[PurHur]

Summary

• Thin AOT NestedJIT of ArrayPushJitHelper::pushFromList / ArrayUnshiftJitHelper::unshiftFromList died on foreach ($ht->iterate()): CFG typed the Traversable temp as PHPCompiler\VM\Variable, so ObjectPropertyForeach boxed a null objectPropertySlot (Builder::call TypeError).
• Append/prepend at the call site via ArrayBuiltinHelper::appendElement and HashTableUnshiftPrepend (VM helpers unchanged).
• JitArrayPush::pushWithValueBoxGuard accepts __value__writeHashtable's TYPE_HASHTABLE tag (masked), not only VM TYPE_ARRAY.
• Safety: already-boxed property fetches copy via JitValueBox::copyFromPointer; HashTableIterate results stay TYPE_HASHTABLE.

Closes #27226

Test plan

• test/repro/aot_array_push_unshift_27226.php — VM / JIT / AOT all print:

  3 1,2,3
  4 0,1,2,3
  

• vendor/bin/phpunit --filter 'ArrayPushRuntimeShrinkTest|ArrayUnshiftRuntimeShrinkTest' — OK (6 tests)
• Not run: full ci-local.sh / north-star5-verify --strict

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
export PHP_COMPILER_HELPER_RUNTIME_O=0
REPRO=test/repro/aot_array_push_unshift_27226.php
php bin/vm.php $REPRO
php bin/jit.php $REPRO
php bin/compile.php -o /tmp/x $REPRO && /tmp/x
vendor/bin/phpunit --filter "ArrayPushRuntimeShrinkTest|ArrayUnshiftRuntimeShrinkTest"
'

Made with Cursor