK=1; php bin/compile.php -o /tmp/t test/repro/ns_nullable_ternary_return.php && /tmp/t'
# OK

Next step

Per d87ae06: dominator-safe entry alloca or CoalesceHelper-style merge for string|null phi, or Compiler rewrite to assign-then-return (proven sound by aot_ternary_return_via_var shape).

[PurHur]

Superseded by #8584 (clean branch from master with compile-time CFG rewrite). Old branch had merge conflicts with master JIT landing.

[PurHur]

Merged #8586

Fix: compile-time rewrite of nullable param returns to $param ?? null + __value__* return ABI for nullable scalars.

Verification (all exit 0):

PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/ne test/repro/aot_ternary_ne_null.php && /tmp/ne
PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/v test/repro/aot_ternary_var_nullable.php && /tmp/v
PHP_COMPILER_BOOTSTRAP_AOT_LINK=1 php bin/compile.php -o /tmp/d test/repro/aot_nullable_param_direct_return.php && /tmp/d
php vendor/bin/phpunit test/unit/NullableNeNullTernaryRewriteTest.php test/unit/NullableStringReturnAbiTest.php

[PurHur]

Merged #8586 — nullable param AOT returns green (see PR body for verification commands).