[PurHur]

Summary

• Thin-AOT createElement materializes LLVM-only nodes (no DomRegistry). The NestedJIT replaceChild bridge then segfaulted on unregistered objects.
• Sync firstChild / parentNode / element-nav LLVM slots like ParentNode::append; seed childNodes length when the slot was never set (Regression: AOT DOMDocument::replaceChild() segfaults after build — VM/JIT match Zend (ext/dom/node.c) #27216).
• php-src ref: ext/dom/node.c (dom_node_replace_child).

Closes #27216

Test plan

• Issue repro: Zend/VM/JIT/AOT print 1:b; AOT --repeat 10/10
• php vendor/bin/phpunit test/aot/AotTest.php --filter dom_node_replacechild — OK 2 tests
• #27044 live length repro still before=2 / after=3

Verification transcript

zend=1:b
vm=1:b
jit=1:b
aot=1:b (exit 0)
repeat_ok=10/10
live27044=before=2 after=3
AotTest filter dom_node_replacechild: OK (2 tests, 10 assertions)

Gate snapshot (pre-existing master, not this PR): inventory OK 6883/6883; user_release_ready: no (helper-runtime prelink stale + north-star5-fast gen-0 mismatch).

Made with Cursor