[PurHur]

Summary

• Fix LanguageScanner::scanVariable() to emit a literal '$' token when $ is not followed by a variable label start (php-src zend_language_scanner.l).
• Resolves token_get_all('<?php $\0 = 1;') returning T_VARIABLE with value '$' instead of a literal dollar + T_BAD_CHARACTER.

php-src reference

• ext/tokenizer/tokenizer.c — token_get_all delegates to Zend scanner
• Zend/zend_language_scanner.l — bad-character handling after $

Verification

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_token_get_all_null_byte.php'
# ok

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/compliance/cases/stdlib/token_get_all_null_byte.phpt'
# dollar / bad_char

./script/docker-exec.sh -- bash -lc 'php -r "
\$src = \"<?php \\\$\\0 = 1;\";
echo json_encode(array_slice(token_get_all(\$src), 1, 2)), PHP_EOL;
" && php bin/vm.php -r "
\$src = \"<?php \\\$\\0 = 1;\";
echo json_encode(array_slice(token_get_all(\$src), 1, 2)), PHP_EOL;
"'
# Both: ["$",[405,"\u0000",1]]

./script/docker-exec.sh -- bash -lc 'vendor/bin/phpunit test/unit/VmTokenizerNativeTest.php --filter 13896'
# OK

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/compile.php -l test/repro/maintainer_gap_token_get_all_null_byte.php'
# exit 0

Closes #13896

Made with Cursor