AOT: fix native typed property fetch and asymmetric private(set) guard (#16354)

[PurHur]

Summary

• Root cause: JIT\Helper::loadValue() returned raw int64* heap pointers for TYPE_NATIVE_LONG instance property slots instead of loading the scalar, so AOT echoed garbage addresses. JIT::assignOperand() also promoted property-fetch temporaries (KIND_VALUE + objectPropertySlot) into boxed stack slots, dropping objectPropertySlot and skipping AsymmetricVisibilityGuard on native-typed writes.
• Fix: Dereference native long/bool/double property slots in loadValue(); skip temporary promotion when objectPropertySlot is set.
• Also fixes: clone_object AOT fixture and other native typed property reads/writes (AOT: asymmetric private(set) property reads garbage and write guard never fires (#3165 regression) #16354 regression from php-in-php: Object_.php tranche 3 — destructor/static/instance property LLVM (#9938) #11704 property-fetch extraction).

Verification

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/issue_16354_aot_asymmetric_private_set.php'
# 2 + caught: Cannot modify public private(set) property C::$x from global scope

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_PROFILE=8.4 ./phpc build -o /tmp/issue16354 test/repro/issue_16354_aot_asymmetric_private_set.php && /tmp/issue16354; echo exit=$?'
# 2 + caught (exit 0 when catch omits getMessage(); getMessage on caught Error in AOT remains a separate gap)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter "AotTest::testCases.*asymmetric_visibility_public_private_set_int"'
# OK (1 test, 5 assertions)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter "AotTest::testCases.*clone_object"'
# OK (1 test, 5 assertions)

PHP_COMPILER_PROFILE=8.4 php script/capability-syntax.php --check
# asymmetric visibility row AOT=yes

Closes #16354

Made with Cursor