AOT: fix heap corruption in multi-variable interpolated echo (#23842)

[PurHur]

Summary

• Fix non-deterministic free(): invalid pointer when AOT-compiled scripts use two script globals in one interpolated echo (echo "$a $b\n") — a regression from AOT: string concat result is freed too early — empty when passed to a function, free(): invalid pointer on reuse #23798 (AOT: fix concat ephemeral temp lifetime for dead echo/call operands (#23798) #23827) that routed every chained dead-temp CONCAT through entry allocas.
• Hybrid lowering: entry alloca only when the left operand is a named local (preserves AOT: string concat result is freed too early — empty when passed to a function, free(): invalid pointer on reuse #23798 echo $s.'1' fix); chained dead-temp links ($t = $a.' '; $t .= $b) revert to KIND_VALUE temps like pre-AOT: string concat result is freed too early — empty when passed to a function, free(): invalid pointer on reuse #23798.
• Mark entry-alloca ephemeral concat results with ephemeralConcatTemp so freeDeadVariables does not delref strings already copied by echo's materializeStringSlot.

Root cause

#23798 correctly fixed in-place concat corrupting named locals, but also applied entry-alloca promotion to chained dead-temp concats (CONCAT($6,$6,$3)). That path intermittently heap-corrupted (7/10 runs on the issue repro). Before #23798: 15/15 green on the same repro.

Verification

# Issue repro — 30/30 runs green (was ~7/30 crash)
./script/docker-exec.sh -- bash -lc '
cat > /tmp/e1.php <<'"'"'PHP'"'"'
<?php $a = 5; $a--; $b = 9; $b--; echo "$a $b\n";
PHP
php bin/compile.php -o /tmp/e1 /tmp/e1.php
for i in $(seq 1 30); do /tmp/e1 || exit 1; done
echo OK
'
# OK

# AOT fixtures (4 tests including #23798 guard)
./script/docker-exec.sh -- bash -lc '"'"'source script/php-env.sh && vendor/bin/phpunit --filter "toplevel_interp_two_vars|concat_inline_echo_same_var|toplevel_incdec_echo" test/aot/AotTest.php'"'"'
# OK (4 tests, 20 assertions)

# Issue repro 1 (loop accumulator after prior inc/dec) — still green
./script/docker-exec.sh -- bash -lc 'php bin/compile.php -o /tmp/t test/differential/cases/g08_toplevel_incdec_echo.php && /tmp/t'
# 3\n5

Not covered

• Full compliance suites, north-star5-verify-fast, differential sweep on this branch.

Closes #23842

Made with Cursor