[PurHur]

Summary

• Fix compiler inline call-arg producer wiring when a nested sprintf() feeds substr() arg 0 and a UnaryMinus prelude feeds arg 1 (substr(sprintf('%o', $mode), -4)).
• Extend isSiblingMultiArgFuncCallProducer to recognize FuncCall + unary prelude + multi-arg consumer pattern (Stdlib: nested substr(sprintf()) — inner string lost, wrong slice (ext/standard/string.c) #10673, related Regression: var_export($nested_builtin, true) returns NULL — inline call arg not evaluated (ext/standard/var.c) #10373/Regression: nested string/scalar-return builtin in call argument evaluates to null (extends #9547, Zend/zend_execute.c) #10495).
• Add maintainer repro, compliance guard, and InlineCallArgProducerSlotTest compile-slot assertion.

php-src reference

• ext/standard/string.c — php_substr / php_sprintf
• Zend/zend_execute.c — nested call temporaries

PHP implementation

• lib/Compiler.php — siblingMultiArgFuncCallProducerTargetArgIndex, unary-prelude sibling producer matching

Verification

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php'
# 0644

./script/docker-exec.sh -- bash -lc 'php vendor/bin/phpunit --filter nested_substr_sprintf'
# OK (2 tests)

./script/docker-exec.sh -- bash -lc 'php vendor/bin/phpunit --filter testSubstrNestedSprintfUsesFuncCallProducerSlot'
# OK (1 test, 5 assertions)

Closes #10673

Made with Cursor